{ "Event": { "published": true, "date": "2023-05-27", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-05-27", "timestamp": 1685232181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "6c0b9e45-dd9f-45f8-87e5-e21ea4815736", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1c748b-fc8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685191637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191637, "uuid": "47e05064-16f7-441b-9615-235b0e768dfc", "comment": "Malware payload", "value": "3c2d52d17269f8a8d7362f1f08166199", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191637, "uuid": "7cb21d84-53ab-48c4-8926-0bfdc7c97a0e", "comment": "Malware payload", "value": "00c5035cb2ad115135a392893a358acf2e706f81aa56f834d62cd6b2e1da45a6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191637, "uuid": "6ddc0ff1-7729-4127-b555-34b1aafc964f", "comment": "Malware payload", "value": "c30341267028806e5479ee59f2b96c4155235351", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191637, "uuid": "cce4ffce-5f73-4b1d-b522-60cee7fabcea", "comment": "Malware payload", "value": "7ce64f78b70ef3691e915ce4aed1e3e445ba26f019450dbc1e6b9d52621f6d1e518c73c3688c7ad42268c651b366c36e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191637, "uuid": "06c7519d-13cc-4a0a-81c9-4c6705998512", "value": "T123E065CF149958994A0ACEEEB7520CA58945F1CC45EB6F493CC90277D88861C39A1F8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191637, "uuid": "43489f10-cfcf-4be4-af9c-c5acf653a5f9", "value": "6:ebB3w5/KRu7tGBSDRwIxUfrg9FNk7hkKpUfrgoNk7hkKpUfrgYIhFNk7hkKpUfrH:iWKUYBKRwIxpNkNKNkNSIjNkNmzjNk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685191637, "uuid": "2a249a55-98e3-40e9-9539-a3de8efcf6b8", "value": 430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685191637, "uuid": "cc356bcb-486b-4bd9-a3da-27b58115fad0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191637, "uuid": "a1c31e66-cc1c-4ee8-92d0-a966a7c5f805", "value": "a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1449ddf1-fc63-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685173799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173799, "uuid": "bcf2d312-4ff1-4a21-971b-7180a125b20f", "comment": "Malware payload", "value": "7615cc149441014b54dafe91a383c53a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173799, "uuid": "113a35af-b486-4fd5-8174-951f0bceae1b", "comment": "Malware payload", "value": "0113a82f525091132d24bb83b705c7794a439f7146accd67254d47a13dc4cac2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173799, "uuid": "6d144b21-6d37-4384-9964-93b9dc13446d", "comment": "Malware payload", "value": "2d5cb93d78a02e5bf9e405363df3a8f9a5f6cc93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173799, "uuid": "ea8b89f6-c2f2-4ab3-994b-3cf4d079d200", "comment": "Malware payload", "value": "44335afd28300bdc06643c1a42782ab6003dfc3f2911930fa6de6d9167287c98639eaf7814969afd2ccb6f4574bebf9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173799, "uuid": "6248ef26-6f9d-4cb0-893b-355746cb6901", "value": "T12B6340DC721072EFC867C472DEA81DA8EA6578BB931B5213A02315ADDE0D997CF144F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173799, "uuid": "3f803609-5ed0-4823-8c4a-6ce73ae77f99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173799, "uuid": "11e5dba4-4a39-4810-8041-73de3e5efdde", "value": "1536:cNSJ5R/XkDpTDyDbkaduGooo4lX22blOi8a6L:4SfdXqvyDbvlooocm2blOi8a2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685173799, "uuid": "219d2965-c2a5-434f-9db1-e4a7a05da57a", "value": 73216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685173799, "uuid": "79134307-0b8f-4bd4-ba52-d9540c475f3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173799, "uuid": "4116dbb8-df4b-4927-aa45-f331048cd458", "value": "NewNewWatch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c7f3b7a-fcc1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685214292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214292, "uuid": "67fcf3bf-48a3-4f46-a299-f10fa94ef276", "comment": "Malware payload (Mirai)", "value": "c1bf29336790db513f26cc32caf67f7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214292, "uuid": "d597cf03-6425-4b32-a3ec-6d52cf27352c", "comment": "Malware payload (Mirai)", "value": "04eb187673bc70c5b3c2e7cc080bdadd5ab88639493bff2276436c099a25a82e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214292, "uuid": "9d753592-8c48-417c-bd0a-62fc441525e4", "comment": "Malware payload (Mirai)", "value": "6fb87a0bdae8915cef48355026e391d940d7d14b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214292, "uuid": "8f313274-195c-439c-8e49-bfbbc2a576bc", "comment": "Malware payload (Mirai)", "value": "27f20f3670b79e3a428c872bc27ecd88d3098c7bde221598cb1f045a242076a8b698d9bedd6feec8a5f9c7e88eb18a42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214292, "uuid": "2e533f02-285a-41a2-8754-9dc5fab28cd8", "value": "T1947301E42ADBA32BC2CD273DCE545284E17747B3F09F16D69002552C0D8994B78A8DBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214292, "uuid": "ab1ab7fb-99de-4329-80df-1b3be829390a", "value": "1536:uXr1w2X427Dlj972Nl0Vk2ueuSE4X5mcr/CE9CLOUjO9U08R+:ir1w2X97Dlje4k2HZLCE4NR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685214292, "uuid": "ee7b2a06-2661-41f5-b57e-c4b21f910237", "value": 78236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685214292, "uuid": "e3d59a2f-3548-47cd-848e-fe3e7a690a7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214292, "uuid": "1327b1fe-7904-4296-b051-7a76bc191cad", "value": "c1bf29336790db513f26cc32caf67f7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11ad04d-fc8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685191698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191698, "uuid": "c566cc47-6ad2-4d53-8861-d11cc6a19270", "comment": "Malware payload", "value": "92e7bc03935f5f24da9bc850dd9ac51c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191698, "uuid": "15fd92e1-72b3-4ff3-a520-6c3bd143e225", "comment": "Malware payload", "value": "0596951e7464b37c7192006ab19ca824ddc92a2e49738b75d2a6480649acf331", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191698, "uuid": "e5173ec2-1fe2-4233-95af-8ae06611b393", "comment": "Malware payload", "value": "597a0698ceff17091bf7d8d2a97c72836efc18d9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191698, "uuid": "9bcfedfe-f818-4f8b-a5fc-c2a8897b7e9d", "comment": "Malware payload", "value": "2013c667ea62aad8118412385dba3b838347ddb705ae6ce54534a49e2a3f5c109f1eb6127faf0b2d3cc93397bbdcfff7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191698, "uuid": "1e543fe5-039e-4fbe-a771-c968e4835449", "value": "T19FC08CCA01A88C112021CDDAF60288084083D9C80ADA5E0428C701BF889CA0831A1F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191698, "uuid": "7c5180a6-c266-495d-aac5-78683dbd75e5", "value": "3:ebgQRDEnvvBN3w5EnKKZzUfrg9F3N1SHDAWkULEUTvn:ebw73w5/KtUfrg9FNk7vLXTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685191698, "uuid": "e6510d86-75bf-40d0-8a47-bd51eb05151a", "value": 150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685191698, "uuid": "c20b7e40-1eed-491f-81a0-7ba03ef00fd0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191698, "uuid": "31ffea0d-e2cb-465b-a5ed-a0cc1611fbdb", "value": "mm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7792db84-fc87-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685189427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685189427, "uuid": "20eb761c-eabc-4ed0-b796-473deb110fd9", "comment": "Malware payload (RedLineStealer)", "value": "f0a31bd8ad09036faaa7b3eee28ec567", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685189427, "uuid": "e8d9f158-c71e-4cc3-a986-b829a4aa142c", "comment": "Malware payload (RedLineStealer)", "value": "0636a64c4df1c87b196d4ab7d01e39465a0bd2a92f4691b0dadffb22d4596653", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685189427, "uuid": "eaae63a1-c978-4c8b-88b7-0cb5b5632822", "comment": "Malware payload (RedLineStealer)", "value": "f25482f73f4165a8818b222717ba1518f3a6a74b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685189427, "uuid": "5863e8e7-7609-4309-ace5-bc130cc8cbc6", "comment": "Malware payload (RedLineStealer)", "value": "b74894dccd1da435843176d36ebfdc2bae7fc1844fd00425b439d6edf23ab2288e4e3c28a51b7af97bd1eaac56f9a9d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685189427, "uuid": "fed7253a-a9ad-4822-8cca-7818745ea0a7", "value": "T1CDF42353F7D80172E9B157B05DF206C30636BD769C78923B2F86A82908B36949D7633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685189427, "uuid": "a6b58eba-8ea9-4cfb-93b3-a2cec8b9f2bf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685189427, "uuid": "53beb171-a327-42a6-9fd8-26df09b3370d", "value": "24576:yyl0fUWmJh3n+8VEMCjrQl0YFY8MYk3USlvf:ZO83lbOMyrQl05njr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685189427, "uuid": "9069e836-49a5-489b-811f-661fb6f59977", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685189427, "uuid": "f8e5b0e3-638c-4e69-ac7f-b6ba944ff158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685189427, "uuid": "4f8140c8-65ec-4071-b2d0-75abb43af2f2", "value": "f0a31bd8ad09036faaa7b3eee28ec567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9d22ab-fc5a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (BumbleBee)", "timestamp": 1685169974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169974, "uuid": "e7082253-4f07-4fd6-9202-1a1522f01076", "comment": "Malware payload (BumbleBee)", "value": "9d4572f917b9432b617759acc62f4585", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169974, "uuid": "d2d2853f-90f3-4899-940e-718438e2e944", "comment": "Malware payload (BumbleBee)", "value": "063db7b08eacbfec1e75b647f1007e7e551b7c8992c54cb48450dce542056580", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169974, "uuid": "5b87b8cd-1dc8-43c7-befa-6e1bd3f71e79", "comment": "Malware payload (BumbleBee)", "value": "a781b210b3f0aebfb81eebeca9c82eaa02f4b932", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169974, "uuid": "6626d44f-9a25-4edf-aa9a-40968316b446", "comment": "Malware payload (BumbleBee)", "value": "943c796fdb3f65eee3c179966e9e329acffec69402fc93b47b0fa68d9e5852557db36b371daaafa3713d647ff1b749ce", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169974, "uuid": "600e6b7c-964d-45d1-ac8d-e9d8a06f3ef5", "value": "T1ED45E011E2921FF9D46652B680AB352FBB703E1C4311D367EBC0D2377D927A46B1AB60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169974, "uuid": "b0556cb1-321c-4c9b-b67b-f26998032acc", "value": "47e01530ad43ec939d1c47709a80a5c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169974, "uuid": "b3b33aa1-d3ee-4dc4-a820-b0f742599ed7", "value": "24576:d8fDeHYNQfUz6ZFmAltEqaWeqI3gibYWeJVrE6xkY9+N1GFUD:b2guzPHgrrwYtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169974, "uuid": "99380e4d-06cf-4e52-a795-d8e58bd5dd93", "value": 1222669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169974, "uuid": "6dd01631-e4af-4be2-9843-8636ea295a70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169974, "uuid": "a4282be1-7e43-4510-aca2-71d3ddff9a9a", "value": "9d4572f917b9432b617759acc62f4585.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4d003c-fc33-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685153307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153307, "uuid": "bb0580bf-32ae-4d25-abfe-db2d64342ce8", "comment": "Malware payload", "value": "199b64abcb71b6802601bf81fe71a646", "object_relation": "md5", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153307, "uuid": "ccf52a08-c163-4c8b-b3b4-70f505715226", "comment": "Malware payload", "value": "064ee9cc4256a4e004d3c6e74e1a4cc2d686f82a7e22640aa718167b5af40a29", "object_relation": "sha256", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153307, "uuid": "935bb4e7-5955-46b3-aed4-be2317730691", "comment": "Malware payload", "value": "be8894d050617fc80505042aebdcc2d7f1969994", "object_relation": "sha1", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153307, "uuid": "e01fe898-f84b-4e43-a96f-1f4a1c2e08b5", "comment": "Malware payload", "value": "ec14d4cfe6233e70a7dda1706b375021ef888bd1ce1286416121855a81a455da399a85ebb13e128944f2fc24fcb768a6", "object_relation": "sha3-384", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153307, "uuid": "05ef04b7-78ca-425c-ab57-b3acadbc4d36", "value": "T125B41212CB251FAE0D9C07CC8CA45D8B0DCEAD612432E5F4F7DF684B432C969467AB29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153307, "uuid": "398db872-c841-438d-a7f4-56cb53630316", "value": "12288:mla6QGjDAqEgMGmyvZIojQZ4gtAm2m1M7O2DZ5TLMii+FeYHF5k:mlllDJBZgtAxO2l51PeYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685153307, "uuid": "8ea0cdaf-1504-45cc-844d-53d9e80c0703", "value": 503660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685153307, "uuid": "51628fed-f485-4cd8-9327-1cfc219748dc", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153307, "uuid": "0f8bce54-b9c0-4767-a172-ab66fab34d77", "value": "May10-Invoice-DocuSign-6345036.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4e794c-fc75-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685181623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685181623, "uuid": "1015bbf5-5245-4b7a-b7a0-ff416e66d694", "comment": "Malware payload (Amadey)", "value": "47dd5967bd0b0215cd9aa08ebf32c699", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685181623, "uuid": "977bf44b-a158-4c40-95a1-e985f5e50c24", "comment": "Malware payload (Amadey)", "value": "06b9ea24be0e419327e1a90f37f02cbbe07934df6a277e15b3014d2230ed5f18", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685181623, "uuid": "9966b38b-81e6-42d8-9724-1734278d04b6", "comment": "Malware payload (Amadey)", "value": "39b585183552662ab09470ed2f36c8b2a5449ff9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685181623, "uuid": "570f1521-1fd3-45a5-b6f6-0743c1d6d2ce", "comment": "Malware payload (Amadey)", "value": "fb68152e64034a4fabd1cf131a2365c6b7980f828e9659cf78caa27b5ce8d6ddf76651419e9926fa2107f083f7851598", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685181623, "uuid": "c1e0484e-6375-49b9-acf0-ce102ea82add", "value": "T1FFF41253A7D44033D8B61BB028F307D71B397CA58E78936F6785596E1CB2AC1A8703B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685181623, "uuid": "624be308-4bdc-4ba2-a10c-4bceba6b6764", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685181623, "uuid": "0b9e23a5-241b-4e5b-ad80-c01581622c47", "value": "12288:cMr4y90dbl8LBhlAD6Aj2s4yw4sjumBcksFS6PRuPB1zSrY8l913+F0Lk3NT6S2F:cy1+jj2sCcjo6PRuP/yY8EEk3YSZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685181623, "uuid": "c443efbd-7d30-4f62-8bd5-2dadf22f67f8", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685181623, "uuid": "289e3373-8a4d-47ef-ae87-9ec0706b0527", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685181623, "uuid": "941aad5f-3b99-43dd-afc0-d9f97c46043a", "value": "47dd5967bd0b0215cd9aa08ebf32c699.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb36d76-fc8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685190971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190971, "uuid": "b9303d1f-deb5-4743-97b6-488e0397126e", "comment": "Malware payload", "value": "ec10adce9a88b6f1f78bc9d580dd96dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190971, "uuid": "e1c7724c-37e9-4877-8f8d-12e0f236672d", "comment": "Malware payload", "value": "0769287f751519e9f1b81c294788ca586ffd48e6d33c0d1c942c36bf1aa22651", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190971, "uuid": "a40b8c6c-65c0-4d4a-8b04-89be0b3d1065", "comment": "Malware payload", "value": "5f4292b0192a69e93f8ca8d5cfe505a63ebf8db0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190971, "uuid": "40d8f31a-92f9-49b4-81bc-36110a1db656", "comment": "Malware payload", "value": "81608af81f85c38ab2df5bb2b5729dc7b122ae81b32ad5133e7a0b53e8eac7b91a0e39e2f0024a3f4e1ee1eaee17b4bf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685190971, "uuid": "9a13df97-4d18-434c-9641-54fa6ac369af", "value": "T18D13844A6E258FADF768863087BB4E21A75833D712D2D744E16CE9001FB034D785FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685190971, "uuid": "dd8373b2-3446-4b1f-8db7-c9505b0895bb", "value": "768:OF5sS6IXaEd3zrmuQQ5KFlAJSG/v3q/omU98maIg/LCel7Wwi1:yZXL3zrAQ50l3a6AYCQWwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685190971, "uuid": "ca4bd432-2dce-454c-8198-8f63434520bb", "value": 42728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685190971, "uuid": "8e64ae2b-edab-472b-9de1-19fbed91dcbd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685190971, "uuid": "b7fa4f6e-8856-4db5-8207-7d63a4f4881e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09361485-fc5a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685169915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169915, "uuid": "48e97e5d-8c2a-47c7-a09f-07eaa13c5eb8", "comment": "Malware payload", "value": "0c35c759c0266456399510471b77d5e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169915, "uuid": "82bfe3d7-f375-4f6d-be4c-4238749f3309", "comment": "Malware payload", "value": "09345e8cdd272b7cb314ec18e7c3ca69f4fcd2630967a5fb021578f5ecdb2d81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169915, "uuid": "9d38802c-2c34-48b8-837c-af1ab46ce229", "comment": "Malware payload", "value": "a368395c046778b6588538772cc82db4156e75e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169915, "uuid": "f324cd35-dfc1-4244-b68c-1d2347f875ee", "comment": "Malware payload", "value": "c8ce5abb4b34a496ee57923081304b909f230221d83ba2f423086c3c6f255e1f1b56bd0a05cfcef474f35e2b2b746d4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169915, "uuid": "c7e046ae-6d44-4626-bf3e-142091f36d16", "value": "T14524AE213348C47AF86B25B188E9DA755AB97831076F51D7F7D40A2D8F217E2AB3034B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169915, "uuid": "395a430c-0ede-4593-90a3-bbdad290454a", "value": "c431c66e4e6df6a5b1ef02878d31af4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169915, "uuid": "528e9af5-7879-47aa-9ff6-1ae69593dc60", "value": "3072:TODGKo9RRibEbHyjqQ3ezM9QppyyEJ2GKUHtOx5ITx9:TP9ibEbHy5eziQajy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169915, "uuid": "1db0df56-091f-4c00-bc67-96fb41f823c9", "value": 217080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169915, "uuid": "e98e3d6e-cf95-4989-9755-49e2b156a37a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169915, "uuid": "68de2b16-8b2a-452a-b4be-3f9270f2f447", "value": "0c35c759c0266456399510471b77d5e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5dd0023-fca9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685204134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685204134, "uuid": "ea351fa5-cdae-43c6-9c7d-a284c00a798f", "comment": "Malware payload (RedLineStealer)", "value": "bb79a9b36551e10321924199bed28b5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685204134, "uuid": "27c9bbc9-d841-4a77-9094-ca6003442827", "comment": "Malware payload (RedLineStealer)", "value": "0bdc689d741094b2e7b09693bc9322bee5d9a4f993fc1dc63024f956a4f808c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685204134, "uuid": "136dbfa0-5228-4b6a-8b46-ef8588fbdda9", "comment": "Malware payload (RedLineStealer)", "value": "d258d1ffdda11ade9dc4953be8d0de28865d42ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685204134, "uuid": "0a52c8c5-351b-4dfa-9b7c-7c716c08445c", "comment": "Malware payload (RedLineStealer)", "value": "8c85598c36497cf307c5ec0b3e73dd75addacdf092998fd8ab9faac0c698849873e7c5eb9933abef2ddcde9ba4bd170e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685204134, "uuid": "9f3e07e0-c59a-45dd-8fa4-34a13b088452", "value": "T1DCF42252EAD48073E9A8137044F723D3173FBC5268B88B6767819A9C5DB5B60B0317BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685204134, "uuid": "32c3822b-dd2a-4ab0-8e53-4f235aaca511", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685204134, "uuid": "46c1dfd8-dbf0-4fb9-8665-b0ee94cd1b25", "value": "12288:FMrjy90N8yjjOikiA4DRUTo6evKUuQGy5B4dQHLK2RT9FjQadzkkOLw8ziIZmu7C:2yqjjS30RUU652B4+1pLjQad58NlZmJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685204134, "uuid": "b7da8a77-38e7-4a5e-b6ae-e374be811e8a", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685204134, "uuid": "c415232b-f373-4cf7-9347-934764d0a121", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685204134, "uuid": "c6c04e90-c5ff-4e84-a461-26a9e3d4f255", "value": "bb79a9b36551e10321924199bed28b5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6cdaa06-fc92-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685194365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194365, "uuid": "526383a7-7947-4193-a699-d34793f79087", "comment": "Malware payload (Amadey)", "value": "c276d66b18e21d2bcf60bd9658fa56bd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194365, "uuid": "f8042f15-ee5a-4a37-95a5-7fb0f21a8f1a", "comment": "Malware payload (Amadey)", "value": "0d3ef6b4cf3172125dc208808d24392b8a3ff9a55b00b86608c3bc692cd15cec", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194365, "uuid": "51ce7513-caa1-4f67-9649-e24d1a2aba5d", "comment": "Malware payload (Amadey)", "value": "ede108a6ee9563abd647cd899537112af435d064", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194365, "uuid": "78a01380-6e53-45c9-a2c2-f4684526853c", "comment": "Malware payload (Amadey)", "value": "9453da6129e2d718fc0095d144e08c7cdbd2929d25ec78933400289bb37e5ffdf48e3da18fe7927a3457f6907e9666cb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194365, "uuid": "d6031210-ce6b-43d8-b2da-7c8bf0ea461f", "value": "T16E542A1392E17D94E9264E339E2EC6E8771FF6544E0937AA6218ABEF04F0172D173781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194365, "uuid": "86256199-353b-43cb-ab57-29563c8f5802", "value": "697c6731df2df92c82c75859d21c5f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194365, "uuid": "28e91e60-0681-4ef8-add9-f24b6b48293a", "value": "3072:L79SMv2BPsjIpx+8qbmU/R1rDJOqus7Voa9dGIwHr6T2+UDQMz0pUm5Q89yZ:H9SMvpjx8qblPkbMdNwHGT8z38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685194365, "uuid": "5e16fa29-68e1-4248-814f-6180d7ad6934", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685194365, "uuid": "24f2baae-2510-4ace-8258-45c418e85a6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194365, "uuid": "486e4805-2d99-4124-97c5-1429096b2cf6", "value": "08451599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc4262ca-fc8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685191690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191690, "uuid": "b559c946-34d1-4dad-982d-d77a4749ef7a", "comment": "Malware payload", "value": "180f5d2e77d02dc5a7c4b518352b4f57", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191690, "uuid": "ecd5b49c-bc9d-4940-8a71-7aba0d01afaa", "comment": "Malware payload", "value": "0f7caa033127d004c9be64b8dab20df9267ffd7e10d76fb674b5d888fb767778", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191690, "uuid": "6a4f93fa-0223-4316-839f-b14409005cbd", "comment": "Malware payload", "value": "a7ae8b0d0c6767706e59bf8e7dd874cfedda4e91", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191690, "uuid": "c6efba85-fae2-438d-a9aa-df539c6c236d", "comment": "Malware payload", "value": "70eaac485ff6fe809997bcfd3f98d7d6f41cc413fb322c693534cbddbb7c731bbe28db6d2c89f10a88f0918902518922", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191690, "uuid": "28c841b6-76f3-4861-aa7f-ea5c0bb0ffcb", "value": "T1A3E0EDCF00999C850814CAEE77535975280C95DD09DFAF4E7CCA12B6C48561C3164FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191690, "uuid": "ef410e66-128b-44e2-9f4e-a486e5aed195", "value": "6:ebB3w5/Kk4TjOUfr03NFNk7elkKpUfr03TENk7elkKpUfr03oIhFNk7elkKpUfrw:iWKk42BnNkeBTENkeBoIjNkeB0zjNkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685191690, "uuid": "cc0659e8-d71f-43e8-b682-1debaca366cd", "value": 385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685191690, "uuid": "c7ccd1e2-4e89-41ae-8598-3c329229925d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191690, "uuid": "169e9208-25f7-4a87-ac0f-652365cf0285", "value": "l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4864a2a-fc36-11ed-b3cf-42010a9c0076", "comment": "Malware payload (OrcusRAT)", "timestamp": 1685154794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154794, "uuid": "3029ccdc-c306-4647-9b24-62bc75c89652", "comment": "Malware payload (OrcusRAT)", "value": "82a10f282ad38df97046edf8717348fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154794, "uuid": "eb394d30-9224-4497-879c-175f55092397", "comment": "Malware payload (OrcusRAT)", "value": "0fdc4e6cc88a99f2b0871c2720b06eaa6f64e2d0df56e21f7c241d46dc3b993b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154794, "uuid": "64b95be3-9747-4528-ad0b-20cb03423c58", "comment": "Malware payload (OrcusRAT)", "value": "8831189c1fbcc8ac85c982f3fee43032e1d03084", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154794, "uuid": "0ddaaeeb-13fd-462c-b983-65078e8c7930", "comment": "Malware payload (OrcusRAT)", "value": "a86e6e6225dd3739f78cd89c0e6d8824798985650a0cb96ba1fdb78c3742ce939da6a35a75fe100c3c634bc968da8b61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154794, "uuid": "c8ef6c13-cfbb-4a78-8be5-ab964630d15b", "value": "T1E106335F4F169596EB633335CD02A0FA1D553F486DB1BB87085FBAC91BBA3B8113A810", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154794, "uuid": "9c432dbc-7b36-458f-a876-07aa3fb3a79b", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154794, "uuid": "3ae714e4-b7d5-4c98-91af-141f7da03844", "value": "98304:xwafcOVwv4sMeNIJGnOLuvV51IHD8pKyrnX7i03DDHN:hcOVwA9w8VsH1eyXtDDHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685154794, "uuid": "598c6114-0ec7-457f-b314-50079ce96fff", "value": 3948869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685154794, "uuid": "5fdb7dfc-5357-426d-ae47-248568d62838", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154794, "uuid": "9eb691ae-6452-464b-a12e-e0ab642b1ee4", "value": "Scriptware_protected.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff678de7-fc35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685154436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154436, "uuid": "3bd2647a-894c-41bf-b09a-4a9ce8af7b26", "comment": "Malware payload (RedLineStealer)", "value": "bf8a236b406473ca4eacc33112c2453a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154436, "uuid": "a9f2b7de-7793-4730-a300-2ac25c5c19e3", "comment": "Malware payload (RedLineStealer)", "value": "0fef87bf9b6a069f161e43b8214ca380cecad4fb7eda6b2451c41ddbfbb0a7cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154436, "uuid": "baf552de-94c9-4465-b79e-78a8e6de4ea8", "comment": "Malware payload (RedLineStealer)", "value": "676510a5a5e7b9ca85b5debd3c48d20597a30f3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154436, "uuid": "48ccc15c-3cc7-4810-920d-bb0833bbbcd1", "comment": "Malware payload (RedLineStealer)", "value": "f6ade3f71c7411407de884117e1a5271574f7a69c3db77b6c4943d45c024837d85821cc98b4310047c10ebcc56718033", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154436, "uuid": "8fa362fa-a6d5-405b-b6f6-8e7b0e9edbb4", "value": "T186F423927BF88072DCB127B018F707D31B35BDE24D68864B1746285E5CB2BD8A97533A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154436, "uuid": "3d72ca4e-28b0-4acc-80ac-9891440f3623", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154436, "uuid": "ed8bbb95-0d9c-40e7-a453-6c3a3e8c8350", "value": "24576:xyb61r2Z+afTqPxsTLS7OjC8vgk3mSEs:kbK5af+PGXyMbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685154436, "uuid": "068846d5-2447-4187-91e4-e3d2d757785e", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685154436, "uuid": "4914ef96-e513-4f11-971e-6d3f09190e37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154436, "uuid": "6dae17f9-7168-483c-99f3-9175f563e324", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde096e2-fc5d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685171506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685171506, "uuid": "6ee48ced-4415-40ea-9b44-5d295ed3cf68", "comment": "Malware payload (Loki)", "value": "4f4f3e19a67c65345953ccc6fe8da506", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685171506, "uuid": "5bf807ba-796d-4564-a4c8-e996dd83e2d4", "comment": "Malware payload (Loki)", "value": "10945bdcab778a9240bd105c2bbbfdeaa97ae8fe7fa6dcc2ae10b23a189bea08", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685171506, "uuid": "a81bf028-4cf6-4389-9a4d-a07c8d2d7443", "comment": "Malware payload (Loki)", "value": "c12367e37f7ff5a4b5ac93f05a0f4df05fce084e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685171506, "uuid": "a26eecdc-7f58-4732-9f79-c995245caafc", "comment": "Malware payload (Loki)", "value": "b03947ea0018a52d44a5333ede8276ec98f5f4aea27c12a5b6c2abe290e9bf638b12e121731ed51ca879b45d2abba00e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685171506, "uuid": "078974bb-bbd4-46fa-ba23-152cc321b1e8", "value": "T1EDC42218B7A9666ED06F2779002421B1433908AA3523E37B1DD732DD6F30BE517A8F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685171506, "uuid": "95cf27a0-cfe0-4fdc-be28-6aae50af2012", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685171506, "uuid": "7995f0fc-d96e-4a9d-88c7-2b71f653aca7", "value": "12288:MotPplTY6RhKunCyMqbPstLeLzyN02OtTqBJKAJY8OOopcaXskvWaH:MoJTDE4CyMqbPstLKo0xtTOKA+GoHXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685171506, "uuid": "2065b9df-86d2-42dc-a563-4f0f4c58b25f", "value": 567296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685171506, "uuid": "48169927-705c-4bed-b8a7-e315ff7c406f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685171506, "uuid": "e12929de-3fd2-4061-859a-a6b127688d31", "value": "4f4f3e19a67c65345953ccc6fe8da506", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa904118-fc21-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685145838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145838, "uuid": "19f7e479-9995-425f-9929-29678fc747a1", "comment": "Malware payload (Mirai)", "value": "d7d965dce3b520475a53918495d041ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145838, "uuid": "26cffa8e-162e-4738-bbcc-7793c4224b6b", "comment": "Malware payload (Mirai)", "value": "110ff0f964d28170c5c3e911b1b7c991327be1083dace315c79dd2273c4bb0fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145838, "uuid": "217bb35f-bb71-460b-b0d7-d9fa60fd437f", "comment": "Malware payload (Mirai)", "value": "66a10cfcb5a8be11890bf72339f2c46c57c21b1d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145838, "uuid": "f6227ed6-ffe9-4691-82a8-6a71182538fe", "comment": "Malware payload (Mirai)", "value": "c95828cff48f5607ef0d3fb3b96817ec3595ddc97d41db316ac20e41aac10caba4c7a6fe5799a84ee81c43861d1bef8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685145838, "uuid": "13c33827-5d7c-4927-ac78-91cb94468323", "value": "T130931746F8818F12C5C513BAFA2E118E331357A8E2DFB2229D146F2077CA96F0E77595", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685145838, "uuid": "22e7a009-cc52-4ba6-9285-073500c81f28", "value": "1536:L0nPz/cIrBFpfWLHOQB4qSZMH6y/MsRP+T30qIb1yeUwdy4WbpiYIF8ant+QbMuL:YzZ1fYHOE4xZS6sMgPRqIoBwY4Kgb8a1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685145838, "uuid": "fefb5f42-f89a-4d7c-aedf-41ad7c3fce79", "value": 91640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685145838, "uuid": "a5175449-b14c-4957-a97f-3629192f978a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685145838, "uuid": "2d143e6a-f033-4c01-8aa5-8018108d84ef", "value": "d7d965dce3b520475a53918495d041ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "512338ec-fce2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1685228447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685228447, "uuid": "170294e7-3b3f-46fe-a867-60320e7d3019", "comment": "Malware payload (njrat)", "value": "18d1fbf59eb4d288bb2c2ace1764703d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685228447, "uuid": "33e085ab-ceab-47d6-b0e1-f01e2b1ea6f9", "comment": "Malware payload (njrat)", "value": "12398ef7988df8372244cc1589b74591b8fa915e05a4c98ee488daa6e65b0b73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685228447, "uuid": "3dd939e9-f86a-4603-abc9-b5f6953eba69", "comment": "Malware payload (njrat)", "value": "309dc03106f906bdef0cdb924c521b3444ed4d2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685228447, "uuid": "4d230318-6455-441d-8a57-309474f96850", "comment": "Malware payload (njrat)", "value": "1a8541ecb3cfe4adb294aebca25558bdb9ce9e8de5d2cea7fb6e541a5ed5e36402de7467e74a75f0bf69daab1d2a680c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685228447, "uuid": "ce5e8e85-44b1-4adf-8f18-a8479eee48ac", "value": "T147C2D116EB6A82F2D86E4B7BAF7B81D181F0E03579D70D2954680CF5EC42BDE084A753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685228447, "uuid": "98ee18ff-6748-46b6-8d10-8a6bf8077278", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685228447, "uuid": "1ff9628f-7e9d-4fdc-aea3-63d183e7d245", "value": "384:sv3ZINmXEAz6xA3U0M4eTjkDEwjFuszg3Jam5rIL3dBCeWsqfYajiuM+:svpVXE0Sp0ykVpk3J/5w3PCeWgajtT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685228447, "uuid": "83b4ee86-4534-42c3-9f9f-141e9fdaccc3", "value": 25966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685228447, "uuid": "743b4fd4-7730-4078-abb2-0793df2cf5d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685228447, "uuid": "d18ad7be-8283-414f-8f78-9318e18163be", "value": "18d1fbf59eb4d288bb2c2ace1764703d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e5cfe59-fc85-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685188526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685188526, "uuid": "cfb4d1c1-b1b4-4cd4-8147-e42d1081a2aa", "comment": "Malware payload (RedLineStealer)", "value": "0be0531f84f1ac0c0ddc22f6f500cd33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685188526, "uuid": "e0d42b33-cc0c-4d00-8f75-4a49b4205b7b", "comment": "Malware payload (RedLineStealer)", "value": "183ffbc56a2edd6e0939a3961cca532ee8e4d94efdd636273aea4720c850bcae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685188526, "uuid": "3f115cc2-8561-47d6-860f-4496d5f68cbc", "comment": "Malware payload (RedLineStealer)", "value": "aa5555b763824261250085a6ae4277fdebd5feb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685188526, "uuid": "ac0e1e87-5ea9-4ce2-bf58-39047d65653c", "comment": "Malware payload (RedLineStealer)", "value": "9a86d68265aa7a9d0937973aaf427c10c0d284b7a7b94f84801e3d0e4ed5bee1a35af1124f204aec6e1d0c5449575c93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685188526, "uuid": "808210e7-59fc-478b-9654-453a0a71b2a4", "value": "T174352312AAE88832DDF577B05CFD02D30B317CD04D69439E3B91A8A64CB39C469B9767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685188526, "uuid": "6783bcdc-36fd-4789-b7dd-31808ae488a0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685188526, "uuid": "aa056f5f-bea6-4a55-9b68-c443f6fa3f43", "value": "24576:Jy0A/ek+4wJaaXcAXx9k3JSvjP0/8SkZyt+9PIi:8Le2wJX9BQgLP09+9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685188526, "uuid": "3b5acc0d-0fe8-44a7-b6e2-bcb71b37d73c", "value": 1069568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685188526, "uuid": "718818ff-d9f4-4f1c-a5a9-9f57f8d26656", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685188526, "uuid": "4487b81e-28bf-4961-843b-f3f1fa279d40", "value": "0be0531f84f1ac0c0ddc22f6f500cd33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0403c6de-fc93-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685194387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194387, "uuid": "d311ed3e-1ea3-4369-a186-87bc3348b87c", "comment": "Malware payload (Smoke Loader)", "value": "c4d3e12d4ac6276e030b895d56e4b432", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194387, "uuid": "b50d0a38-b952-4ab7-b1ef-0488d688ccc7", "comment": "Malware payload (Smoke Loader)", "value": "189a05734fb38da7a177987c5def7b80959df4525a15ab59f6c61c653b67464b", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194387, "uuid": "2fb34399-9143-40bb-b770-cd3fb3709371", "comment": "Malware payload (Smoke Loader)", "value": "9878f5160144a31891f56909714eb02f69e83891", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194387, "uuid": "05f465c2-5d81-4aed-baef-8f981f5fce7c", "comment": "Malware payload (Smoke Loader)", "value": "d8af1f9e98bb49617521c1a50c486c4f92179184231405f4051e7900414534b9e44b46b5b2b489b82b55cfc651ceded4", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194387, "uuid": "5578bcb8-9e1b-4ed8-a25c-a254ce6de21d", "value": "T1E3543B0396E2FC50ED668A729E2FC6EC7A1DF5508E1937692218ABDF05713B2C173712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194387, "uuid": "a4a6f7e5-ee52-4c8a-9609-efe435faf7f8", "value": "d683fcb523ac92743f5db043ced73806", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194387, "uuid": "c461197c-16a2-41fb-8938-296dcd933c0a", "value": "6144:W7+Wjmp5apRYwTCLLiWGrntvzqaLpb1JBalu:+LjmnapRYwTILiLdqaVb1vwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685194387, "uuid": "85cd018a-1b53-44a4-9ef2-417b8b79ae90", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685194387, "uuid": "11796ed3-6598-4f28-8e99-492f0b0990ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194387, "uuid": "ab6f5b21-2edd-469e-b1fc-158f511fbb02", "value": "09956499.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56267f88-fc33-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685153293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153293, "uuid": "c7a9fac9-8edb-4f72-8f2a-4151ca57a726", "comment": "Malware payload", "value": "d20ce88d19a17e5ee166cb903437186d", "object_relation": "md5", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153293, "uuid": "3d590ece-01fd-4d6e-ad06-b4071e7a46f0", "comment": "Malware payload", "value": "1b1ee0937147d8867227ea72654d3aa7acb54d5bc1d31b7922586f12a30beeb4", "object_relation": "sha256", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153293, "uuid": "133d6c98-6308-4e5b-a76d-0ae9f52d22c7", "comment": "Malware payload", "value": "e93edd3ad9c9361d3202261ad79d65f0bc826c13", "object_relation": "sha1", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153293, "uuid": "bbc248a7-0ab3-4c35-8380-256d934ef7e9", "comment": "Malware payload", "value": "fcda7bf1cb5e3104a79fd77cab5f8732ede32be25bda8ca018d52198da1c48adf08736a6590d721e19ab6eeafbfeef4f", "object_relation": "sha3-384", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153293, "uuid": "ad31e91f-ceeb-46ad-aeb1-0e7df1c7d242", "value": "T10EA41257CF154F6E0EA803C88C950A8B4DCDAC561433E2F4E2EF7857A229E59193DF29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153293, "uuid": "3077cf0e-b404-4f28-a8da-6414743d70eb", "value": "12288:mla6QGjDAqEgMGmyvZIojQZ4gtAm2m1M7O2DZ5u6ws8mJBaa:mlllDJBZgtAxO2l5VXJBaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685153293, "uuid": "118ea09c-0024-4abf-8623-80bbca3300dd", "value": 480397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685153293, "uuid": "9675ec90-81bd-42bc-adc6-594f3f8ffb12", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153293, "uuid": "8a12465b-1320-469b-85da-b948c387fd84", "value": "May10-Invoice-DocuSign-945225.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6236c223-fc7e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685185526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685185526, "uuid": "b6e8d20f-1962-453a-9e37-2cf48f64d697", "comment": "Malware payload (RedLineStealer)", "value": "9315650da95f006ab85dc17a3e84d113", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685185526, "uuid": "9cf52b06-0737-48f6-9018-39a3f1d618fa", "comment": "Malware payload (RedLineStealer)", "value": "1bde29cf3b08be18f78b3f545bb5097c0e2d8429fc8287897b3c076e48038463", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685185526, "uuid": "b5bd6058-fbd7-401c-80cb-bb67792e7854", "comment": "Malware payload (RedLineStealer)", "value": "91b835df728822f19a43b0e9bac8faa4b61886e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685185526, "uuid": "0d588007-1023-4e63-b40a-119c1482b59a", "comment": "Malware payload (RedLineStealer)", "value": "e82c38d960c68e5e8a6ac8bf1cc3008f7c14352463f53b0bbdf861bdacc80bdd2625193a891cea350b0ce2b9e4d95fe9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685185526, "uuid": "649fdb44-d92a-4c96-977a-d2d314319d26", "value": "T198F42213A7E6C173DCA163B029FA1BD70A36BD422D6583173781A95E1D73684E87133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685185526, "uuid": "09c81351-c702-4cf9-98db-045a872cafe0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685185526, "uuid": "ed84fce2-beef-40f1-8eeb-ffba9a1867b4", "value": "12288:jMrpy90TiQKj2CGFPOpbWtK6LoAwLS7WA7Ovb3GmxnY8l9Z3+l0Lk3NTvSgr4F:yyRQKLGFPOxWZoeWAyLY8wkk3FSgr4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685185526, "uuid": "be216bd7-c52f-494e-9ec5-aaa752315b98", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685185526, "uuid": "ee689ec7-2504-464a-91dc-f4ae3bc3b620", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685185526, "uuid": "6587c6d4-1fa5-4755-8ca5-0b564e210b3d", "value": "9315650da95f006ab85dc17a3e84d113.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7db30d-fc59-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685169895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169895, "uuid": "393e6b14-4dfc-4149-ab8a-25b7e8da8836", "comment": "Malware payload", "value": "02d89d4feec8458bde8e4c63f8c754c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169895, "uuid": "4b98d350-62b0-4847-a643-4490a3425645", "comment": "Malware payload", "value": "1ca1d897c0205f39a98addd552f7f340f7efbd5fa836554f5d01f6b9babcfb29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169895, "uuid": "bffe5246-95a5-4a5d-85b0-456a5d3fae6b", "comment": "Malware payload", "value": "0e143c9572f98378295186e6c1f24f311e19f373", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169895, "uuid": "499337ff-f275-4178-8446-e7f42ed43090", "comment": "Malware payload", "value": "bd9a53b572b26c75e31c6a495930dcd5e3db416e0489d02c19d61ad0454e257e035d5fddd44ef4bed5da76826cca11c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169895, "uuid": "5c7aae6e-59ae-402d-9a9c-d1fdfca664c9", "value": "T1FC26D700D601521ADDBB24F54BAD313EB14C9FE0131864D782C86AFADBBA6F13E3559B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169895, "uuid": "e985648f-5bd9-493a-bc8d-2f89b2845db5", "value": "49152:HLz6va++B6xN2+V+tfG2VcruFG2KALO9D3pMDuDhEDL4xqU9uBB7fQbA6qbC6K:rzC+CqfG2VcruFG2KAyVEDLvTQtH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169895, "uuid": "86946890-6f92-4137-a5f0-9b2545c0cf15", "value": 4634070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169895, "uuid": "d38daaab-0be9-41f3-a2a7-41f4bf044fbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169895, "uuid": "c106c773-57de-479d-a95a-e75aa0e82bd6", "value": "02d89d4feec8458bde8e4c63f8c754c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42cdee63-fcc4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685215538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685215538, "uuid": "a7d32044-38b9-4ecc-bb0b-789a216a1825", "comment": "Malware payload (Amadey)", "value": "389da40abfaa23a5d8c31be7215f51c9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685215538, "uuid": "9f027274-75f6-4b11-a9e7-c615d7fad5b9", "comment": "Malware payload (Amadey)", "value": "1d44b8fe417b286bfcd0bac0d51eef0b4e12db441012f44b8ea72ab1d1e57339", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685215538, "uuid": "90f08dd2-16ec-43bd-b065-d7dba30707b9", "comment": "Malware payload (Amadey)", "value": "e5a4d0c782c8d1acda2fbf2edd78871ac34b5aa3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685215538, "uuid": "21d1de9b-c89c-43f6-8422-3e566932fb16", "comment": "Malware payload (Amadey)", "value": "1aef41ab06feb1fbe1a37644db957d7c5056036769168cc86984050d1f9cf784d0c4687cae9fd1ac1ab3aedf1343a277", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685215538, "uuid": "978db9c4-d1b8-4278-8bb0-0fb1cf904261", "value": "T1F9F41222A7D460B2D8BA17B54CF652830B3BBCA11C70935A2311BE5E0C737E5B57636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685215538, "uuid": "d58d7412-d265-4333-b47e-cdaf1fdded5e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685215538, "uuid": "1b3f9112-5743-4752-8a13-dc16504def1c", "value": "12288:qMrYy90bNB34MvDh2Aa+fy8y0uH6fqNgiB9qKwX1oJOdc4ci3W6b+1aq0LtGione:2yuPbvHjf4BApYiXci3W6b+1nyGiW6VZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685215538, "uuid": "f139babd-1ec9-406c-b139-e23cbdbc9673", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685215538, "uuid": "10a2c330-027a-415f-8ba2-8b0cdda6e21a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685215538, "uuid": "edbe9e7c-4d13-4356-bab1-a2f91d5eb6d2", "value": "389da40abfaa23a5d8c31be7215f51c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a169d13-fc59-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685169621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169621, "uuid": "f20f5b41-8475-4ec1-b2c9-c335ddba3c7b", "comment": "Malware payload (RedLineStealer)", "value": "cf26025fe502d2045481bc46a911e62c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169621, "uuid": "713abe49-5186-496e-b713-c4ab23119c42", "comment": "Malware payload (RedLineStealer)", "value": "1dd88baae32ed45983a6f179528b0ea3a656ccc054b71ee92609365c6ad91800", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169621, "uuid": "890b0fde-59c3-49a3-b06c-fa20cd45659f", "comment": "Malware payload (RedLineStealer)", "value": "40b801dbcee0d965f22e238280257c19cff779e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169621, "uuid": "a6182502-97ef-499b-be81-9704f3575214", "comment": "Malware payload (RedLineStealer)", "value": "47e61ba8c2577bdf7e34376fb48cabb1d66963f57676f114f6d47893dc9cff7930eb845ec5577c407eb97076455ee886", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169621, "uuid": "90eaefa7-8ac5-4e2b-b690-66ffd74953d8", "value": "T174F42253B7C881B1C8755BB06DF20B831B373CA65E34831B274A5DAD19F3685A97433A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169621, "uuid": "603334b3-bee0-4282-86cf-1a1ade86c790", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169621, "uuid": "6356f094-f2d3-4117-80d6-17e2205089df", "value": "24576:uy83X0LifLsVGgEtJd+PlV4OpKnNkbY8FZk3bSt:983X0LbVGgEtJd+Pf1pKnNXek2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169621, "uuid": "54437bd0-8c9c-4e6b-834a-5f0d2d0653e1", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169621, "uuid": "67bb89f9-5d17-4799-a8fc-1b232e154ac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169621, "uuid": "e35eb09e-e6ae-4984-b135-81a5ff2dc012", "value": "cf26025fe502d2045481bc46a911e62c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f647fc7b-fcc4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685215839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685215839, "uuid": "0626530b-d173-434a-a6f8-768c13e1af8d", "comment": "Malware payload (RedLineStealer)", "value": "6e651fedaedbfdbcecfef7061d07102d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685215839, "uuid": "0608a732-4114-4acf-9325-3f0f264002ae", "comment": "Malware payload (RedLineStealer)", "value": "1f52e6ef79b5169888761b80ae9b6b2523d94a38d8f191047774dda9d9997a19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685215839, "uuid": "ce3d9a8f-3e2b-4742-8f26-1fc12c0cde3f", "comment": "Malware payload (RedLineStealer)", "value": "8125e74a6067a0f10f167b37a0df8588680e66e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685215839, "uuid": "cf7890a0-c618-40e5-8ede-0fea9f1a6f0c", "comment": "Malware payload (RedLineStealer)", "value": "36b17112fc45798a1ebb620706d91658e306a98d525466679aca1d19395af1c8eb057056ad59debc35dac325126f6a0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685215839, "uuid": "d186931e-634c-4ada-adb6-19b8917df0e4", "value": "T17D252301FFDD4065C47827B01AFA1353073DBD962E799323B345A98A18B2685BCB177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685215839, "uuid": "e99e6b2b-fec1-409d-b798-d19c3cdfccc7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685215839, "uuid": "ef6c292c-8b56-4022-b758-6d933a1693f1", "value": "24576:Jyj11twQLfbfa5+6t0wWb4Xy2srrcQmh:8j1McTfOabdtZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685215839, "uuid": "eda72384-1786-44db-ba7f-d491f1b4c703", "value": 1057280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685215839, "uuid": "d623d715-fc77-410b-9a06-d677b16d4846", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685215839, "uuid": "77c1743b-c6c7-42f3-ad25-14a7945e4010", "value": "6e651fedaedbfdbcecfef7061d07102d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6bec91a-fc58-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685169320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169320, "uuid": "009ea1a9-677b-4469-a63d-6591bec95a9e", "comment": "Malware payload (RedLineStealer)", "value": "a615ba0904a3d390c97af9b5bd271eb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169320, "uuid": "e9c3ca47-9e7e-4d2c-95b1-934aee3bf438", "comment": "Malware payload (RedLineStealer)", "value": "1f5e56dfd2f721e8b0c492c7e186fd5030f35ba1f603e71c13c8d22c818135cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169320, "uuid": "584d8f0a-5d2f-4879-b8a2-1e7e86fcaf47", "comment": "Malware payload (RedLineStealer)", "value": "3f22ad88f673ace6ed45acc484d7166b91c21c71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169320, "uuid": "50b31fe3-0933-4325-a93b-734a345169a0", "comment": "Malware payload (RedLineStealer)", "value": "2ce448d822fb0f9d51a458a8bc858f191d5603493fc18c156b23ac2c202c3b5848e5fd9d2ebbcac1d5f65b458362f33f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169320, "uuid": "9d9f406e-06bf-4c2f-a677-7860098502cd", "value": "T188F4236767E88972D974637058F306831B367CE29C78D29B2751D9AA1C73781B8B033B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169320, "uuid": "bf05b3ea-2cbb-436e-b109-40ba4bb54638", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169320, "uuid": "08d2e9b9-91a2-4752-a2d8-3e1def8c65a6", "value": "24576:kySCH/1PIBmbiOjAw7wilXssYY8Thk3qSD:zfRIciOMw7wYHT0cN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169320, "uuid": "170f9cde-60aa-4e27-8063-e58eff830011", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169320, "uuid": "38068dda-f3cc-416c-a15c-5239b0668c64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169320, "uuid": "63056a07-78a2-40b5-871d-4e748081171f", "value": "a615ba0904a3d390c97af9b5bd271eb7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f06a46-fca4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1685201737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685201737, "uuid": "fedd4ae5-eec0-40d3-8690-927dd5112f08", "comment": "Malware payload (DCRat)", "value": "adac3ea10f4ed158473fe3680fc1efb2", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685201737, "uuid": "47d8b5d6-d542-40d4-8ddb-d1b9fd00c7ed", "comment": "Malware payload (DCRat)", "value": "21f916b721f00ac97997267dfb601165e5718f9253fcf7b07938575c531ccef0", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685201737, "uuid": "c57cdc48-72b1-43e2-a468-0bd04ca47cfe", "comment": "Malware payload (DCRat)", "value": "08b6afa1523b959c8c1cbbfd4ad0188ed65956f9", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685201737, "uuid": "d1080d8c-f74e-4325-9c58-8dd65f42c2bc", "comment": "Malware payload (DCRat)", "value": "7d84816599817f4f6b6969d906ccb30d447c502f03c3cce572bfd1b5f20688553e75a231985aa5940b61503894e579c6", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685201737, "uuid": "4403708b-3c7d-4f08-a835-c9369a3f593b", "value": "T12005DF43E20844FED43918794F9B55A20C443B740BBF0BFFAB97073916616ED962BE4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685201737, "uuid": "932b9bb1-5cb3-404a-ab3e-f5c848ddee28", "value": "e6b23993ae8422553bb383ebec15336d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685201737, "uuid": "195d6eaf-6072-4ddf-8c07-e8d6247945ae", "value": "24576:IK4Sbx1gpQxETtWMrNtKRxU+MBqBPMwsY:Ibm2pQabpQRa+MBqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685201737, "uuid": "8e318a2b-9c6a-4e0d-8648-f36488751590", "value": 819992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685201737, "uuid": "04fbd75b-c8bf-4173-9f4f-4464ee6e5780", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685201737, "uuid": "1a38de75-629b-459b-8ede-a4d8b870f7ca", "value": "adac3ea10f4ed158473fe3680fc1efb2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68f2577-fc92-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685194230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194230, "uuid": "7150beb4-d45f-482a-bdae-b07a486abc8b", "comment": "Malware payload (Amadey)", "value": "da0642b88cab775d0288b92379c838b3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194230, "uuid": "98ef2e3b-dddc-49fd-848e-a2573b39cea3", "comment": "Malware payload (Amadey)", "value": "22e202c18d915a7a543197861b9bdc8ecf79062d7ee1fd7df155726e2f27874a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194230, "uuid": "bd1e43a3-127a-469b-8368-a419826b7bda", "comment": "Malware payload (Amadey)", "value": "4d467ae189cc1457180c9b9a590ca95e82c8267a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194230, "uuid": "16a6c34b-70c7-40fd-a54b-3174a7b27ba2", "comment": "Malware payload (Amadey)", "value": "90032649709f56842945aa8af57e1d566885619806e4269f70de2dc63fae78f56da29c4580bcea9190c9bd80894dcaa5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194230, "uuid": "5ed598be-1a81-4e79-9682-ecfa94f830cf", "value": "T16D25239797E49023CCF50BB148FE13A70F317DA28AB8436B2719659D08B36C5A97473B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194230, "uuid": "39e7bbc4-996a-491a-b2be-02fe64ebf6bf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194230, "uuid": "edf57fec-0ce8-4767-8c0e-92ac1f7473db", "value": "24576:eyfSpfHEkDE6/rU6VdyYQxZRbn2ovKj2I7EH7S:tfIfRDjU6VkHxDjl8EH7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685194230, "uuid": "84fa2678-2d95-4005-bd65-301237c08c58", "value": 1057792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685194230, "uuid": "ee4c9e14-744d-4069-84b7-11fc830958cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194230, "uuid": "b232c844-90e4-4426-90d0-438a747d03c2", "value": "da0642b88cab775d0288b92379c838b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57ce06a7-fc59-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685169617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169617, "uuid": "0967fb71-a4a5-47e4-80c3-c740bb053f7d", "comment": "Malware payload (RedLineStealer)", "value": "b0fe7e463bcbd8c29cadb922d4b3a2a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169617, "uuid": "4a1af8c4-4fb9-423c-af76-9c18f8751a8c", "comment": "Malware payload (RedLineStealer)", "value": "24757d8a949a1fb3f447ffccafd73a10baca77809c6ffc10c78d1b4e991bbbd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169617, "uuid": "5fe32240-3f66-4dc9-848b-d5e825d038ee", "comment": "Malware payload (RedLineStealer)", "value": "6ceb5d11c21df17917d547dbe7bb45b20b118f7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169617, "uuid": "082f4c80-e687-4669-b255-67c04e585303", "comment": "Malware payload (RedLineStealer)", "value": "84974874d52372078a37daceec8d708a74cb6a993eaf3c1d0f6977b5d44760ae61a3ad417ed9e4d786a7bcd5d7d51380", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169617, "uuid": "3b9d0b15-b853-46e9-9da1-9a1ad0d4fd97", "value": "T1E8F42242B7D44172C9B01B3068F71297073BBCE5CEA8927B6742AC9B6CB37929931357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169617, "uuid": "41d25b18-7be6-4d35-8ae5-ef80d8d09788", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169617, "uuid": "a91041ac-01cb-43cc-926f-d1aee23f78d7", "value": "12288:kMrCy90suFQAafXQWipseRjUVSrs9epcdZIi0D1rRFBlVUm8T9l3+EULk3NT8S1s:myf+afasBsIgCQlt+m8S5k3KS1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169617, "uuid": "77a8bc77-d70d-4446-9b47-2f82060d4300", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169617, "uuid": "1184b8ac-4c0f-41fc-8c28-223edf9f2de6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169617, "uuid": "d86e82d6-de81-4435-96b1-fddcf35dbcd2", "value": "b0fe7e463bcbd8c29cadb922d4b3a2a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d1c930-fc92-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1685194288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194288, "uuid": "c4a1f029-3389-425a-b724-6687dfff73da", "comment": "Malware payload (Stop)", "value": "4935047537f2ad199df246e29dd2ac23", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194288, "uuid": "7faa9d1a-76cc-4e2d-afaa-8e009c372aae", "comment": "Malware payload (Stop)", "value": "259ada903b39beb613b1a24d73f6cee28cbd725fa11a3dc45c3fde6687a7a8f1", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194288, "uuid": "eea42d15-363d-4eff-91b4-a6088b292ce5", "comment": "Malware payload (Stop)", "value": "8b11b25579899a72d0ad7415fbdee41b923ed613", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194288, "uuid": "311f3fc4-774f-4769-b2b8-90ca3ab18adf", "comment": "Malware payload (Stop)", "value": "9ff89e7f819ad1ec3187b479399af57fd28c153df9c9aa9d73a8bb181750a1f3544ce4554934fb0645585e1288a0aad0", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194288, "uuid": "cbc6c64d-fbed-4e6b-9bef-e326a731b77d", "value": "T16C05E00392E1FD95E9268A339E2EC5E8771EF7644E497B552218AFEF04F01B2C163781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194288, "uuid": "fd2590b4-2e6e-43ae-92d3-3c4927f9e250", "value": "697c6731df2df92c82c75859d21c5f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194288, "uuid": "a0de62fc-7bbd-4d5b-9b34-9fcb9ec0dda5", "value": "12288:+IkS/y/mxpQMqzU0sgPXcNSQ1imcLnWTxdZVwVBZ+eFefZtjLR6:k7/XzdXcNSQRcLWZVwIeIjd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685194288, "uuid": "37210d6e-c6a3-46a3-9ce6-5e1ace233f59", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685194288, "uuid": "d6157f05-557d-4af9-8d06-bf635142f466", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194288, "uuid": "5d8cf9f8-e7f2-458d-9b1f-89959b2b79af", "value": "07149199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b07a7266-fc8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685191670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191670, "uuid": "f0f6b803-b9ac-405a-a496-9cad77e164e7", "comment": "Malware payload", "value": "30fad4b80fcbf0a45982240eed787db3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191670, "uuid": "0ccfaf73-ebcf-47a6-8757-9363bbf46251", "comment": "Malware payload", "value": "2767861651c0e8ed8321adbbb4e691912b6ae7a835192462971796ebebaed543", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191670, "uuid": "6ef5b3b8-97b8-47a9-a078-a26ad5319f7d", "comment": "Malware payload", "value": "0443d9b805b8efe63c4c196aacada1a6569e5cb7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191670, "uuid": "23d35d99-c2f2-4209-b324-8a7b53ec7693", "comment": "Malware payload", "value": "7ce18fa183d35ed18a90e1175694d521336e29551bb0d778f3e55aa13f3ce4a8dbfbac39babc419de83d137bd1ec26c0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191670, "uuid": "f8b22d69-ba5c-47dd-a74e-3730efdf5e3b", "value": "T1C0E012CF409849960804CEDEB7920D599496E1CC59EBAF4E7CCA0377C88D71C7561F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191670, "uuid": "919f8215-9658-4a31-8ee8-26ba6be73b0d", "value": "6:ebB3w5/KRZpUfrg9FNk7fkKpUfrgoNk7fkKpUfrgYIhFNk7fkKpUfrgEzjNk7fk3:iWKVpNk7KNk7SIjNk7mzjNk8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685191670, "uuid": "829a4de1-9936-4277-844d-52adfdd46c51", "value": 383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685191670, "uuid": "71653abc-30fe-4ad7-97fa-694f1483b804", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191670, "uuid": "1053f7ec-8d46-4cb1-96f8-d6a2c97a58f8", "value": "h", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2538b3d-fc76-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685182224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685182224, "uuid": "4be1b26c-ce14-48b9-b137-9570d1b66aa9", "comment": "Malware payload (Amadey)", "value": "fa3d32d79c2280e84755be6eb31ac908", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685182224, "uuid": "1499f095-1365-4a67-8c47-d1bed6940e7c", "comment": "Malware payload (Amadey)", "value": "28326c8616d70ff7ac513102edbbf41dc541dab318717504eecfc0e3f93d9805", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685182224, "uuid": "cabde076-7990-4d85-85cf-0c90b97017eb", "comment": "Malware payload (Amadey)", "value": "1a020c3c2400df2da3e9c7ecaf001084912515cb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685182224, "uuid": "92138da8-f582-4334-b50b-42f207d9bb46", "comment": "Malware payload (Amadey)", "value": "a5c1ca12e4c2557e87f55c6ba56cef2945d83b9977b6e8a54527ec52dc22734c0cd9ac98b381343602e92766b8b27aab", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685182224, "uuid": "50c4c63e-f09a-4249-9a42-cd9fe80dee2b", "value": "T10BF4231777DC4173D4F02B7068F301830B36BDA29C6D526A3B065D9B5CB2A49ADB6326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685182224, "uuid": "5290c0a8-b332-41bd-9fdb-2996a24c5413", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685182224, "uuid": "14fc318f-1fe1-4860-8534-939828ac7cc3", "value": "24576:ty9HshjzZMEg4RBXtL/uO6y4m8y7k3eS5e:I9MhO4RvuKZ5Gh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685182224, "uuid": "6dd815ea-dcb8-4d11-bce5-d2354883aa3f", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685182224, "uuid": "8adbeeac-e65c-4f8e-979d-2fecead87438", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685182224, "uuid": "74c31a7c-fdb0-4369-9609-40ae50743ceb", "value": "fa3d32d79c2280e84755be6eb31ac908.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9adb1ffb-fc28-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685148684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685148684, "uuid": "4949d7b2-a973-487e-b677-f1cff4b95c05", "comment": "Malware payload (Mirai)", "value": "5b41cfbeba46bce34b90a3f3e1d7e9a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685148684, "uuid": "f76358ed-f552-47a7-936b-099476193a49", "comment": "Malware payload (Mirai)", "value": "294bd62d82aa29e7e522c37cb17791d48909494848bea5acf61f2d071949a416", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685148684, "uuid": "f217e950-d298-4f79-befe-2bdfe81f88a1", "comment": "Malware payload (Mirai)", "value": "28c74c131610e48877f922e1217b02a3e54cd316", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685148684, "uuid": "7739d40a-8362-4e8b-81e1-cd5699331a11", "comment": "Malware payload (Mirai)", "value": "c50047cb1461f7ed410a27c3425f0dcf966dbbd3e7b8dd5ca022604a934f86ee73aff7a672a0107129dc0922e3eefb40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685148684, "uuid": "bb1b2e32-1f09-4693-9c06-bb4d4adaad40", "value": "T1CFA3D40ABF610FF7ECAFDD3749E92701248D651A22A83B757934D818F25B24B59E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685148684, "uuid": "17a3ec14-6547-4170-beb2-d9b7f0a46431", "value": "1536:zbGvn6zh3Te6XVqdyIe2lNSNGe4VZwUxtLoQ:zbGvnboVkIGe4VRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685148684, "uuid": "da6df4a3-f98d-4470-bacf-4c453c0634e9", "value": 105116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685148684, "uuid": "25a2feda-b9e8-4c48-9f46-c247e0a4307d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685148684, "uuid": "3c2ddd5e-c516-4308-9492-8bf0b93afb8d", "value": "5b41cfbeba46bce34b90a3f3e1d7e9a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15cfa6fc-fc92-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1685193987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685193987, "uuid": "44166321-e2e2-436b-855d-040eaaa7276e", "comment": "Malware payload (Stop)", "value": "cb67aba3a72d321e8d59506abdfb6eb5", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685193987, "uuid": "d77d102a-4ba3-48af-9439-b389f3aa637d", "comment": "Malware payload (Stop)", "value": "2af185a498d126fe3c5cc45aaec75ce794857f97879597f4ced63d445ffdd5b1", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685193987, "uuid": "dae5ef36-5ad7-419c-96b0-414de9144504", "comment": "Malware payload (Stop)", "value": "24ad0c2172667086e15fdfa05d036fd5e9fc5722", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685193987, "uuid": "05dcaa70-a586-4470-a6dd-3dd03bc16eb5", "comment": "Malware payload (Stop)", "value": "30388c82dc8b37a6aca3e9b9de42f5139704e6017873b826faf827649910eba42c10359a1683c0b9224c6aec6f3badf1", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685193987, "uuid": "dc25a23e-5be8-4df2-9973-cf2289e8a5a4", "value": "T11F05E14396E17C95E9264B739E2ED6E8771EF7648E4937562218EBEF04F00B2C163381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685193987, "uuid": "5b3ce7f8-56b4-41b7-8461-5bcfc7d4e522", "value": "697c6731df2df92c82c75859d21c5f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685193987, "uuid": "a088299f-2a4f-48e2-93f8-b706a9ce591a", "value": "12288:ybjXglkxpt8B9R2DStTS6be8BGkxOVHvWSXa1iqYpwwRKu:GXSkK9RdRS6be8B/xwvWQacpbUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685193987, "uuid": "bc9a534e-fe5f-4223-9ff2-58360606588f", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685193987, "uuid": "f23fb8cb-6255-45b3-9204-ade643865639", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685193987, "uuid": "c84901b7-bf39-4033-9d43-b47e5f25528f", "value": "02214199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3023f80d-fc63-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685173845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173845, "uuid": "185f4964-4f45-4846-8d18-f3f1c063f88c", "comment": "Malware payload", "value": "edfb8d26fa34436f2e92d5be1cb5901b", "object_relation": "md5", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xoomep1-com", "colour": "#8B5AEF", "exportable": true, "hide_tag": false }, { "name": "xoomep2-com", "colour": "#7479B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173845, "uuid": "79a0de42-8df8-40b4-8317-d62a56d82b16", "comment": "Malware payload", "value": "2b8fcbb905bd0a948a924a0f09534bac65ca444e023e5de301f4d4f83bc840e5", "object_relation": "sha256", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xoomep1-com", "colour": "#8B5AEF", "exportable": true, "hide_tag": false }, { "name": "xoomep2-com", "colour": "#7479B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173845, "uuid": "14a1e064-1927-400c-8418-207aa245c462", "comment": "Malware payload", "value": "79bffe330575dcb9d0fe746325bc42e48da397f4", "object_relation": "sha1", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xoomep1-com", "colour": "#8B5AEF", "exportable": true, "hide_tag": false }, { "name": "xoomep2-com", "colour": "#7479B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173845, "uuid": "ac4b21ad-6c9a-4af0-8027-66b9e83f22ae", "comment": "Malware payload", "value": "78d7cb435b76850c8d9b4b6aae332c12c3b87dbb99dc5e05256b9f7b055676eb01153dc6b79c466816230b45a1d9b7cb", "object_relation": "sha3-384", "Tag": [ { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xoomep1-com", "colour": "#8B5AEF", "exportable": true, "hide_tag": false }, { "name": "xoomep2-com", "colour": "#7479B8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173845, "uuid": "c6949303-6e48-482c-a3b9-8ae36104daeb", "value": "T1671100136A4EBD5C282BF3D5337401911FD78044F45D3952AB58290F6F36C6E49DF894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173845, "uuid": "1ea8e183-2683-41ff-ad2a-fd93ac9afd83", "value": "12:+fx/vONhz7q+mPXjxGSGpzWVTXuZ7/PfY837GXoKIDWUpYL7XBGSaCYubluMNAty:spOhzZmPTxapz1l1yXtIDJCPBmuA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685173845, "uuid": "f6cf6f3f-b889-4dbe-80ea-46fc95e4b112", "value": 908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685173845, "uuid": "e6d825ae-ceaf-4988-b67b-7ad7a695037f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173845, "uuid": "aeb76f5c-e086-4b99-bde1-a31bc4bf3f8c", "value": "client32.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134f7ad0-fc8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685190977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190977, "uuid": "794fc2f5-fad1-46aa-ac0d-a3892a1e2284", "comment": "Malware payload", "value": "eea40c286aa4f4029aecf7120b3f86b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190977, "uuid": "7880e6d6-12c4-4211-8d3b-00f9d3dae93a", "comment": "Malware payload", "value": "30351e2efb882d526fafda7ffccfa27271ce66d4ee385dd2c2087896654600f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190977, "uuid": "3d8068a9-f9c5-47d6-9875-6b1b0ee49fd3", "comment": "Malware payload", "value": "60acccb62565a01f9d7eb76998145b7ff1fb3df0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190977, "uuid": "c7d74b79-1443-4fe3-8c7d-06b35536f1a1", "comment": "Malware payload", "value": "f19be2f9b91748efa54ece1866b1f3978a5c6c7b0844e84afeac138b118f6f59d6c42d4a5ed5f303f176f5c106f7928d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685190977, "uuid": "0c7d3fae-46a8-403b-8b6b-a49d992e4a7a", "value": "T19013A8467E618FDCFBACC63086F75A21569833D226E1C684E56CFD001FA064E745BBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685190977, "uuid": "ad56b37d-25be-4577-8560-f6e26a8f4111", "value": "768:dWuJTF/j5y2MFfF3AseFiukBJoKVYUFIWUm8RJg2kbEMC7JHn:fL/dMF9GFiP40Ag2bMSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685190977, "uuid": "5c516ec3-0110-45a5-b8bd-cbfcadbb8640", "value": 43544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685190977, "uuid": "d839dac7-3e58-4054-b3a3-94e3e3b9b32d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685190977, "uuid": "767de2ea-5f51-4dde-b410-580e36b0ac6b", "value": "mips_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ffc3222-fc8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685191642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191642, "uuid": "c353c703-cbef-4f3a-b3d9-d6d71c845d04", "comment": "Malware payload", "value": "e12818170ca8ac5e8d281efcbe2bbee9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191642, "uuid": "54fc1528-4636-4dd8-a832-64653f5c6950", "comment": "Malware payload", "value": "31d2c267d7135fe201b46b405ff6c8d401f913403cf7ffe5b3c9c980c9a3e081", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191642, "uuid": "dc81496e-6b8b-461b-9383-f32e383a5a35", "comment": "Malware payload", "value": "e9462c2db49667046afa7c62414a8ec466fdc41e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191642, "uuid": "aeaea2a3-8649-493f-bd04-149bebf84800", "comment": "Malware payload", "value": "576cb0b8f82ee5e19468890b1e1c2c72344ac5337a7596cf0b09478acb37a9bdb9a731d3eed72cf81c1674520752f00c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191642, "uuid": "8299f2b4-ed6b-43b5-abe3-8134365de269", "value": "T11DA00291E39002B0EE5C903EEF1C293800850D01CF07C230DE8413C3EC2CA0B3200114", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191642, "uuid": "fc122049-abb2-4128-9ccd-eefeb33d4ea0", "value": "3:XWXyn5FIgKqfvL7gpfFtXyn5v:XQysgKqfT7gpf7yx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685191642, "uuid": "bb8bc613-d1f9-451d-8c6a-03b3c735cd49", "value": 68, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685191642, "uuid": "f3031c25-76e0-4f4a-95f0-098186f8a489", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191642, "uuid": "d8b7f76b-b0b5-4eba-8154-4fd54f7fe15c", "value": "as", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12dc2a23-fc86-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685188829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685188829, "uuid": "f52e9a85-8c7e-46ea-9904-7e7916bf470c", "comment": "Malware payload (Amadey)", "value": "b37131c4e79ed55c4772637698aeb149", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685188829, "uuid": "39336472-8f81-4bf4-9329-ba8243e4ae64", "comment": "Malware payload (Amadey)", "value": "3273af2be3afff55aa4975444416c0dd9afe169eb2525f4acfea7ffb115d8ad2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685188829, "uuid": "e1733ac7-abec-4b82-b2cd-1e7019f805b6", "comment": "Malware payload (Amadey)", "value": "dd5cbef4d97430e67dc188c2cd3c5afaf754811e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685188829, "uuid": "c0db048e-8a21-41b7-8ec7-3a9b5a2dde5b", "comment": "Malware payload (Amadey)", "value": "3edcb2641bd648de75b95c66ff16c27979bc6f6aa6f0ac33e04e3185a9154d05a06cafae819d79410066e85ee1169fb4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685188829, "uuid": "352b8f27-50a1-457d-8ca9-f975d679e9dd", "value": "T16BF42252B7E48032D9B557B09CF10BD3063ABDA16DB8425F37009E9D1CF3685A9B632B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685188829, "uuid": "96d8a9fa-7fca-48ea-991a-3ad5f3100436", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685188829, "uuid": "2b02ba70-4858-4c12-9cff-6df02c768b2e", "value": "24576:Dyb49ckRS54CXwVyyNjXLAcJDTK845k35Sh1:Wb4OYSiwUyJEDmTEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685188829, "uuid": "0a2f48dc-6668-4287-b724-5c0fce7dba34", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685188829, "uuid": "dc69e2cd-71e1-4429-9bd8-8bf2e8b09616", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685188829, "uuid": "1b943e47-7960-48a5-a0c9-f2cfe69f1373", "value": "b37131c4e79ed55c4772637698aeb149.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f258e0e1-fc91-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685193928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685193928, "uuid": "2c14c142-93f7-4de6-a6f9-a331828d85d5", "comment": "Malware payload (Amadey)", "value": "d8aec8f9fd801dad8d6156b22754797f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685193928, "uuid": "9c229d24-6868-4d40-aab7-2ffa0e6f244d", "comment": "Malware payload (Amadey)", "value": "32dcdf0dd4a7aaaf2a590782cd8b2f0852954a7bb3a810f4b1fe1cc8ed3aaddb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685193928, "uuid": "5627b6ec-db39-471e-9212-54484f2aca97", "comment": "Malware payload (Amadey)", "value": "2566218c8d4aaf5af9cac7d424ae7abf68d75c42", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685193928, "uuid": "47599ddf-2ed3-437b-8501-1a24f1d1dea4", "comment": "Malware payload (Amadey)", "value": "e4fe59ef723d8db0f372e54003ab1827d5a69fea4ea03ec0696426808eabed2669f3e1544151883a8e2566e947dc3483", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685193928, "uuid": "55644a3d-ff18-487d-9b50-35fe4f21e673", "value": "T171F41206F6EAD836DC74277548F507D31B36BCA29C78D32B63896D0A18736846A32377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685193928, "uuid": "022e989d-9771-4bc1-bfab-2b4313ddad14", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685193928, "uuid": "33b764ca-d44b-4b9a-a915-9633df2b4375", "value": "12288:6MrHy902kW6QJVzMJSk3OQV6/yr0jXf4BXOTJoSeK4VXfDEOO8XqUwHAn:tyTSuV41w/VrfXGSL4VrEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685193928, "uuid": "43c21957-836c-4d64-ac6d-1022687a4268", "value": 778752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685193928, "uuid": "d1a795ec-4b75-448f-aba5-fd017d061687", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685193928, "uuid": "75170f4a-e623-4e43-80fd-cffd39e183f4", "value": "d8aec8f9fd801dad8d6156b22754797f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92f6ed52-fc7f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685186037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685186037, "uuid": "d4a3b4d0-caec-4027-804e-30972fc472f3", "comment": "Malware payload", "value": "140518164b4e215675accd37cae0d91f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685186037, "uuid": "ef5cb23f-d82b-42f2-8a74-acc4306475e8", "comment": "Malware payload", "value": "3411ad812be09efa84946389ddf8fcbc2c1faa7aec4fd419fe02ec748f746abb", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685186037, "uuid": "6108817d-3d14-4b24-8bb8-cae0441bd62b", "comment": "Malware payload", "value": "605f1798f9b54b245e35ea516c6e3818463953a7", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685186037, "uuid": "87e52653-c8fd-44b2-b96d-27787cae2a95", "comment": "Malware payload", "value": "f31b6fe1957e6eea2dd9f82598c4f777037e13ca0ac13d1a5fa6d1f20329a78e27ab65766d098cc228227332717d8417", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685186037, "uuid": "1e8fb7d9-6039-4f1a-9d57-c8634a0e8db7", "value": "T11CB5022541983FE9CB58673CF079320E57F4158B4A65628EAB63EE06BFF6C080D274B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685186037, "uuid": "44e4cb2f-0da7-426f-a246-cba0da8930dd", "value": "24576:dr8+hKEEFki/cKQSMavHgz6kMtQCJQ5HT0/xBBX0T+DewGEpwERNey20cUIz9Chg:dryEE7kMRy+DeOFYT0hTg+js", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685186037, "uuid": "4c2324a9-74b0-4fcd-a71a-086a309d5f83", "value": 2277691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685186037, "uuid": "9861a9fc-d91e-4b7b-ae99-28b797369616", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685186037, "uuid": "9428ec21-2b04-4e87-8dd4-458f8f463a2e", "value": "deneme.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2efedbe-fc58-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685169448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169448, "uuid": "1d38011a-35da-4d56-bbdd-8bc1b5aaca53", "comment": "Malware payload (AgentTesla)", "value": "950afff340174448d86e0bbc88cb3879", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169448, "uuid": "abc479f3-a191-4f05-b836-4384f252ee8f", "comment": "Malware payload (AgentTesla)", "value": "35770c56e33fb8d8c31fc263cff6070ae9fd06418ce29059ee8f53dd990c4c5d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169448, "uuid": "ef3736cc-dac3-4e69-84ff-7eb6d8d4900f", "comment": "Malware payload (AgentTesla)", "value": "dbad1a06ac5bf66421a85f9a261bc937919497a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169448, "uuid": "6fb7ea07-8a09-4516-b6eb-f6f7a1351237", "comment": "Malware payload (AgentTesla)", "value": "6414bdea8a11ad19f3be98b899e6b9921324657f3334db6df6a5168d1b09f13189bc6f35332495c71fae0925d0d922a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169448, "uuid": "93bac9d0-2dc3-4f23-a6ea-8696f9ced2f2", "value": "T1C6E4124932AA8B57FABA3BF515629BB003F5BC26B535E21A0DC233CF8667F405541B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169448, "uuid": "6ffb7a48-1675-4a58-97ad-9e2e73da1dc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169448, "uuid": "60e3f21e-1b24-4501-bd9b-70250cd4905c", "value": "12288:dKh7z5GoJiGaq5auWTiclj/E7v9simPrzBLOQXOF4Kof6VnqONXez:W5GoR5aWch6IPrzTXOmyOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169448, "uuid": "ceb8c68f-04be-4a22-a0b4-8d9ef7f4e050", "value": 684544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169448, "uuid": "9bb932bc-88a1-403f-99f7-e7be09092dd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169448, "uuid": "2dae4566-b81d-4eaf-89e0-92424390bf1b", "value": "Pedido de art\u00edculos 89753271ES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0115493-fc6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Glupteba)", "timestamp": 1685177925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177925, "uuid": "2f4867b5-d6aa-46dc-b114-0b4e34818cfd", "comment": "Malware payload (Glupteba)", "value": "f2f63eff117bccc4d0f7cd559e84709c", "object_relation": "md5", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177925, "uuid": "1cb091c1-9d59-45ad-baae-9727e744c4e5", "comment": "Malware payload (Glupteba)", "value": "36c4e6ffbc083d627d75542cf79faf4095f0999d242be8fe4cd69da5a73b75b2", "object_relation": "sha256", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177925, "uuid": "9bf5f253-c848-416c-95b2-8f8dc936c54f", "comment": "Malware payload (Glupteba)", "value": "23981bf5cac78a6bc59e3536da4553b228b3a0cb", "object_relation": "sha1", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177925, "uuid": "61be7b68-9dfa-4694-9284-d086c710c253", "comment": "Malware payload (Glupteba)", "value": "4a9f7c0f11385c4d6883992a1f09867a56805b85087846ca8d42fbb8f3e7a629d0dd6faba2586bce0364ec6ea48942e8", "object_relation": "sha3-384", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177925, "uuid": "9086646d-9c97-4696-b435-2b35a0913853", "value": "T18316234382D07D95D56A8B33AE1ED6E8BB0EB6984E5D773732192EE714F0063C173291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177925, "uuid": "58340bff-124f-4720-8851-be75c2ff8834", "value": "697c6731df2df92c82c75859d21c5f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177925, "uuid": "a95eb725-77d2-4279-9e2a-12b0472efc48", "value": "98304:/wwnuY/s3I4HHAgK5AvrW46hqyBPHtRMqZ37r:/Rnuw6Hc2rJeqyBPHtbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685177925, "uuid": "aa786458-f976-41bb-84c5-24a8bba5504d", "value": 4386688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685177925, "uuid": "b4fe39f9-815e-442a-805b-94163518d80c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177925, "uuid": "e8eac069-d430-47eb-b50b-9265943121eb", "value": "04689199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06229f84-fc22-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685145858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145858, "uuid": "91e17619-338d-455d-b16a-0694f908b404", "comment": "Malware payload (Mirai)", "value": "4d0a2a8f04f693064bdbfb3a0d3538a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145858, "uuid": "97d8ed82-8639-4739-b47e-69f35c9fa712", "comment": "Malware payload (Mirai)", "value": "372db9ed2a34d3d7bbae5342dc2ad73c2107342a97f1bfa3d35b1e423886db0f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145858, "uuid": "71b20dcc-4317-463f-8f30-f4145e1e22f7", "comment": "Malware payload (Mirai)", "value": "334d35ee2f1c56749739489272041e7d023ec0b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145858, "uuid": "b897e164-1969-407a-9b0d-ffd629ff11df", "comment": "Malware payload (Mirai)", "value": "11bb89a4c77f590f18f4187e41b47fe4173b7177a7f659d6a7bc4198195cf5fa3dea90a0d50aa02a4a8be643b1ec4c8b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685145858, "uuid": "00e1e4e5-6a59-417e-bbd8-41aa78e9046b", "value": "T1DFF33B46EA818F43C4D6177AF6AF428933239754D3DB73069D28AFB43F8269E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685145858, "uuid": "5471bbac-b266-4fd5-8de0-f6eb3137e251", "value": "3072:8BeYuLWnFJkgCFzgQe8u8gmonXA5ShalEEyZcamKy3cmLOb/32M/9IyHS7:8BeYuLWnFJkgCFzgQe8u5XA0halEEyZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685145858, "uuid": "4760ea7d-326f-4929-8762-8496d57792a7", "value": 163700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685145858, "uuid": "2ad03beb-a1f2-4445-9628-558be421d039", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685145858, "uuid": "7cf3b296-fe2c-4ff0-8ba0-320e8aa425d0", "value": "4d0a2a8f04f693064bdbfb3a0d3538a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66ccbac-fc76-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LaplasClipper)", "timestamp": 1685182231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685182231, "uuid": "cedd3036-fe09-43eb-9d95-da98fd0bfbc4", "comment": "Malware payload (LaplasClipper)", "value": "880cc09f6957f8eea513d876344ac5ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685182231, "uuid": "6c2e65ee-88d6-4189-bc95-c1d3a2d2abcf", "comment": "Malware payload (LaplasClipper)", "value": "374038d3b479d64d002df14a62bc561394613510b82cfbdbce25d18aaab03d27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685182231, "uuid": "30c7132c-d867-49a6-9054-b4d3a5cbdc02", "comment": "Malware payload (LaplasClipper)", "value": "150eef1ecf06848b6440031cbd1f88eb5213adc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685182231, "uuid": "5227a756-d303-42e8-ab25-133b7dc5ac53", "comment": "Malware payload (LaplasClipper)", "value": "428acc8acabc2a59aa1efea0124bc8da753ea3bd8b57da92cf7ca84292d1b31c10b31da82e841edf6fd152d65bcfc5a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685182231, "uuid": "6e8adca8-5cda-44cb-aa9b-5be058f8b12d", "value": "T18BE3270E67884567C2A49879C0EB7E1013B06DBE3E03D37AFD48B05739627D9643B67A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685182231, "uuid": "3d027ba0-ce8a-4db2-af61-a6a756a3c83f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685182231, "uuid": "02d0ab2d-9ef5-4d27-82ed-b64ff0382f75", "value": "1536:P5JHLKlrwB3YlCLtA1myrCM+tKB5dTsET3fA/gthm4dpqgU/KMkDE7JnRlFrkPtd:QlKnwCtM3fvhzqguKMkDEDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685182231, "uuid": "d9483ab8-a97e-4462-99aa-b69499977fb1", "value": 144584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685182231, "uuid": "9225ca6d-b2f9-4058-996a-ca2095762915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685182231, "uuid": "f91f20bf-9442-4505-b91a-5ef9b2235321", "value": "880cc09f6957f8eea513d876344ac5ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da29ff4-fc57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685168714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685168714, "uuid": "1085d797-6e55-4b50-abac-0c8208ebc506", "comment": "Malware payload (RedLineStealer)", "value": "180e932782ada205a5bd11a4981d2ec2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685168714, "uuid": "e6b35d58-974f-4bb1-ba09-1cd9f56a2199", "comment": "Malware payload (RedLineStealer)", "value": "375fe8d379a86dc7544081a8193644e4c8cad4a54229dd4f69f2839cc7e8a2c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685168714, "uuid": "5a6f706a-7a56-4d72-995c-df5d4d3f4434", "comment": "Malware payload (RedLineStealer)", "value": "8abd42ceb5d79291076e37b04bd01dbee8cfacc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685168714, "uuid": "6304b190-b8ab-494f-b0d1-2c998e3bd15e", "comment": "Malware payload (RedLineStealer)", "value": "75767dadeecbe1e9ba13c0d1f21ea962415f531f17a6c641ad307a14fad4d9218d50ee8c7d3f6778ef70feed0f8becae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685168714, "uuid": "97d986b9-8c77-49b2-96e3-04123fcd9a4e", "value": "T1F9F41252ABE84073EEF1577064FB06832B373CA99D7482373B89948A0D736947A75327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685168714, "uuid": "dfe9b68f-a672-4745-a3c7-d7d3ce009579", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685168714, "uuid": "e883299c-d58c-4ce0-978f-c040b71e0633", "value": "12288:ZMrIy90gLPb2FxL0/y/yV9LNUHsjX4AIpZQC7gxMQTQ9m8T9n3+cULk3NTvSQPF:Ny5P2Fa6QUHsjBC0Bem8Qhk3BSQPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685168714, "uuid": "69719001-e6fb-40a9-97c1-3ee81c5d2539", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685168714, "uuid": "64c50ab7-f238-4761-ab6d-36a6925fbc14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685168714, "uuid": "6964a1ab-7ecc-417b-909b-ce922a89069b", "value": "180e932782ada205a5bd11a4981d2ec2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f44974b2-fc58-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685169450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169450, "uuid": "83d5d6ba-6592-45de-964b-530ac0994653", "comment": "Malware payload", "value": "f827c7d9391ccbe826745bd46663af93", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169450, "uuid": "58373280-08ab-42a2-9a0c-66f8a8d51900", "comment": "Malware payload", "value": "37bcbca40683417e501ad03428ba9202369a9b4b07b02acabde371c853f2dc7b", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169450, "uuid": "e7941507-9081-4ad7-80b4-46a84e8f9856", "comment": "Malware payload", "value": "a19e8902dcf79a76d3ff315af8c81f297ee1a36b", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169450, "uuid": "89c992a9-0a76-4fc0-89bc-b31e13b07889", "comment": "Malware payload", "value": "b251326adaae8a78e2f574a9ce2066cb1af6b32d1a4a33bef41030d7f7df9f9434fe84215636c1bb29e209410a93136c", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169450, "uuid": "6041db51-4894-40f7-9890-28bb2e0f229b", "value": "T1511139A593790EBFC8B262B5CC30AD4C88BA9CB30F4ED09EE9273484C9605E51FC4719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169450, "uuid": "ce0118dd-8800-43f2-ac2b-27f33782d239", "value": "24:8loG2gF1PdSDrTfzlAGlca8sl240u7lsljlsnl7xaRolicd7ZW:8loYFFonTf5AWca/4OAps5xaRKZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169450, "uuid": "ebf7d08e-9a1a-4a84-9bc1-4a755a038692", "value": 1095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169450, "uuid": "88a2eefd-c578-474a-87bc-d78acd759c30", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169450, "uuid": "f1036801-c37c-4166-861f-7a668052df79", "value": "Boletos_Nfe2726742235.164023.85214.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4984c7fc-fc35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685154131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154131, "uuid": "d18e17a3-1175-49eb-b431-61205a7e9a74", "comment": "Malware payload (RedLineStealer)", "value": "fbc05fa69fc04310ea27e61193f2224a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154131, "uuid": "0759d981-2f5c-4a95-a0e1-17da5ad99d2d", "comment": "Malware payload (RedLineStealer)", "value": "37ee2dd486688beb8dbb47c0d08ff2f21d924352591d1b62de460f7dd53f7b40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154131, "uuid": "7105cf21-fc5c-4374-91e5-9fa21917dfc7", "comment": "Malware payload (RedLineStealer)", "value": "fcd4d5cd367cdfde9dec81a4e41fa869d49f7b8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154131, "uuid": "26e6ea0c-484b-4d00-b75d-ed5f76c748f5", "comment": "Malware payload (RedLineStealer)", "value": "45b3149897430ea68ee57d2a2cddd01fca63ef87904df091b1972af16c0d535a946e7d8b0531015e7eca783d1fd0f88d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154131, "uuid": "fb550f81-aa84-4149-b40f-f2764f28e23c", "value": "T1BD3523537BE855A6D9A067B135F20BC31B397CA39EF4833727D6489D2CB224C647132A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154131, "uuid": "4487bef4-f5b5-408c-b131-827654a282b6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154131, "uuid": "9d6494c1-688a-459d-8522-42e24a9c0e53", "value": "24576:kyXY1NrhaBTJ9rHJ+CJV1k34SkV60JAk2GOI/IjCN5/:zSNrkt9bYPkV60ik2V9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685154131, "uuid": "6ba778e6-d5ba-40b9-9280-920da4fe6681", "value": 1068544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685154131, "uuid": "fce7b071-6508-405b-a742-0214fc0d024c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154131, "uuid": "504f847f-1620-4152-a311-59c2de61bcc4", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "172ed767-fcc2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685214606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214606, "uuid": "d2a8bd27-f9aa-45e2-a937-3afcda344925", "comment": "Malware payload (Mirai)", "value": "4057bb8f4be56a23bda86d0c92d27825", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214606, "uuid": "41ab03bc-088b-47ae-952a-42b1a5516508", "comment": "Malware payload (Mirai)", "value": "3872749d4dbfcf8c5018ac04ded30201519b567b304b70525f7ec64a7ac15050", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214606, "uuid": "0c2ff042-6353-46da-8427-950b0146cbd3", "comment": "Malware payload (Mirai)", "value": "c451f5cb9ef95834f3d4349708804aae87ad38c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214606, "uuid": "e3ee8494-d5e1-4731-b0fb-dd60126a4941", "comment": "Malware payload (Mirai)", "value": "29cb85f7e12826c1d499dfb39fe035e1ca79d6cf71657abf2351ce0404183445aa6c8f98d5cbf55cbbd4825b4cc9befc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214606, "uuid": "0fa56af7-771d-4613-b6e2-c1dffb261140", "value": "T15583BEB6D20A5D31C189827060E48D393753AAC642AB3DB62AE7C57E8007EDDF509FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214606, "uuid": "f105f5c9-d155-409d-8bb3-1649a62f852d", "value": "1536:C/jd72BY2aO2TDc8vSCdEMLaNVlJFypjkBw0RWPKvz3eH7OfCt44MC2FHwbZnN:CL89J2TDc8qgdLITKpa5QSvU7OfkM5BQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685214606, "uuid": "127899db-b6dd-4ce8-bccc-30f2d439d64b", "value": 84052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685214606, "uuid": "cb47b6a4-8831-4336-b7d2-fe99c9da5580", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214606, "uuid": "d14ee343-b778-446d-a3a2-b6bc63a87646", "value": "4057bb8f4be56a23bda86d0c92d27825", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7595415-fcc4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685215841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685215841, "uuid": "5cbbea75-7b14-425b-bdb6-f8fc5cb8ca69", "comment": "Malware payload (RedLineStealer)", "value": "655880ccfb69d0b7ee05d34e189c8803", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685215841, "uuid": "b2aab007-514f-4af9-a4c1-cdc9b5df7f76", "comment": "Malware payload (RedLineStealer)", "value": "38ac1b6d0d24f2b5edec5949e87ab80431dc9a11d8cd0d383df58b16018c7273", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685215841, "uuid": "a79c395e-3e8d-469a-a2a3-c724d92c1ba3", "comment": "Malware payload (RedLineStealer)", "value": "c104d19e6b9285648ee94efb787c3c5f7992303b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685215841, "uuid": "00ca99de-70dd-4acc-abcd-3d946e893aa1", "comment": "Malware payload (RedLineStealer)", "value": "ca0c69fb5324f2a5c542449f1dca7ddd14766b8e5af5bc4607c81e80df8923dbf00d7e56275a782c8daf89a336ef95c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685215841, "uuid": "c9879f9e-d3b9-4885-ae75-9e3a1c6d0f9d", "value": "T1FBF42302EAE99463DDB0273099F3029317713CA19C7583673A469E5E1DB13D8B836B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685215841, "uuid": "d4263153-5d28-46ed-8a96-aa71337e69bb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685215841, "uuid": "6a242f8b-4823-41d1-abea-84a5aa2fc641", "value": "12288:+Mr/y90Cmyx+lbLs72vDeKqxOZ81+dxW7gtGh6JuRgrloHMMRFdX4dXq4oam2I:JyUBlbLs7gKp1QQh6eouD4w4XI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685215841, "uuid": "b1bab783-b13a-46ba-9585-b8d114fc9e65", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685215841, "uuid": "7f7dfeff-c4ad-4020-93e1-fa86848a9a50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685215841, "uuid": "33db8331-cf1a-4622-9256-a4812b9ac2e4", "value": "655880ccfb69d0b7ee05d34e189c8803.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5696edd9-fc6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1685177775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177775, "uuid": "55fa0760-e002-4eac-b9dc-8c2dfb1b98f9", "comment": "Malware payload (CoinMiner)", "value": "33b4baef7b0a6ad57a7d30af324c4efd", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177775, "uuid": "368d962f-8b99-473b-a660-181ecace25fb", "comment": "Malware payload (CoinMiner)", "value": "3a48d4a5106dd9ba74e5fccfe58bf65581ee894d7f3ca1b15e6680fc912cd150", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177775, "uuid": "cbd93c09-267c-41ae-a612-7683925d681b", "comment": "Malware payload (CoinMiner)", "value": "b169a559615a8448d7ed7da56d36a6850d2092e2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177775, "uuid": "03ba30ff-0202-40c9-a0d9-0034fcb6a6a9", "comment": "Malware payload (CoinMiner)", "value": "212a34d51b69d8b65a9f26d80c182be61c7c0e33d25c74b1798a015c28f9d001e14d89e6a828b92348d42ef12a7b41dd", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177775, "uuid": "890f093e-497e-4c34-bc55-88dbc5dfed57", "value": "T11716AE12BBD58F2BC5564B388AE783647379DC904B43575BA34AB12D3DB23E02B871D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177775, "uuid": "a7cd0cf4-1f6e-406d-8300-d7b4e0313c45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177775, "uuid": "1d5a9428-e9c4-4dfb-b693-8dca3396fe55", "value": "49152:ENDFFPJu8fBsVE6ij+RNg+UKpBvtqB3m1RC3:SzP88fBsnZTgOtqB3m1RC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685177775, "uuid": "c0ede47c-cbd7-4508-9113-99b12f80301f", "value": 4156928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685177775, "uuid": "22ee752b-dcdb-4d07-8b06-da6cc6be4a5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177775, "uuid": "b862d6ed-06a9-44b2-9240-969f76fcd71f", "value": "01904399.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1c341d-fc61-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685173221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173221, "uuid": "5a45f166-830f-4433-be1e-21b8c8b4b488", "comment": "Malware payload (RedLineStealer)", "value": "5c0a67bb92104dd9f6b9b63281f46f6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173221, "uuid": "522dc639-f44b-449e-8b69-bb13e4367ab0", "comment": "Malware payload (RedLineStealer)", "value": "3c561a257a2381232e9bbd0e40ed24da6569f750bb2b13d1fef20049b4f8f1bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173221, "uuid": "a5bb2da9-a276-4372-9c88-738b232b9840", "comment": "Malware payload (RedLineStealer)", "value": "f3dc1c6404a79cdece12768d5e07c13def424a47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173221, "uuid": "6f385c24-00c7-406d-8e52-8bb8b644a9e2", "comment": "Malware payload (RedLineStealer)", "value": "416eb616daaf9caff88395c8fdc3e82e893cf4079a179440f333496edf08565664865508f8b8e91f7b0dd29fc86d505f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173221, "uuid": "34ed491c-36c0-4d8c-9f3e-25f36a273d9d", "value": "T160F42293BBCA5432E8B12BB059F206C31B393D914A78C33F6702696A1DB27C4567573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173221, "uuid": "f75cb88e-7b1e-40e8-9cc3-57c1f43ec5ea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173221, "uuid": "426b0694-3bae-4f3a-81cb-89f3116c3de3", "value": "24576:myUYZ5ghJwzIULMUJsolRyhcsNY822k3uSml:1hOJwz3nJzRyh5WBBRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685173221, "uuid": "9e97382a-c618-4556-8a0c-638e4fc42a7b", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685173221, "uuid": "5edb4e43-8ba4-4ab5-a977-d6d84ec51a83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173221, "uuid": "2b786a3c-41b8-4ad2-98fc-a6bfa75dff98", "value": "5c0a67bb92104dd9f6b9b63281f46f6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f338ce0e-fc57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685169019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169019, "uuid": "2ba464fc-de4a-49e3-b929-629a4b6523f6", "comment": "Malware payload (RedLineStealer)", "value": "70443f76ac5e76b72a75ec8afa7d8885", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169019, "uuid": "f1696782-64fb-481b-9cc3-6b850c70fa50", "comment": "Malware payload (RedLineStealer)", "value": "3c7640a0da3a820b7c288640a0654be7fd8fe00a2d198cb27396ade90cf08acb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169019, "uuid": "47c6b296-c5ad-4149-be48-935dde261872", "comment": "Malware payload (RedLineStealer)", "value": "b017df0e6318b248d8fbe8e8db424cb9683fcce4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169019, "uuid": "1cd5cae9-8abf-4aca-b99c-4f0aefd45d75", "comment": "Malware payload (RedLineStealer)", "value": "6bbf85e26eca665595ea43249b09cce516d8c2ed90187e691d2dfccde7ec90aecfa1f21a025172302f02d7574b6222a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169019, "uuid": "22730a62-3b79-487d-8e2b-aeb317deafdd", "value": "T10AF42393BBE98636D8761B700CF342A3073ABD925D7887231615691E0DF3B44793A72A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169019, "uuid": "322bc436-6ae7-430f-bdc8-60109b432fcc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169019, "uuid": "1ab38344-7a24-4be4-ad8e-6edc4939ef1e", "value": "12288:HMrqy903f6ULMP92g3OIgoWHhHKRD+zqF2etn2hTqzwWi6wnH3hm8T953+KULk3l:1yi1a53mPHMB2C563Hxm8eTk3/SuCe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169019, "uuid": "02ea06ce-c725-472b-8847-97c9c955c3f9", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169019, "uuid": "d9ea84e2-6d20-4a5b-a46c-3097ce6e6539", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169019, "uuid": "e4775494-bc81-49c3-b834-0a9074597e81", "value": "70443f76ac5e76b72a75ec8afa7d8885.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f9b074f-fcc7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685216740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685216740, "uuid": "8cad9f57-59e7-4373-af0f-e7c6d56c3848", "comment": "Malware payload (RedLineStealer)", "value": "3da73363f96ecf4b6eb8c6391686cae2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685216740, "uuid": "79f6c689-aaf4-4c55-92a3-467506f10809", "comment": "Malware payload (RedLineStealer)", "value": "3c7c842eeaf0fc00c5684502e6210910fa4f6c2330d4995db24d7d8cb2e382fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685216740, "uuid": "6d7eec4c-7c03-4d65-a627-6303ab6f9768", "comment": "Malware payload (RedLineStealer)", "value": "3b93459e2ebe3612aa8024e3a1c64863c2ca9a1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685216740, "uuid": "a3031147-363b-44e1-b00d-c72d32563db1", "comment": "Malware payload (RedLineStealer)", "value": "99dcc39668caca967530a2ec15be70068fa9a46f55ea29cbf54ac94d0d58ebcb5217e1665045e5ed93bbf5508535cd29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685216740, "uuid": "61ba36d7-7ad9-4225-bc2d-668b6d444a6f", "value": "T180F41243A7D48035EDF9237014F713871A3A7DA2A878431EA286DD5F5CB26C1A63673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685216740, "uuid": "6c6f71eb-d6df-4386-9b07-7fde7391d56c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685216740, "uuid": "adaf2bc7-19d7-417f-ac5c-6cfd8020166c", "value": "12288:lMrDy90H0fk2Ju7beeIIV2+CYRHt/q46R68r+fQW1Cmv4FKZw8iJU7X17:Ky5FY6eaYf/qf68SIWImgAZeKz17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685216740, "uuid": "42604a36-f1fb-4f87-9187-48734e4671f0", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685216740, "uuid": "62138e62-9549-49f0-8023-eee6a027b89c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685216740, "uuid": "58a2b65a-9ddb-4bab-9ed5-525e7c63bf00", "value": "3da73363f96ecf4b6eb8c6391686cae2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2414a06c-fc8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685191005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191005, "uuid": "695532d9-9e8f-49ed-8fe4-99a70b45d779", "comment": "Malware payload", "value": "10a7a4574e32bcbf453a22430e61620f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191005, "uuid": "f124c3be-4410-4915-b8f3-77d1e7ff7fc1", "comment": "Malware payload", "value": "3cc9037b835663468e1a34220684089e79c9816b271b109006aedf7ad5042786", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191005, "uuid": "b346d178-de10-41b4-a65a-cde65537a76b", "comment": "Malware payload", "value": "f58e48d01023ab5ca0fcd2203a5a9cfcf9b3e2c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191005, "uuid": "f9b7d86d-8fae-4757-bbf9-0de341192b19", "comment": "Malware payload", "value": "4c960b6ba969802be73564d5be5b7dc8a89ee195fb34b19076b389b7fea3013b5f4b26b2d8f5100c7409d0693bed1fbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191005, "uuid": "6025a850-798c-42d1-8d40-dc4bf55cf963", "value": "T12CE2E6DAB801DD7CF81FF77A84038905B171F289568217366BA3BDB7AD321940A73E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191005, "uuid": "60a6d32b-5095-4105-9d69-0da958bd6780", "value": "384:r7TwV3gVaGZ6Bby93Ny7YHV0MvI1A9b8pgAn+jBvhD00IOqMcEj6t+BACn7:rn71vvI1Ah8qAn+jlJ09zMcEjG+7n7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685191005, "uuid": "c85f2885-eb25-4b5b-a858-6dce57852044", "value": 31448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685191005, "uuid": "59f69e1e-e7ed-4de9-abff-a1bfa60f9671", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191005, "uuid": "9e6b4655-74d0-4437-9dad-40e5b412b11b", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9dab093-fc59-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685169862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169862, "uuid": "fe1c3f53-5abe-4b8b-9771-80f7b9f01e84", "comment": "Malware payload", "value": "ec9472fdd57d46f9134509128537b13b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169862, "uuid": "c3fb10f3-4cf8-4bd0-8751-dd949d81989f", "comment": "Malware payload", "value": "3cf508994f224c9334f9071465d343d1c2894535d95c74044a5c2014d59d21d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169862, "uuid": "b6a7cf63-1d41-49d3-bf68-119c7189b59c", "comment": "Malware payload", "value": "dca2d2e6b78c5ef22a4a13d58077a78d077c8f9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169862, "uuid": "2b124d39-fb4a-4ad5-b5b5-623c981539c3", "comment": "Malware payload", "value": "d450576e7667d9b9dfd5dce3712b76af1219fa0fc9ad874a21d35c917b56a0c866d508a749d91643cc6ea695d3f04e57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169862, "uuid": "f1211612-0215-4515-a1ad-1995fa419d87", "value": "T1F5C418A370B191E0E4F6547385BEE5B1C7267C76DA0446FB3290BF2A3A35C139622E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169862, "uuid": "9d931996-fa0a-4270-930c-1cdfe22a8ae3", "value": "d07e313f1b57a8ea9d8ad620c61bfe3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169862, "uuid": "0645b729-6d8a-4101-8400-0e31c1362446", "value": "6144:n41xtuP+LxY4MUABaw2WdMAOYVOV1IHjRXOIOcSqBrB8YB38DamXGRKP6l8ms:41xMP+LxY7KgdM1TOl5nyPSHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169862, "uuid": "4831d850-0230-429a-9fe5-d22139f791ca", "value": 576000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169862, "uuid": "bed21e9c-e9da-4656-ae1d-62d67780c1b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169862, "uuid": "1a72df5d-2786-452b-9349-e7f2c745d4de", "value": "ec9472fdd57d46f9134509128537b13b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b10275cd-fc92-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1685194248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194248, "uuid": "6923dca7-de50-46a7-aeb8-44433b2a7978", "comment": "Malware payload (Stop)", "value": "e2ce4e0c6af1049fa81b9bf979530fad", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194248, "uuid": "e0ca05cd-681f-4bcd-8d30-4688b2e6c0d7", "comment": "Malware payload (Stop)", "value": "3d107b134ad4b3c700db4e842a5e825350abe65275efd2b5e69519b2c74ea5b2", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194248, "uuid": "66e72262-aeaa-4593-8ffc-211269f4e1fe", "comment": "Malware payload (Stop)", "value": "7e1cb5aad12a966c0d86a012a539cd4145339883", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194248, "uuid": "d9c5582e-a58b-4d0e-996e-b5c3ea599a68", "comment": "Malware payload (Stop)", "value": "d21a1cf95d1e5e7cf7e416ee8fe6954ce39a17553b330b577f8b76b59934592643fb56427b504e40b649017328034f46", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194248, "uuid": "8ebe30be-23ba-4eff-afa6-9c7c7d2759d7", "value": "T15305D11392D17D94E9274A73DE1EC6E8771EF6618E097B6E22189EDF04F00B2D163781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194248, "uuid": "6f1cca86-05f7-4632-8a95-36c857de4512", "value": "697c6731df2df92c82c75859d21c5f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194248, "uuid": "37d9d8f0-6540-450e-9ae3-37a800ae2921", "value": "12288:A2lR1qBMfDDWKvAxE5phEsMJq4pWc06phRAx7ol1PchyGikId6:dqWfDDWKvAxELhEjHWTMXVZcnJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685194248, "uuid": "92e95b9d-5612-43f1-8fb6-ac26e9208e2c", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685194248, "uuid": "ca82b406-a563-4d80-8112-460a95efb0fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194248, "uuid": "9c30c445-fd44-40fa-80aa-84cfd41377df", "value": "06411899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e040726-fc75-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685181626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685181626, "uuid": "47ad3b91-3441-4408-840b-0715e1b88d49", "comment": "Malware payload (RedLineStealer)", "value": "d6421cc1dd62ad1d2cbb47d111491704", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685181626, "uuid": "23fc6cff-ca30-4c03-b939-c8b9209f23f4", "comment": "Malware payload (RedLineStealer)", "value": "3d5d91613033f94c7b22b38b15351089265d158fd2fb6dabc9d671592c2aabb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685181626, "uuid": "e393e458-31f8-4ea1-be79-d82f6b1ce267", "comment": "Malware payload (RedLineStealer)", "value": "90e5ea575728049d29ba8d0e83adb3595846b047", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685181626, "uuid": "f07af0c7-dfe0-4319-8205-9b25ca3f355d", "comment": "Malware payload (RedLineStealer)", "value": "1c2d741dcd750a8e37c6783cf116be0e4e7a24f771514c38f46fced5c7544acfeed96b98ac8814cfddb515e278e9e6b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685181626, "uuid": "c4e5ab72-ba5d-4a26-b768-9a35e31cbefd", "value": "T1A1A34B3027EC9B29EAFD0E3564B2512543F2F0C65091FB4E4EC1A4EA1F62B875D266F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685181626, "uuid": "9bcb7f89-577e-46d7-afb3-bdaa55f8367b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685181626, "uuid": "9045b1ed-6569-4f09-8969-861581bf4f42", "value": "1536:SyoSAkUG6jejoigIcWqEVamw/GSPqL4IWOO/AIdbfHSCv0uuXyyedOxtCgfLpoNZ:SuAxYc849uNvByvr0ueyzddZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685181626, "uuid": "97fa2a3e-d79c-4fe8-a25c-4193bc2d27f7", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685181626, "uuid": "3e31a48d-1583-4de0-9ab1-8ad0e2db8a18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685181626, "uuid": "63f33c2a-c8d1-40f1-986c-18cd074ce515", "value": "d6421cc1dd62ad1d2cbb47d111491704.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ee05598-fc75-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1685181628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685181628, "uuid": "8273765b-fd52-4253-9f03-d6509c78417d", "comment": "Malware payload (Stealc)", "value": "d2482690c64f36d4f23cf26d617cb268", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685181628, "uuid": "103bad0e-6b53-45b3-b9fb-35de92612e70", "comment": "Malware payload (Stealc)", "value": "3e1e3a8cf5efe616591c7b6b91265b3adf8b9bc594ec7ea9a06e7d20cde4a2ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685181628, "uuid": "cb8add02-afec-449c-bb1f-6c34d044b2a4", "comment": "Malware payload (Stealc)", "value": "d402cb34dec340db286472e3ff4cb06df750d340", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685181628, "uuid": "70ea3850-b6b0-4db2-82d3-f3a74d21d203", "comment": "Malware payload (Stealc)", "value": "1fb84d1bd8bf8c495b5e2e7e4f3095eb7132a4aecc8cbd9a76ca1ed801be930e2a16612c2c18208c4b91f3025a099a65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685181628, "uuid": "2b9c0d9b-69c6-4f2a-a291-98d7a8ff2180", "value": "T168543A0392E17D94E9264A739E2EC6E8375EF694CE4D376A22189EDF04F01B2C173791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685181628, "uuid": "09615917-4853-47c3-8754-4342ec7c07b5", "value": "697c6731df2df92c82c75859d21c5f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685181628, "uuid": "7bdef2a1-947f-4dbe-b973-a52c4cc2ee85", "value": "3072:jCKxd9hOvDLrOnzD10lRGE1TX396JwBUm5QS9W:uKxdGDLrGEsERn96JrSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685181628, "uuid": "aefcecda-c266-4e80-8a27-8a5a8959d6ae", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685181628, "uuid": "038f0947-2202-479d-9cdd-380a35320140", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685181628, "uuid": "dffe0b5c-6345-4591-b3c7-98bcaf0ccc03", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b95e7b8-fc92-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1685194105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194105, "uuid": "aa86729c-7dd5-4bfa-b8d0-cd2211103f71", "comment": "Malware payload (Stop)", "value": "bb833a941c8a2c7aaa4b8f65df277446", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194105, "uuid": "3af21375-9bba-4e47-b263-93538cb6d3ff", "comment": "Malware payload (Stop)", "value": "3edfc307d567a68818bf65e8ea6d3bec91ae7c276d8ea12a32ed20ef2f54764e", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194105, "uuid": "9e4c3a14-4de0-40f9-9977-cc4786633b71", "comment": "Malware payload (Stop)", "value": "c7e152ec8668cbb0391e159f1f3935acb80e676a", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194105, "uuid": "da0962b4-cbea-44a3-8d85-2e4d835137da", "comment": "Malware payload (Stop)", "value": "0e5f325570d74ccb25b0496688c67fc972248bd417900bc4727a3ea5949875c19e826f3449e4ccce00141481ebb4982e", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194105, "uuid": "48bad88a-17da-4343-9e7c-7904ec5f8a2b", "value": "T1CB05D003B6D2FC64DD264A729E2FC6EC771DF1B18E197B5922159E2B04702B2D263723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194105, "uuid": "cbbffd22-9f2a-4932-a3b4-76e2685792dd", "value": "d683fcb523ac92743f5db043ced73806", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194105, "uuid": "d9b95ec4-5a3f-44e5-b037-9a52d6ca419a", "value": "12288:LqGHRn3TEDA+YsxWrelngYwuvgSCGqkI/Bp2AzjCLhU+raiE:OGxn3TEDAQxWrUguYZFduA/CLh7ra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685194105, "uuid": "a296b2eb-6fd4-4125-8c1c-ac4f0a640151", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685194105, "uuid": "df2b16ff-e963-4993-bd29-8e352394d1c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194105, "uuid": "777d7d93-b83d-48c1-8f17-bc218d9bfdde", "value": "05495999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd337a93-fc61-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685173223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173223, "uuid": "e9b314ea-140c-41ff-a26d-9e8550f79a5b", "comment": "Malware payload (RedLineStealer)", "value": "49b74d2bf278ee659e7c0f2bb6214eca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173223, "uuid": "d861aa1e-3798-4b33-9663-162dd7e326de", "comment": "Malware payload (RedLineStealer)", "value": "3eea6b42b88a14f089390f681d52020473580d03db34d743b39a1c4f1e6f3e9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173223, "uuid": "642ba3f0-f555-4d44-9842-6361725afb0d", "comment": "Malware payload (RedLineStealer)", "value": "71b744c3e178119c02b0e115cfce04fda6902f29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173223, "uuid": "0732f6ad-2ee3-4f4c-aaa2-4f87145b7096", "comment": "Malware payload (RedLineStealer)", "value": "49aac21085752e1cca2fb65cd67d79eab33c6e67c77a3988ff0572e735ce3e91170d950227ddaad52716d0e446cec523", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173223, "uuid": "fa177533-4f6d-46e2-a52d-cce524ac82de", "value": "T12C3523837FE44162D9B127741DF606C30B367C829A7883663B876CE92573A85EC72736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173223, "uuid": "9a633f34-d9b8-4f96-b403-3c9aa2f514ef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173223, "uuid": "c7c48646-626d-4c1a-b0f1-eb66df0d67ea", "value": "24576:4yPsAMcBKw5Lst2GPSpE1p+e3uSvaf7xR3wWzVqAwR01XdP:/vNcw5QcGQEvfRCf7xRfVqAwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685173223, "uuid": "3b144e6f-32b2-4f80-9901-e17804e17402", "value": 1068544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685173223, "uuid": "73383607-1dbc-44cd-b62e-0c8fe85fb1a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173223, "uuid": "506b942e-bed9-4935-bb3e-d69025fe0713", "value": "49b74d2bf278ee659e7c0f2bb6214eca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8d1dbb-fc57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685168712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685168712, "uuid": "5f520e36-a876-41c5-97bf-c8d8d406f6e6", "comment": "Malware payload (RedLineStealer)", "value": "1f89aca39681533384c403689b26c8d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685168712, "uuid": "698a82b0-a025-4e41-ac48-3e243f8249ca", "comment": "Malware payload (RedLineStealer)", "value": "3ffc2ae8728dd6b28f9281442ad92e1ffad62ecfab19b5a47c5487cffe96bd81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685168712, "uuid": "a7eae363-7922-4d4f-9749-52e790888dc0", "comment": "Malware payload (RedLineStealer)", "value": "0b62482282f25497e032d38b21526b2e27964677", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685168712, "uuid": "43bdf3d9-a528-40d4-9ecd-bfbd30f101f9", "comment": "Malware payload (RedLineStealer)", "value": "24922b2ac3b95b097160a73757631a3ce48b1b9ab6c5e900f376758b19145cf17c6688b7e31b7a3f94669c3962736848", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685168712, "uuid": "15c1fb05-902d-45c7-9f67-18e9d7b42ec5", "value": "T11BF4224277E8C172E47117709EF607D32B363CA25D7887A72704AD9409B3B8AB57932B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685168712, "uuid": "b7159f05-9675-4808-ae0a-4943c4c87627", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685168712, "uuid": "86ed3c8e-2074-4d98-8751-91e9ab11d35a", "value": "12288:KMrYy90LL8qDXSyxrScwNRqgTGNbw0XQRMzVZt7RvjUlojicK8f9+3+aJLk3NTaz:ey279htgUpJPOoucK8zQk3gSSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685168712, "uuid": "9cb8ec57-47a0-40b1-a3ee-5ff06c69a2c7", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685168712, "uuid": "4c71ad4a-5e95-40cf-ad6e-42319a1f9d06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685168712, "uuid": "d358e062-dc47-4163-98f7-4cf281853362", "value": "1f89aca39681533384c403689b26c8d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6524f72-fc92-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685194257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194257, "uuid": "3619b836-cc40-4fea-a6f6-6defce01bf7d", "comment": "Malware payload (Smoke Loader)", "value": "a5475b78bc6aa14bc316420943dd733d", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194257, "uuid": "c12bf970-da41-49b4-8c82-aa9b11410dec", "comment": "Malware payload (Smoke Loader)", "value": "41b4ef28bcb4fcca37c63f3c34d9a40236c49fd7a49b5f41952ece56cda836e0", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194257, "uuid": "7d50d7c1-bd71-48b8-96e8-fd20924c2124", "comment": "Malware payload (Smoke Loader)", "value": "3e93aafb3c6c72c34a2914cd37a151183e8d3d1c", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194257, "uuid": "04fe3ef9-992e-4bbc-a3f4-f8ef4e30169c", "comment": "Malware payload (Smoke Loader)", "value": "37d22b6f1a0a8ca498cd9db239fd351e44f0c8b9bce674bd273e89e6f74f720b8ee24722210c5fdaa03eb444d540e60d", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194257, "uuid": "8ab4582c-2ee0-47f8-b9ad-a1e5abfb3647", "value": "T1C4543B0396E2FC54FD66CA729E3FC6ED762EF5908F09776A21185A5F08702B2C163712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194257, "uuid": "49f374b4-f618-4d2b-ade0-3aadd7fdd5ca", "value": "d683fcb523ac92743f5db043ced73806", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194257, "uuid": "95efb1a0-b5f3-40ed-bc4f-ae6320315fed", "value": "3072:aEhxSl7OBQ5mqry09ZJ+o7wtJyWXb/AOz/5QSGvAbxEqF/:Nhxk7fmqm0jJT5WXbYSuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685194257, "uuid": "6e156e8e-6294-48e4-85a3-b5149cd175d3", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685194257, "uuid": "363f0228-7dc8-4ae3-a1a8-9885e5134205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194257, "uuid": "983824e8-c2f8-4bf4-b8fd-4b597072c277", "value": "06767099.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c9b145-fc6d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Glupteba)", "timestamp": 1685178276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178276, "uuid": "f2911636-ecec-40b8-bbf3-7abcf007c734", "comment": "Malware payload (Glupteba)", "value": "289257051a7e30f837a00b4186b47501", "object_relation": "md5", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178276, "uuid": "b1e63c60-c78b-4d64-9326-c0d5d6a6fae8", "comment": "Malware payload (Glupteba)", "value": "433ec815318e439551d66ddf3c605ba7da5e966b671107b425f73262d39a9c83", "object_relation": "sha256", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178276, "uuid": "c8933274-4fd9-4c5b-9210-d8edd08981ad", "comment": "Malware payload (Glupteba)", "value": "322971cb7da2f62756e505ea8ba036462514c1bf", "object_relation": "sha1", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178276, "uuid": "56c5075d-fc16-4fa3-a672-fa922ab330dc", "comment": "Malware payload (Glupteba)", "value": "78013686c89797ae4997f924478426527d6ff273875879f2c03e3aaf3abee86f36d5e857089d518d6243002a215c60b5", "object_relation": "sha3-384", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178276, "uuid": "55ef5f87-2afc-47de-aed6-6489e7e84c01", "value": "T139162353E391BDD4E9924A32AE5E93F8331EF6504E98775A21299EDF40F42B1C2633C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178276, "uuid": "bf79c929-ad32-4e04-aee3-3b0712c8bf0f", "value": "bd191f6a78cc98a8bbe61db18ad8e9a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178276, "uuid": "28216a75-7d5d-4927-8969-734608db368a", "value": "98304:aHVVp2uqi61tX39zbn2cQKXNes4aMrVfmxWuRZxuBKBOBL:aFYzTXNH2c3eKokxlRfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685178276, "uuid": "15ec7d43-5d15-4ab2-a878-74a260a7bc18", "value": 4387208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685178276, "uuid": "a8d5a9b3-74bc-48df-8d92-8db3b4cb52e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178276, "uuid": "e3026301-7efa-49f8-aad1-9ce978031b43", "value": "09751399.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a173cee-fc22-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685145864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145864, "uuid": "8da625f4-ccf4-4696-b0ac-e4fea8bebb47", "comment": "Malware payload (Mirai)", "value": "ddf33ab2a548d8cd5eac19b7ead99f94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145864, "uuid": "3cdd3c77-b97a-414e-bc36-06f7ef3f2236", "comment": "Malware payload (Mirai)", "value": "441e581c0ef9a63d192fd6832c4caa9ac3479da11acb1fea36d5bb027ef0561e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145864, "uuid": "64ce8c77-b078-456b-82c9-fb5793071866", "comment": "Malware payload (Mirai)", "value": "6129b683672b6be311f08f4846894d471665b25b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145864, "uuid": "402a9943-319e-47a5-a0c0-ef0ebb524b8c", "comment": "Malware payload (Mirai)", "value": "0c5e61ec80c0065b347ec64da9db5a270978594f16a7871c8166552396f298323f5a7f25961c06bd3e88b65436213f73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685145864, "uuid": "996e26e3-1d05-42a8-ac09-fc082b4a220c", "value": "T149A3C70D6E21DF7CFBAC823447B74B21965833EA2AE1D685D15CE6012E7034E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685145864, "uuid": "f274caf0-8f10-497b-bf5d-1d9e9abae296", "value": "3072:V0qPEXlrKBzuqJCbIHnXuBMzP3jdILxKE2+VlZ:GABFHnXuBMjzd0LZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685145864, "uuid": "0c2b1ecf-215b-4a8c-83c3-1f2a8811ff8a", "value": 105116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685145864, "uuid": "fc6b35db-eb80-4485-a08f-297734546efd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685145864, "uuid": "9a81d559-2156-41bd-b0b8-1cfcc8a7fa2e", "value": "ddf33ab2a548d8cd5eac19b7ead99f94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7561bb70-fc33-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685153346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153346, "uuid": "b8fbb060-09d5-4533-8e32-9ae6a530cdbe", "comment": "Malware payload", "value": "d975b425bf0bf640e5825b5b92654fac", "object_relation": "md5", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153346, "uuid": "961552ba-ef8a-462b-8a9a-e71d54265d1d", "comment": "Malware payload", "value": "44737c01c93b96afcbb96c0b38993594d29a0a07d625999ef503c8424da90b0e", "object_relation": "sha256", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153346, "uuid": "41333e4b-c324-4e44-b5e4-7c78ab0f0e9b", "comment": "Malware payload", "value": "76500b0f17fab41cf5339c6034d3d95312f1f232", "object_relation": "sha1", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153346, "uuid": "378a1494-09ef-432d-8d39-df41d3ef7615", "comment": "Malware payload", "value": "9f77de5dfde81ec4f5f9996f3936864668d998bceb8908ceb28559cb174ac38d2caa3f0b0edb5a4a8fa8bbcd03d2d2c1", "object_relation": "sha3-384", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153346, "uuid": "4399179a-7f41-4f73-ae6d-e127f609daa4", "value": "T121331EDF25E100599DFA293C93EF1BC46B90909BE798FD930C95F1B43CA498879A4CC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153346, "uuid": "3f87c804-4569-433e-84d9-b990ba42a7b7", "value": "768:DdUqDi+qUjqt35yYKEPPsLYqarEPqjZ/baviPxJvrDpPl2EHw9bzD2JVNsm:eqDoQTEXs+rkM/HJv5Pl2EHwleVWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685153346, "uuid": "9a2e20c3-48cb-4b2d-a8ec-2fcb6b47c45d", "value": 51448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685153346, "uuid": "bdd99989-ef09-4f13-bfbc-e557e0c86f19", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153346, "uuid": "37f5dcf2-d094-46df-a177-58f073ec0092", "value": "May10-2023-Invoice-DocuSign.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a62c71-fc58-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685169234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169234, "uuid": "6dc729aa-0467-4be0-a093-bf035c41fc3a", "comment": "Malware payload (Loki)", "value": "2c10b8a40b52efe17821e4db18b5f357", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169234, "uuid": "2cfb05a0-32bc-4308-b0d1-ced565719f0c", "comment": "Malware payload (Loki)", "value": "471042eb7fb8a0e0bef901eaae7ace1f91df34c277dd7484aa2bd565023e60f7", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169234, "uuid": "f2e3e53f-90a7-43a9-96ea-6b3bedbd87f8", "comment": "Malware payload (Loki)", "value": "8740abe094cdc483caf4897b3e00a4b5cd2c8c7b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169234, "uuid": "97961be7-7c47-4150-abdc-761d5c3b3090", "comment": "Malware payload (Loki)", "value": "302a0efc900d51d6218e51d2208918fef33a21d7229d2f2812e8c26afbecea4aee0ec965071561654a8507efc6693bf2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169234, "uuid": "db683cf3-8f69-4086-aac0-4fb12ff41e8f", "value": "T12BF2285AE78F02648F5112B2571B0E88AABDB63EF3505571746C933433EDC3E0266ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169234, "uuid": "b4d3682a-fb92-4373-b496-498a4bc79102", "value": "768:2Fx0XaIsnPRIa4fwJMVIRhL6Btx2KIzQA0ezDjVGKuh8yxjjzLu:2f0Xvx3EMCRhL6Btx2dzX0qjVGR8ydzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169234, "uuid": "67e1b28e-f6ff-4149-82a3-8aab1601d604", "value": 36332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169234, "uuid": "da1df936-f80f-47ab-a8cd-0f49a86b4d15", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169234, "uuid": "b6dee81a-3b35-40e4-a106-69cebf62a0fb", "value": "New Purchase Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0089008b-fc7e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685185362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685185362, "uuid": "0bbb96ab-2698-43cc-b57e-1d68c38e603f", "comment": "Malware payload (RedLineStealer)", "value": "ee255dab4870d3a4880d6fe1a99f720c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685185362, "uuid": "8e8d18d5-0506-4871-9e90-c08cfe778a65", "comment": "Malware payload (RedLineStealer)", "value": "475fbf0b743936ba24e8b8db5e85cb0e13a8487c6d9b52350aac81020f380d38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685185362, "uuid": "3007b061-43d3-4e3a-8467-a75d3ba20ecb", "comment": "Malware payload (RedLineStealer)", "value": "bedcc869e252cae4e7ccbaca9ccf09cdff415171", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685185362, "uuid": "bcaa5799-05fa-4d0b-a25b-ade62157ea35", "comment": "Malware payload (RedLineStealer)", "value": "3dc7c1bfa2bcf493783569f58d56c0bba0c90c73baa2759208b6f2617ad0234322b68ed1692d0280c21c955bd97d0fcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685185362, "uuid": "a4a27401-bebb-4de0-b0eb-924913b68f3d", "value": "T1E3A35D3067AC9F19EAFD1B75B4B2012043F0E08A9091FB4A4DC194E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685185362, "uuid": "78482c4b-8f9f-46ee-b229-776cd9b365e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685185362, "uuid": "377d2d85-32a1-4f3f-b692-45d4c326ad5a", "value": "1536:5qs+bqDylbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed29tmulgS6p8l:XIwiYj+zi0ZbYe1g0ujyzd98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685185362, "uuid": "813a50ef-6b54-4e97-8455-cdb4d2f8812b", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685185362, "uuid": "8ae07f58-8f20-4de0-a537-4de5c189370f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685185362, "uuid": "655ac376-f0c4-4229-9c36-ac6d5ac18b6a", "value": "rat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa11ec7-fc6d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Glupteba)", "timestamp": 1685178139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178139, "uuid": "8d9b5c66-99eb-4efd-8680-a704fd3dc033", "comment": "Malware payload (Glupteba)", "value": "10fe885342f8fb85a94c2fa16ce66358", "object_relation": "md5", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178139, "uuid": "abf20ca7-7707-420a-a622-49bb9054d5d6", "comment": "Malware payload (Glupteba)", "value": "4a13391b70f6dd4ab733e3745a787176e0e7fc33c6c0220635f3b6f65d5fd067", "object_relation": "sha256", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178139, "uuid": "0ec11f48-dc05-4532-b00b-d14cf851e730", "comment": "Malware payload (Glupteba)", "value": "d4ea6472a9dd8fe51986d737559b9ec8f2aedb12", "object_relation": "sha1", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178139, "uuid": "14ca8377-e4e1-4304-905b-3dac49c5847e", "comment": "Malware payload (Glupteba)", "value": "d1c98c2fcea3684875b74d79642e32baf64a2840ae2c21b26e9bb58d0803cb6aa1570769c8fa8fabd012e06b20516aca", "object_relation": "sha3-384", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178139, "uuid": "a6ed3143-31ab-46a8-bb76-8afdfa4840d7", "value": "T1E4162323B2D27DD0EA554B339E1DC2EC761FF6688E493B9512449F9B18F1372E163284", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178139, "uuid": "ae33b616-5e8a-4f5c-ad63-5740bc3051ac", "value": "bd191f6a78cc98a8bbe61db18ad8e9a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178139, "uuid": "d6de344a-519b-4f5e-a7d5-7161ae3a89c1", "value": "98304:ZW4aBj/T4tJy8LF10uQfG3CbNSYUG7XFb3lEjngfW:MBj7+h1tySC5S3GD1aDg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685178139, "uuid": "49603f82-b801-4d76-8863-086991fa8f1e", "value": 4386704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685178139, "uuid": "c0234850-3c65-47fc-80dc-e951119b0e74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178139, "uuid": "16799c92-e42a-48e3-9206-f0b47ab65fcc", "value": "08096699.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3647311-fc91-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685193930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685193930, "uuid": "d48acf43-6397-4b6e-baa2-79479ee41d05", "comment": "Malware payload (RedLineStealer)", "value": "a9a70db8d9d35498c1f1611476dc9b4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685193930, "uuid": "31c80f22-ecea-448e-892b-41687b8a3364", "comment": "Malware payload (RedLineStealer)", "value": "4b98270b3e02bf07273bff68629c189086e93fe88a5bb305de19245d6e7ad467", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685193930, "uuid": "4014e5a2-a28c-4553-89a6-33d6c27747e8", "comment": "Malware payload (RedLineStealer)", "value": "965df2a2b620c579fd4102e92cd408036dbd5989", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685193930, "uuid": "daaf23d6-2a06-444e-ab57-e9d1cff1b320", "comment": "Malware payload (RedLineStealer)", "value": "2942577123ef3629071884e8ecbfc56557a1b89b1230a1006e96013a9a3edbe3a595c7ca8ca6ab5d71d708c4ceed4a72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685193930, "uuid": "0ba2625f-5141-4556-8cdf-fabaa9ea504c", "value": "T15EF4231372EC4532D97A7B7118FA0B471B397C666E348BAB3740A55D1C73B84A832B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685193930, "uuid": "01c338df-76a2-487c-becf-de6136301b0c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685193930, "uuid": "342fd6d6-7661-4087-8f0d-407aaddcdcb3", "value": "12288:0Mr8y90iWfz1Xx/Ly/3qpqxY3x46f3nvUBqKbBHnx4NQWIYp+4COVnJ66BJ:IybW5pOYhvApBwQWI7iJnBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685193930, "uuid": "aff503e9-42fe-4167-8daf-13d7110e1289", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685193930, "uuid": "f9e4d29a-434f-4955-a8eb-442f04a38062", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685193930, "uuid": "1562889a-39c7-423b-98c5-e66fa48202b4", "value": "a9a70db8d9d35498c1f1611476dc9b4a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fbce91c-fc92-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Glupteba)", "timestamp": 1685194192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194192, "uuid": "60672621-7f1e-468d-874d-c8a5535aaec0", "comment": "Malware payload (Glupteba)", "value": "ce7b80b2fc44881e1b68df120c4fb239", "object_relation": "md5", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194192, "uuid": "2663e01d-a089-4098-805b-904468258c64", "comment": "Malware payload (Glupteba)", "value": "4c5cabd7587b02b1870aa6e4779331817dfd2f260fbe41c92a74909da41a1891", "object_relation": "sha256", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194192, "uuid": "5d66b2b3-7fe9-4c7b-bed8-e6dec2e4427d", "comment": "Malware payload (Glupteba)", "value": "20b335c6e15097218318b3f9d11e060ce7af1aeb", "object_relation": "sha1", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194192, "uuid": "d460dde6-db1d-4b88-9efa-b6c638f6f07e", "comment": "Malware payload (Glupteba)", "value": "83b8443f1b3a9e21afda94568d1b8972166659319bc19b913716c9d31f7a4f00513b9fde248c460e61d0cd8026d50e2d", "object_relation": "sha3-384", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194192, "uuid": "8a25ae31-b4c2-4ac3-a781-1f24b739d6c8", "value": "T1C4163343E7D2FC64ED630B729D2F85ACB26DF6808D14BB5961199F1B18B02B2D273352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194192, "uuid": "08230566-e621-4670-8131-12308d215c4b", "value": "d683fcb523ac92743f5db043ced73806", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194192, "uuid": "44ea5b9e-5be6-4dae-89ee-7169cd52977e", "value": "98304:7SwbqFUh7X92+QIeh4zoxNLGLsrBqRj6UIM6JO:ewbSUh7XY+ChSkFedl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685194192, "uuid": "f81f8de7-49b3-4812-b3b3-7ef48f1237ee", "value": 4387720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685194192, "uuid": "260c5c5d-36ba-4be1-bcc1-16e176ffdc94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194192, "uuid": "b1307cb5-3c68-416a-bfff-fe0614a582f2", "value": "05960399.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd42a57-fc8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685191585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191585, "uuid": "3486c1b6-775d-4dfb-87bf-3f42c28f5dd2", "comment": "Malware payload", "value": "21dc39e4656b3305d2e3fc60472957ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191585, "uuid": "6a7a9c35-eb86-4542-863b-8e49b7edee1f", "comment": "Malware payload", "value": "4c6d7f7c52358220ef729b20c8d2925e75d6eded0ddf83c6e1c9fc0a8f84023f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191585, "uuid": "312ae743-aa51-448e-a173-388eb5f3e8c1", "comment": "Malware payload", "value": "6174012d63e38ea0f950b94f85e784a315fc3a2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191585, "uuid": "1d81bc08-3726-44ed-8d73-d837b310b21a", "comment": "Malware payload", "value": "64dca71b8977a0f5af911868723b31b1240ab015bbf4c5bea2502096a90526090ec109548a277ed6fc197460193fb09f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191585, "uuid": "b6d52c11-d50e-4378-b460-d4d15eeca537", "value": "T1F6C25BC6AD83E8F4F81927F5593693B19E35F03A2D6AD943E3A13131E422B10D60736E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191585, "uuid": "e50790c1-bd0f-420f-b17d-bfd2583c81e9", "value": "768:gpR+uwdQWIMKXjcFqIQt5Xt/VIB2+1lan:ycp5KTsq5t9t/ViH1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685191585, "uuid": "b0bc3756-b40e-4190-a1ca-d1fb461db079", "value": 27256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685191585, "uuid": "f6a56ed4-24d6-42bd-95f2-57af82618874", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191585, "uuid": "e52ca0c6-fa71-4c76-a191-2149df15ba63", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35d64c9-fc58-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685169314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169314, "uuid": "2236909f-625c-4c24-b706-9e60694223d4", "comment": "Malware payload (RedLineStealer)", "value": "45b7024e4734476c5006c78ab8594fbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169314, "uuid": "cb5a0a28-70ea-496c-8829-057e9f74ec74", "comment": "Malware payload (RedLineStealer)", "value": "4ddae89a6385ba5e8c927f467cf7cdb5fab93876bf26c2ae2886c1710007d863", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169314, "uuid": "96b70344-bea9-4017-af51-0d1645947176", "comment": "Malware payload (RedLineStealer)", "value": "eb974bd656e62e6fdaf6d9e30bcbb1b992f180d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169314, "uuid": "691843c4-c589-4fd1-9a39-ef485e4c868e", "comment": "Malware payload (RedLineStealer)", "value": "a8355f21a4689aeb2399c53290917404ea07808f4f0f81d6d5e08a899c01788294a4d6668ff24743c7b187a631915e5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169314, "uuid": "f0bc6ad3-b412-4107-889e-e1d2979220af", "value": "T1F9352357A6C88173F9E617701CFA00870B39BCA55668C19B638B6CAC1DB3BD4B931357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169314, "uuid": "d1fea950-87ae-4b2d-acc9-08771e91740f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169314, "uuid": "5793ad85-be26-4445-b8cf-3c8b69c85f9e", "value": "24576:AyL2WLTDRZFurx5BCB3VOEGk3QS5aQTLewgSxb3Oji8XL:H6WDRirxLCHJxn53ewbLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169314, "uuid": "cb0b1acf-5af2-482c-8af5-5c6a86d51166", "value": 1068544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169314, "uuid": "a2bdd829-f4fc-492e-b38b-6fdd3b711588", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169314, "uuid": "0b461da0-d76c-442b-a82b-ef294c53f1b4", "value": "45b7024e4734476c5006c78ab8594fbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e5ed5b0-fc9c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685198431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685198431, "uuid": "f4d9c62d-dc1c-4b25-9cdd-5d91e65f65f4", "comment": "Malware payload (RedLineStealer)", "value": "081196b01c92c9f3f822343d57dc7418", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685198431, "uuid": "2d98812a-a3f5-4a27-8f43-bd219a0d68ef", "comment": "Malware payload (RedLineStealer)", "value": "4e6c24227daeafda1c19db85448114dc6cba3aebb9b795c418d52b283f6d842e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685198431, "uuid": "dc084b8a-2e86-4dac-a564-44233988dc16", "comment": "Malware payload (RedLineStealer)", "value": "1bb2f654452184638823a713cf5a6caed9c8187a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685198431, "uuid": "eeac942c-708f-4444-8d56-5486b43c9afc", "comment": "Malware payload (RedLineStealer)", "value": "f487ff06775b6e1ff1717e36e273037766a83a63ff16522e72c49baaab5c66e88841b62dff60f2c899b65d889fddd882", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685198431, "uuid": "c43de01f-1ebf-4c43-9788-598dbe5121de", "value": "T17EF42212B2DC5272ECF66FF058FB1B83063ABDB18939875B32269D5D5D7225084327A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685198431, "uuid": "8c382495-0dda-4a94-8f64-e80946c8ec3f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685198431, "uuid": "2e621047-818b-4c1b-9498-327d0ce188ee", "value": "12288:GMrgy90IPLcMbPrktgaT4VWOFGQzOq1n9Pu+SNPZQTlH2cbureHl0ujvbkInDrJ4:2yRTHdaEGGOq19W+SANHljjvbkInDF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685198431, "uuid": "82ccd230-7033-4294-8b13-344ec0d65e00", "value": 778752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685198431, "uuid": "2b1f89c7-0658-4b88-80d6-bda497fa36f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685198431, "uuid": "e06386cb-aebc-481e-b740-d568fba02149", "value": "4e6c24227daeafda1c19db85448114dc6cba3aebb9b79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3079bdd3-fcb8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1685210353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685210353, "uuid": "49520058-ff95-47f7-97cd-3fc19726ca69", "comment": "Malware payload (Stop)", "value": "2da755014502de2168f0e27edb8d587b", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685210353, "uuid": "7e340c5d-f3f9-45f2-9838-9d17a69b83a9", "comment": "Malware payload (Stop)", "value": "4e8c752b8a016e8d4fc9723ada1498af8a3b3f46e89f3388782f4082575d3218", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685210353, "uuid": "e429fd94-9d0b-4f1b-b613-a6dfe915094a", "comment": "Malware payload (Stop)", "value": "8d2d811f969c05399f5990426bed94ee49f79b0b", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685210353, "uuid": "e16648d9-509a-4275-bc1c-0eae222fc29c", "comment": "Malware payload (Stop)", "value": "e17d92c6dd68af8349877699c74fd1e3ada38a5a7c5cd41eb88750b55eb439484cb9b11b84e6cb4243e26af52ebfdae0", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685210353, "uuid": "442b8908-090a-4238-b845-b378ad5b38a9", "value": "T11A05D003D6D2FD50E9654A72CE2FD6EC761EF5508E493B6A22189F2F14703BAC163722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685210353, "uuid": "42c7d018-0ad9-4994-9edf-f14ff1515c54", "value": "82b2bd7dc938b719df57a6b2df186152", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685210353, "uuid": "73de3c0b-85c8-4872-9967-761d300e5fc2", "value": "12288:o/eRcyNek9YK9jYk1MAmvgCVHEJUGH3seBHymAnstE6zuHnc1+FAM:DRcyNek9113oVHtGXseIDns26zicM+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685210353, "uuid": "2cb71037-e929-4e8e-ba16-1950d30a8b5b", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685210353, "uuid": "3fc9ab87-790d-40cb-a3ea-e0b43052f681", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685210353, "uuid": "64bdd2cc-79ec-4ded-b1d0-db9664dc54ba", "value": "02914099.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fe473aa-fc92-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685194165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194165, "uuid": "a131d541-08b7-4e8f-8538-1778d787f978", "comment": "Malware payload", "value": "2f6649730fe0c6daf60ac91cbcc2273b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194165, "uuid": "8cd33b4a-6521-45ae-8b06-b18ec68f7366", "comment": "Malware payload", "value": "5043171432237c4d824278c60010f33acc58d79f51ae1d4acd59ccc3cb44ae35", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194165, "uuid": "252f4042-0d16-457e-a67a-b1b70cc92391", "comment": "Malware payload", "value": "c22d69a2ed74a088237ef1a3df4c36726a771213", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194165, "uuid": "741bf3f4-b9f1-452b-b2e3-9ea4ce616e2f", "comment": "Malware payload", "value": "deea737a6ffa6d43d0ecf0be495e5e60a9c76f859ac52395663f7ef1c7ca3880c4967b8102f8db4fd3f08e05ad90ed49", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194165, "uuid": "578410ca-d6ca-48db-8f54-a5123c6d37ae", "value": "T13B065B3072CAC577D56605B0AE2CABEF51687E754F7148CB6BD82E6E14B48C24231E2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194165, "uuid": "8c8a3009-0e16-48d6-86fa-7b07316db9a6", "value": "1ee3b0da38e7b7c567f93f357ca3751c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194165, "uuid": "478d6019-d9b7-4aeb-9e3f-6a7b7ecb6374", "value": "98304:h35E+vGaiDnXGtwcmoQvoTn0iMYexBA7YnkPOYnqGGse:/vGacofn05WYnk5qGGse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685194165, "uuid": "7cf9b2ad-8506-4f3f-859b-8f19d3b2c3ff", "value": 3729238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685194165, "uuid": "953a9cbe-0c21-4c5b-aa16-810f281b8b65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194165, "uuid": "5fac7a00-baba-44b5-9442-c1205f41fb07", "value": "05642199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35144257-fcad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685205636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685205636, "uuid": "8f3f4c10-9e63-4c9a-9394-607b3cc3d997", "comment": "Malware payload (Amadey)", "value": "c52bdf15327d13e10ee2b9a294183aa7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685205636, "uuid": "76cf43c5-c16a-41e9-9a43-cd0ba6499726", "comment": "Malware payload (Amadey)", "value": "50685399f6252b3ea2ba2871cc00f3fc5516beac6b5eb130bdb12edc01b36153", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685205636, "uuid": "09d5f8de-22ef-412e-9c0a-a5bb9d2cfbbe", "comment": "Malware payload (Amadey)", "value": "b7ecc8a0d23c31d363d11fefac78e201ec150d3a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685205636, "uuid": "944ce885-9904-4d61-a216-ba90cf001b1e", "comment": "Malware payload (Amadey)", "value": "53e1f315fc44b7962f112c1c910228d6dce51c2932c400996be2a122d985c057efd079ea1065b11d96d408e5df776126", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685205636, "uuid": "1ecea44d-79a0-4d35-a505-f8afeaf07296", "value": "T1BCF42311A7EC8472EDB81B3054F713D32B397CA02974862B774E999A0CB27A4753537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685205636, "uuid": "23a53b85-6c78-46f5-a698-fc99909335a1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685205636, "uuid": "fdb90de4-e5cd-4ced-993e-a5abc55052e6", "value": "12288:1Mrqy90T6IJjHQ6QM/tDuEWqmoJSa7IGnuauRibAoHpStyIRoGq9Qo/+U3LpP2jG:Dy7swPM1yYmoJxMGBuRCHpStyQ4QoT3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685205636, "uuid": "c76b71c0-3269-410c-83f0-83b208dbe1c4", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685205636, "uuid": "97904742-9fb4-481b-a5eb-7ed2ebaa454e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685205636, "uuid": "22f0bfc6-6fa6-4fe7-943c-7a8ae5655558", "value": "c52bdf15327d13e10ee2b9a294183aa7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55066d4c-fc8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685191087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191087, "uuid": "1ec816dc-c108-4019-8f36-60f0d5ff1e65", "comment": "Malware payload", "value": "02eacd7d8285a4d5fca2625dbca66a3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191087, "uuid": "c77958d1-ddc0-4961-abbe-87014a9b9739", "comment": "Malware payload", "value": "52406e16131a007ab3e015a987704193249f575825c6adc1366e5521bc67d78c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191087, "uuid": "00e41829-1a21-42b2-91c1-f49909c9539b", "comment": "Malware payload", "value": "4606edb37d46ce85a1f108d0663a1712a540948d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191087, "uuid": "17350855-b61c-42fa-a9d6-38a94df1d7db", "comment": "Malware payload", "value": "5020b7609c41c33b06b6d91de5127197a87e62d0c395aca2c5922403acd40a74e3466ffd8acca816597f1225969900ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191087, "uuid": "17727321-f89c-4cfe-8a6f-c7e952c0a50a", "value": "T14EC239629D6D5E44D628DA79F8318F7D1B23AA05E5870ABA412B8672D003EDDFC0D2F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191087, "uuid": "9ac40c20-27ac-41b0-bd41-40fb561024ad", "value": "384:znkSjzpbEYFMZW3GZtyA9iTc6QlwEWeiwbWdhIXJGtPIJPChof/3EqBxiCC7wnh:znkHrU0iPklGToHUMiCxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685191087, "uuid": "7d787dff-1e3e-4404-afad-a723842c8998", "value": 26712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685191087, "uuid": "9e64230b-e508-4bd4-b803-c3df5770a890", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191087, "uuid": "d9fa8442-3d90-4e76-a388-62142c4bd30a", "value": "superh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d12e2e9-fc28-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1685148688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685148688, "uuid": "cdaf0ecd-5021-4c51-86d5-7e2591657895", "comment": "Malware payload (ArkeiStealer)", "value": "0a2dd335b9609abede010ab5337985ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685148688, "uuid": "313a4ae3-8008-4021-a2b7-3d4f98cb44cf", "comment": "Malware payload (ArkeiStealer)", "value": "537c3e56e01ced9e64abbe83dd28f0a74a8ad634e46de55b62556fd5006be206", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685148688, "uuid": "3873f3f4-dcfc-4fd2-ac4f-40db2c9d4c5d", "comment": "Malware payload (ArkeiStealer)", "value": "3a74aa21cd528a1e81a7194d16bac80d59b6fd3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685148688, "uuid": "d8729a70-71d5-4edf-97dd-a78e0b24614c", "comment": "Malware payload (ArkeiStealer)", "value": "3b8f98b33b694b6865499e30acbf480b82af6265b6126d74ed9b0fdf4756eb3dd10a96329e7b9bdcdb8320cf524acf84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685148688, "uuid": "d2741d0c-63d8-4629-8944-48105041dbaa", "value": "T106948D0392E17EA4EA274B339E1EC6E8775DF6548E093B6622196BDF04F01B2D173781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685148688, "uuid": "06ce21af-d6e0-4aaa-b503-8a59da8445ce", "value": "bd191f6a78cc98a8bbe61db18ad8e9a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685148688, "uuid": "4bab8e83-1719-4d18-8202-466d0b69a563", "value": "6144:qBxj+ktFZBHh2WGEXc2mCPHMsriJ/6dOOrlI3CMZTarcNx:qBZ+kh2XewCPsHJ/aO3SMZTarcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685148688, "uuid": "c288f7cb-0a88-4920-ae37-262d15c55ea0", "value": 412160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685148688, "uuid": "85da5051-58fa-439d-a295-9a7ec3006211", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685148688, "uuid": "2516ba61-95d2-47dc-9a31-ff269e73d2df", "value": "0a2dd335b9609abede010ab5337985ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b858e89-fc8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685191017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191017, "uuid": "9ed45ae3-0cc0-4dd1-bd70-4c644d5147cc", "comment": "Malware payload", "value": "43c6b73e8db18653a3973f8081a9858b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191017, "uuid": "b6cbf387-20a6-4177-b0ea-14ae2d4bb229", "comment": "Malware payload", "value": "54ef0d85490a89bb66bcdfbe9e47f7d6bded3a2ec154cc98e51ba02f3e0ede5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191017, "uuid": "cf994155-b4f2-438f-b9e4-85ebee0db22a", "comment": "Malware payload", "value": "4894055bfbee9bd378a46585fc58a6630cc1961f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191017, "uuid": "64e0969b-6697-477d-8f63-dd276378fe89", "comment": "Malware payload", "value": "6484935a0b017c22243b6a65024182dd003eaf0ee5e7083649520ac3b5c723333c666fd83118287a9ed30d4be1ba501f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191017, "uuid": "1402066b-68ca-4759-a57c-72dc2a613374", "value": "T17C13740ABF654FB7EC1FDD3709A81A05308D641A12E92F3A7974C91CFA5B24B49E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191017, "uuid": "3d7e9f1e-5b7f-457f-a0a1-637eda40b035", "value": "768:wEW4Wolta5Mz0sowT0DLctL1uRweIeQte0gNx69IZ2/Y0XiTwBABmzQiS:wEftR0sDB1LtNtrgNx69IZicBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685191017, "uuid": "16faf0ba-b706-4881-9fcd-b8d6a89102c4", "value": 42968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685191017, "uuid": "66168775-41b5-4043-a415-bf6eb7199bac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191017, "uuid": "203565b0-8871-4e23-956a-0c0dd4581922", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe0c143-fc57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685169013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169013, "uuid": "0e9ab61c-35da-4500-811b-5178348568bb", "comment": "Malware payload (RedLineStealer)", "value": "5a2d38fb973daa43703d3e9fbcb945c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169013, "uuid": "011602e1-af23-4003-8b7e-4cab27696841", "comment": "Malware payload (RedLineStealer)", "value": "559aada01f84fe0dc8011fdb8325246ae1468b7286c4bcab518d95f5236a18dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169013, "uuid": "514c6243-0f25-4b25-a2f9-ace12dec830d", "comment": "Malware payload (RedLineStealer)", "value": "318ff426bcba8a17d3924d843078db4270a10a15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169013, "uuid": "71ee70cd-1df0-4358-b016-82260ca01575", "comment": "Malware payload (RedLineStealer)", "value": "5b61d08388565c81e762bf1b258588d5c69b310da0c46d280e0a02b62d1b8688c13bfe0b7ac6d9f7aaa0cafe59d04d8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169013, "uuid": "b8fc86b7-6dbe-4410-bce0-5164b8144672", "value": "T137F41263B3C04073D9B227B16CF3069B0B397C679868C7676646B9C91D73BA1A93131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169013, "uuid": "4df8bffb-631f-4234-a567-b64e1fccd559", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169013, "uuid": "a5b920ed-8e68-40ab-8188-ebe31aa6663b", "value": "24576:syJPbWevLwd5IUgOsz3ul7UQtK8Vck3uS6N:bJCevYQz3ulfoS/R6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169013, "uuid": "b4a44826-bc66-4bb5-87c2-df6ee3640e0d", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169013, "uuid": "b0e89318-5942-438d-b989-3a605ad7d3b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169013, "uuid": "96e45ce9-3ffb-421e-9c9d-16de6234f54a", "value": "5a2d38fb973daa43703d3e9fbcb945c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "421e5de1-fc6d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1685178170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178170, "uuid": "252a532a-c902-4e91-964e-b0cbd2b1ad43", "comment": "Malware payload (Stop)", "value": "cf63b4271f72e49b978cc2ae1b5b55c4", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178170, "uuid": "a7db6815-21fb-437a-b83e-2fed5cb448cd", "comment": "Malware payload (Stop)", "value": "5713ff744cd3e992f8171a558774d6d0a105dd1041fb54db7f32488ce51fb036", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178170, "uuid": "07d7a4b3-6392-45f9-9c4f-89664153e6f9", "comment": "Malware payload (Stop)", "value": "86d09617aca1964f9a5ec5d4a2bbef38e2b34e18", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178170, "uuid": "09666403-801b-491e-92ae-7280b09442bc", "comment": "Malware payload (Stop)", "value": "a50c56e77592aeac7dfd464b1d3e2b8ff0bf67e567a1495411d12b41a0a93c0e0e779a185cf013103e47b85465f752dc", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178170, "uuid": "2f41ce03-f90c-4b0d-bc32-6c11b43f765c", "value": "T1ED05E19392E17D99D9228B33DE1EC6E8731EF6548E49376622186BEF04F01B2C1E7351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178170, "uuid": "8e5356d1-813a-4340-8ec6-fa034dc66452", "value": "bd191f6a78cc98a8bbe61db18ad8e9a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178170, "uuid": "427836d1-7c52-4baa-a74a-99ecb5e5f380", "value": "12288:K6zN3CX4lpvIuWha00kC27Dh2YD7FRko4JKXtu95rx62HN3pk3Is:ZNVzWUs5F2Ysdrx6cZkYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685178170, "uuid": "d105b492-993d-4573-9e36-17a84f057beb", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685178170, "uuid": "a2434aab-b3b4-4ebd-8d55-2af785b94677", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178170, "uuid": "ff4e9446-f34f-4876-a5bb-bc4f9bc44031", "value": "08177699.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb87c5fc-fc9b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685198131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685198131, "uuid": "6ecc6170-d20a-416b-b1c0-c2430705fd97", "comment": "Malware payload (RedLineStealer)", "value": "b493ff13edcbe8082bb7545582e7172e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685198131, "uuid": "893268fa-e8f3-442a-ae8e-efb46fcff15b", "comment": "Malware payload (RedLineStealer)", "value": "58cdb2341547668221bffc327a15192c3072e010fa2aea5da2a0d3093c9e12be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685198131, "uuid": "4f4f8376-cac1-443d-9074-ded88c791975", "comment": "Malware payload (RedLineStealer)", "value": "6200e4b268b4a43a0d217ba4f03f4612067aba21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685198131, "uuid": "eca04059-60b4-41f8-98dd-8dbb6f91e1dc", "comment": "Malware payload (RedLineStealer)", "value": "317a7f28b08926fdb0e5cc7c83f8cf7e4f847bea30557af248b21a14741167a645dbd1590a9d3a0d92844e053fa1eb04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685198131, "uuid": "fc4a7ed5-878e-44d2-92ed-904fbd3aff59", "value": "T1E0F42302E6E85433EEF51B7168FA0F830B31BDA28E74C66B5650A85D0CF2145B476BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685198131, "uuid": "f9d70562-88df-47d9-9ca2-05241ff2bebf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685198131, "uuid": "3e6477d8-bfa0-4578-ab46-cb407b6d3ad5", "value": "12288:5MrGy90bMV6dddOzRXhp0d02Ip/r9TWjo16IX2QCxXHx3i7QtKX:vyh6vdOFRpM02IJr9TWjzpVH87kKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685198131, "uuid": "4fc484f0-8bf6-4cbb-827a-27440b5bcc78", "value": 778752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685198131, "uuid": "a7916faa-0f28-4f80-b6a0-fc2244212851", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685198131, "uuid": "01b2a885-1c5c-4874-ba51-27c9216fe910", "value": "b493ff13edcbe8082bb7545582e7172e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d74d3b-fc5a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (PrivateLoader)", "timestamp": 1685169991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169991, "uuid": "84170594-8459-4a92-b99d-19e60e055d6b", "comment": "Malware payload (PrivateLoader)", "value": "25c2e6d421fd59f3775a6e46ae76bbcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169991, "uuid": "299eb504-a36e-40bb-9bce-9e49f35dedeb", "comment": "Malware payload (PrivateLoader)", "value": "595daef1eccf4f144a39610006cf77e8ab32dabce45675ed48011a3a8e739558", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169991, "uuid": "c8796e1a-b2e7-4e3e-be2a-5879372314fe", "comment": "Malware payload (PrivateLoader)", "value": "f598487cfb56f551a3f4c62d9e22e5c3d4862e7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169991, "uuid": "b6e6c146-2b1a-46a3-838f-01d0caec727c", "comment": "Malware payload (PrivateLoader)", "value": "9d2cb7f5d32383e2d5e545385fb3bffd777c5be5b592065d6a6d8df5972b902d013abf5629c038ef34889690b5a109cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169991, "uuid": "3b3d57d9-6b0c-4514-9703-0385c8d429b8", "value": "T107A56D21E211F029FCA240FAF6BB09FB59281A30238514FBE7C1AD957BA16D1F635D17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169991, "uuid": "4c7604a9-0e74-4f1a-af38-9a8a3bec4ed8", "value": "49152:kHEP1Ytp7MnOYoH7NzvsfZHXlIZELxmuY88jIvnPojMuHmsMtTQpv:GEPuBSONzvsfZ3eCxmQ8cWmsMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169991, "uuid": "8a3d3245-6eed-4e1a-9817-610bfd6c14dc", "value": 2231394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169991, "uuid": "10b078da-a660-4e0c-aef4-9678cf3a8b09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169991, "uuid": "cca168ca-ff76-489b-8b83-68a87555bd9e", "value": "25c2e6d421fd59f3775a6e46ae76bbcb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e0328f-fc6d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1685178254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178254, "uuid": "999348f3-9e52-4e1e-9acf-716187d433e5", "comment": "Malware payload (Fabookie)", "value": "eedd7ab914b7822fcb3e36b0e9bf9b6f", "object_relation": "md5", "Tag": [ { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178254, "uuid": "d51ffe4d-570c-48db-97d9-6e0c4a2fe7c7", "comment": "Malware payload (Fabookie)", "value": "5969b46b8fa8960b6b7f92952d9a10cd63b1175f39633d2bc5ca890438353646", "object_relation": "sha256", "Tag": [ { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178254, "uuid": "36f38379-d83c-4fe5-9efe-33b67c20e360", "comment": "Malware payload (Fabookie)", "value": "a1517882a31a326ad1c78677cb80ba7c234d2d96", "object_relation": "sha1", "Tag": [ { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178254, "uuid": "7a575615-0ee0-463a-be25-bc300654ba4a", "comment": "Malware payload (Fabookie)", "value": "f3b3c831ab8ae2050b1cbec761fa2e006d5a0ec4db2f769c594514ebf333aca32f95183e7f9f3aa7944a34ead496e4cf", "object_relation": "sha3-384", "Tag": [ { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178254, "uuid": "b4d7e882-c3b9-4e43-ab09-7b3a9d1b5e40", "value": "T1FC543A0392E17DD4F9264A739E1ECAE8379DF6548F49376A22586AEF04F01B2D173381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178254, "uuid": "f4f631ec-666c-4ecb-a9cd-0bc103706fba", "value": "697c6731df2df92c82c75859d21c5f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178254, "uuid": "bf7df9eb-f728-4c2d-87e8-1f09a255c7ee", "value": "3072:Grz2YThTaDYG4d5kik/R0/WsZ4cT3EQpACMciVVeKCup/UniUm5Qk9A:kz2YMDYG48Rgv423EQuCMc6kKCA/Ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685178254, "uuid": "9231f693-865f-4a29-bf04-5d86739cb3b0", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685178254, "uuid": "5502a05a-9a6b-46cb-8d91-d7f1fb091f0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178254, "uuid": "619dfb9a-789e-499e-94a2-d65df71ae45c", "value": "09563599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b04e7c9-fc58-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685169246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169246, "uuid": "7711811e-2bd7-4280-8926-e448853fbfe8", "comment": "Malware payload (GCleaner)", "value": "078ad7ff94e6c34a1ec89508a72df47c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169246, "uuid": "dfd6ad12-ef98-4ca1-aebe-9389510cdf5e", "comment": "Malware payload (GCleaner)", "value": "59e6c371955e6a8f2891f24b57fe3b58917a7c14735104034cef4df3157bd4c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169246, "uuid": "3322ff69-546a-43d4-967f-fd5ea4bb96c6", "comment": "Malware payload (GCleaner)", "value": "97a99cea03ee56b4c305dee959ea03003b7df633", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169246, "uuid": "ffcd92f2-3f01-42e3-860f-ed2fb7fd3bf1", "comment": "Malware payload (GCleaner)", "value": "2b638d2f5633ff338c9cf1ec1451b9aac16c48b818e23bcdb4808c24eb1935a06c74bdc539e8b5b6b9ceaca29c9defde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169246, "uuid": "393d24ba-8079-47a3-98f3-86d22eff43a5", "value": "T1F8746B1392E17D94E9669B739E2FC6E8771EF3544E193B552228AEEB04F00B2D173381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169246, "uuid": "1a915c2a-3659-4c48-934f-a31bf5069335", "value": "019c3afb9e20d1069ec440ffb48da873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169246, "uuid": "2691d2b6-5118-46c5-b311-e85f94b028bc", "value": "3072:1n9Kp36wJ1vqFzWzVmFlkIZ+U/iVOO5mteLZtxDmRNEyPf4EMmyh0hz/IL01LIPc:1s5IzW5YkIZgOcLrxDmzhPAsigIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169246, "uuid": "bb573af4-9ff1-4b75-9cee-769ced8e212c", "value": 369152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169246, "uuid": "ffa6a50d-dfff-413e-8b87-95a49e1acde3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169246, "uuid": "47053307-a278-4899-81c2-b9dabf3cdea8", "value": "078ad7ff94e6c34a1ec89508a72df47c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbacbda7-fc93-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685194695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194695, "uuid": "2b037b7b-640b-44fc-8ff7-de90991f2504", "comment": "Malware payload", "value": "5079d5992497325dd379996d819ef7ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194695, "uuid": "7e76ce5c-163f-4513-b73e-ed0bf64dff3f", "comment": "Malware payload", "value": "59f6e559d4053e7b5358708d5c6ac677889ba5702ef8e71fb64bd11494cf5c58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194695, "uuid": "328aafe4-3415-4b0d-b6d9-e329f9b09299", "comment": "Malware payload", "value": "e4ac29e332fbd889f2e65d2a08cfcdcffddddb99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194695, "uuid": "03a9b8c2-36fc-4c5b-842d-68788a57a52a", "comment": "Malware payload", "value": "79ee8b4dffea163d0f25dd4673fbf0835a76993a170c2cf4eb8cedf201029d28b8c5b3ae5d84655cb5b59792e886af9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194695, "uuid": "780a984a-af6e-47c6-bcf7-9941df91af34", "value": "T160E64A07F89191E5C0BED170CA269262FA303C485F3167D73A64FBB92B32BD85A79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194695, "uuid": "687f0646-7948-4262-8a7b-f5218d67b25a", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194695, "uuid": "22ff1153-079b-40d5-b419-f36165791fa1", "value": "98304:059xzBaKClql8V3c3FcrxE1/4/1oC9PblSe:0nRB3ClTQFc+e/1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685194695, "uuid": "afb367b9-ce45-40fc-97ec-a80ab37bc228", "value": 14533120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685194695, "uuid": "54947479-269b-49c9-a991-f174bdb961a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194695, "uuid": "1419a887-c393-4255-bd36-c371561587ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a6c7ebc-fc89-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685190130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190130, "uuid": "67e7e56c-b771-4658-b93b-f9f4a0f98763", "comment": "Malware payload", "value": "c5422bcb0392a6511745dc86a6c720ce", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190130, "uuid": "fe8c46a4-9cca-4fcd-b069-61772917af49", "comment": "Malware payload", "value": "5a15932374b0461e141699fc201ad25337ba405e63d538ccd33f2cb8e9acf3dd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190130, "uuid": "e588dbb6-b28c-4da3-961a-ec988dbdb517", "comment": "Malware payload", "value": "59faade8d9cfd890bc02a948c22fe8316685c758", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190130, "uuid": "62261587-a191-441f-8ed9-577c47e2418d", "comment": "Malware payload", "value": "1c8d07d5bee85d55bf8bfa00c7c73c8a4c87227b22c790c53046b11ddaee11453f2c7c20bab92dd375fd7b95d2b0e2b9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685190130, "uuid": "fc0a6b6f-6c8b-445a-a57a-d8ec13608a91", "value": "T114E092CF109550840504DBEEB6A20C18854AD1C96AEB9F1A7CC907B7D8CDE4C3091FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685190130, "uuid": "9cda720f-de80-4e4b-a90e-1aef58be93d2", "value": "6:OZPrthvSaRS3GlUfrg9FNk7EkKpUfrgoNk7EkKpUfrgYIhFNk7EkKpUfrgEzjNkz:yPLvVe+pNkSKNkSSIjNkSmzjNkz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685190130, "uuid": "c875bace-49db-41c0-b11a-63265e17cfe5", "value": 414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685190130, "uuid": "a71a2885-b12a-4dd8-b8d6-06c565ebfc0b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685190130, "uuid": "8d76ab85-0506-4f09-8a2c-de320fe32d69", "value": "s", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7dadd4b-fc58-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685169322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169322, "uuid": "ddc1c1c2-564f-4cb2-af6a-03730b65d8a7", "comment": "Malware payload (RedLineStealer)", "value": "3d6e0f4135a3a4811a7122d648736e08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169322, "uuid": "facee1ff-2ad9-4f81-9c54-89878b4f3e38", "comment": "Malware payload (RedLineStealer)", "value": "5afd44c8882ab7b57654d49eda5ff98bbc41ee7c02bcfbda8eeb8697b4733156", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169322, "uuid": "45a8d024-0c2d-406e-85bd-c7abb0f57681", "comment": "Malware payload (RedLineStealer)", "value": "a4a118757ed4ea420b80e8b8a0e9d064e9967acd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169322, "uuid": "412084ab-4f0c-4463-aaea-c5ca5859d5a4", "comment": "Malware payload (RedLineStealer)", "value": "749b21b9fd2d6effa735783575cd7fce8203dc8a2ccf04c7a13a305709205c8d4dd40f4ff7325d0ea0b0a00a9ed48a8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169322, "uuid": "fe3055e0-2e9e-4d93-ba93-8707ace17c8b", "value": "T1C5F41253B7E481B3D9B117711CF303871B3E7CA68AA49AAF278599DA0DB27D06470372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169322, "uuid": "6ecaf79f-fa5b-4aed-a5f9-c35a93b9b444", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169322, "uuid": "e88bfba6-a462-4376-a412-26478115a578", "value": "12288:sMrdy90sM7yDOVyrhPpKWUwmjAJrT7LsGyydePQLlTE7om8T9e3+nULk3NTfSuCU:5yVxOIrh81wm0xTHsqQPom8LGk31STU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169322, "uuid": "cd951bac-7642-4662-9836-f5f46f42cdc8", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169322, "uuid": "cb43d622-4150-4634-8c8f-87742bf6e044", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169322, "uuid": "8b6356b3-bcd4-4133-b7fc-b1f0f355f8e2", "value": "3d6e0f4135a3a4811a7122d648736e08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "506cae8a-fc6e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685178624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178624, "uuid": "4f5a7a18-3973-4771-b746-0ae5eb63758e", "comment": "Malware payload (Amadey)", "value": "70ebbcd4a4103af9236a179646b43502", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178624, "uuid": "1d4c4f15-fdff-4f72-a6dc-c1d99a6031e7", "comment": "Malware payload (Amadey)", "value": "5b63a988f91d2bb51165710a3b94bc8c9161b462b1b3f45496f7a5395d1a1bd3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178624, "uuid": "738c00bd-48ef-4f15-ba47-0e9c9c592aa6", "comment": "Malware payload (Amadey)", "value": "b98966d18144f32d74f9277a6ea66ac2057ea830", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178624, "uuid": "83ad7227-a3fd-4dfb-a072-cdef7278646f", "comment": "Malware payload (Amadey)", "value": "656773867ad2c4b18e835c0811c0ede0eb7e5e9942dad69ee8d4e6b0f7948029025d313bbfce24011dd884531e73dfcf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178624, "uuid": "8d475826-e51e-416d-8612-873f767c082a", "value": "T16CF42242FBE84033D9B4837018F713C31B3ABCB65D688AAB2751AD691D72691E875337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178624, "uuid": "54d6a799-a858-4b93-b1d3-9684f3991b53", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178624, "uuid": "c053b9f2-60a4-45f5-8075-9774f356232a", "value": "12288:8MrKy90+PVB6omKGSjE1aA+CcHhiPyurDOzYUm8T9l3+4ULk3NTcSw:WybPVBVNbE1bXci3OXm8mVk3SSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685178624, "uuid": "6f0875a3-b4f8-4c7a-9af2-15a950d28575", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685178624, "uuid": "83945469-37a0-4b54-afe6-2e84c7279e0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178624, "uuid": "d9760310-00a2-44f7-9b3b-893d19209bfe", "value": "70ebbcd4a4103af9236a179646b43502.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5718f281-fcc1-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685214283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214283, "uuid": "475fd448-3f14-41ff-ad0c-4d2a7060fa8e", "comment": "Malware payload", "value": "d5ae7e439e395d6141a61958f0f42748", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214283, "uuid": "f8fca2e1-8c8f-4d43-b0cf-ad4d68696a68", "comment": "Malware payload", "value": "5b8757552aa3153c9dbc27539cd461ec4dc04c262785c0524542a8ad3ff74c97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214283, "uuid": "1a82d995-65f3-48a7-ac72-6f160d8afc88", "comment": "Malware payload", "value": "595cc5f9b9a8ec036838eb08151270a22ee71386", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214283, "uuid": "5e5df6ff-a82b-4d70-a6be-69d9cb410010", "comment": "Malware payload", "value": "c63e4b579aae123904fe512b7d2e2ceca243c12d11dc8e9f5c5999fbcd75d3e60b32c5aa17aa3f1d336d844151b067f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214283, "uuid": "810c78af-ed8d-4738-a74e-0e0fc58b409d", "value": "T12D23F14C5301AB3CD704EDB1239A00D86457EDAAA7452E9F1681F7ECEB9002A2035EFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214283, "uuid": "a24bb0b4-0e71-4069-963d-151a05758ce2", "value": "768:hRjP+Jpbl8yqNoYOCkCXF0jZHLW8hDm9FXWLPDUbp8nQY9ES4ussZK6Td:hRj0pqhNoSk40jZHLzhuFGLYen1EFXE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685214283, "uuid": "48fea8e7-3601-4850-8345-e8af165ba504", "value": 46828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685214283, "uuid": "2c253fd0-1ebb-4ce8-a113-79ebab040736", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214283, "uuid": "c5ec6424-0af4-4b0b-ad74-d145bbf87dd8", "value": "d5ae7e439e395d6141a61958f0f42748", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c011000-fc6d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Glupteba)", "timestamp": 1685178241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178241, "uuid": "8641413a-9ef1-4f4d-80a0-1bbef6b1dff3", "comment": "Malware payload (Glupteba)", "value": "e3cca7f8b53c467506897cda6d22d2ec", "object_relation": "md5", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178241, "uuid": "a8a9d5c8-8f54-480b-beb9-e3506f417a15", "comment": "Malware payload (Glupteba)", "value": "5c21d49a85c6d2d09a61fc58df9c41bbad07c7c58df7ac801aec3ee9b3491f2d", "object_relation": "sha256", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178241, "uuid": "1e859c38-0c41-4898-aeb2-f669f5d6b899", "comment": "Malware payload (Glupteba)", "value": "5b49833d150da11b0ffc0df3c3b35f9b4d20248c", "object_relation": "sha1", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178241, "uuid": "ea5a1625-137b-4dbc-abcf-4330313e1e68", "comment": "Malware payload (Glupteba)", "value": "8a5775851b2370c257fb90c5213fe0fd7fb52ae5c0f4415d32d7cd7d48293c80a8e9f099493f2230980348e0867f5dec", "object_relation": "sha3-384", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178241, "uuid": "9f2f0bc4-21f8-43ac-9f0b-ec54c276c1be", "value": "T17A162353E391BDD4E9924A32AE5E93F8332EF6504E98775A21199EDF40F42B1C2633C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178241, "uuid": "5559caaf-3465-4d4b-ac22-beaacc37e034", "value": "bd191f6a78cc98a8bbe61db18ad8e9a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178241, "uuid": "d465b9bc-466c-4146-8a3c-b8816b277efa", "value": "98304:aHVVp2uqi61tX39zbn2cQKXNes4aMrVfmxWuRZxuBKBOBY:aFYzTXNH2c3eKokxlRf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685178241, "uuid": "85218aa8-455b-4496-b4ea-95452c2ef0c1", "value": 4387208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685178241, "uuid": "af090c20-5f47-4cac-b016-f56bb7a990f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178241, "uuid": "547fe524-608d-440b-8131-96394fcde615", "value": "09227099.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e630e62-fc22-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685145871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145871, "uuid": "a8767321-54c2-46d6-a8d3-a0187f17b23a", "comment": "Malware payload (Mirai)", "value": "de2afda43604324fc51e4346286f69a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145871, "uuid": "cdf4abae-c4e2-41c4-b306-6c60d764ad37", "comment": "Malware payload (Mirai)", "value": "5cba8207afb2ec52bc0a4e949f4be80afb549ab16f8fc1f23cac6d180f2c5494", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145871, "uuid": "65997a53-21b9-4518-a1a5-3ee37d773d2d", "comment": "Malware payload (Mirai)", "value": "63360959a97eded2983c15f72a063725df1c9b2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145871, "uuid": "12f369f3-5d7b-4e0e-a3fe-ae06bc2d8830", "comment": "Malware payload (Mirai)", "value": "85894a01639e80bd6ced7a7e9b0a48b4a00506f69aadba9fdf282ec1a880c7b5aa20c8ab844759fc2989354d49833ac1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685145871, "uuid": "3da24acd-0bcc-4b4a-9ab1-6b4e37e84cfc", "value": "T19223198D58412E2CEAD66CFD14624F099E556312E0E34A0FA7BEFEC33CB3268AF15544", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685145871, "uuid": "e4e460a4-4583-4d2f-a63e-ac74a6b3e117", "value": "768:F8X8nS4UzeBeMJiEgWebkgN6IX/iz3gUb4fLSZpqn6MqI2tYfVGjC:F8X8nSDeMMsEVCogUbA2PMqZYfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685145871, "uuid": "547b668d-b2f0-4726-b933-1cfc987dfbe1", "value": 49748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685145871, "uuid": "90ba3062-15b8-44c9-98ca-93b800518b55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685145871, "uuid": "7b29258a-57b2-40ac-b5ff-c9ca030a17b3", "value": "de2afda43604324fc51e4346286f69a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a98f92-fc8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685190986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190986, "uuid": "be06475e-0465-4ec1-9945-e0869c2c74ca", "comment": "Malware payload", "value": "5651dde2486516e030d58242e46d7db7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190986, "uuid": "8bf7287e-0c6c-4d4b-98f9-bb6cd06ab030", "comment": "Malware payload", "value": "5d647044186d3abb102379f9d469594277677124b2226c118644fd7461b56c5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190986, "uuid": "d1c86879-89ba-40ca-8c8a-c30a4c9a4c5d", "comment": "Malware payload", "value": "5c3c89f1645490fd788cf6c22b3b2ded2f22914a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190986, "uuid": "0f05baa0-cfbf-4407-9cdb-a49249f682a2", "comment": "Malware payload", "value": "c5e1daf5ed0ee2f23c9ec313d795a8242789c2a1b82544eaab00eb74155d0ddd660e860e285b67b5c58d944ea89e8cbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685190986, "uuid": "800df136-ca2c-4bc5-9a29-be60c98ca9ac", "value": "T1E6831A8FBD4B0D89C067CFF047AF838E1D2316649DD2D1E2A9AC5DA928192E94DC37D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685190986, "uuid": "718e23ad-fdf8-4e95-a211-2ea5702a208b", "value": "1536:dsGQxYQkdTwskTljLyZ+JFv1xKuTOA+JfZzv0/LW:dsGQxYQkdT0NLyIXvXKuw0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685190986, "uuid": "5ab1cb99-5721-4a3d-ae4b-acf11912f865", "value": 84004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685190986, "uuid": "5c5d3ec5-55c4-43c2-8558-c232406a1d9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685190986, "uuid": "13c4c32c-f060-477f-8c5a-c0df161e671e", "value": "mipsel64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee468af2-fc9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685199934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685199934, "uuid": "16941929-54bf-48da-81c4-c7f092f1f69f", "comment": "Malware payload (RedLineStealer)", "value": "796feb5aba553ddeaf8f65e5bf8445a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685199934, "uuid": "206029be-720d-4382-9d5b-452171a48590", "comment": "Malware payload (RedLineStealer)", "value": "5d7fdd85bdd9c6e8c330e61d51b7897e821f83148b69a8bf1ece2bea3cfb8bf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685199934, "uuid": "9e23ed58-a36a-472d-b756-eb6cfdbfc468", "comment": "Malware payload (RedLineStealer)", "value": "d612227f2b9a2631210f8246624fa6913968aaaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685199934, "uuid": "c97d1aba-00d1-450a-8554-3f356a000e5c", "comment": "Malware payload (RedLineStealer)", "value": "e3aa37a449e2578d48709d6c1c43d4ae69290f8eabad34fba150b95715362de8e546f3187d5f2c844abfbe97aef01f42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685199934, "uuid": "753b97d0-1fb3-4285-ab60-abab74e2e9c5", "value": "T14AF41213E7ED8576D9B917B42CF703930936FDA1587C831B2BA4AA1E4C316D8A13136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685199934, "uuid": "d38ad657-11c5-474b-8e00-61cce0ca8212", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685199934, "uuid": "4e7d1c3b-1745-42f8-945c-f226647d64ba", "value": "12288:tMrYy90/QMwPUjsytT2i5bk7/c5BEi7Cz369Y1skJaeRRuWcMcAkzIvf6pj:9y45SUbl2WkAbL7CzqG1VKW2AkzIaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685199934, "uuid": "91699060-eb03-47b0-82db-fffbc7460628", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685199934, "uuid": "aa38f029-9a2f-42e5-b7a3-cff04c664645", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685199934, "uuid": "6ca16b7b-5e3a-4e2e-a19d-78b82ef42cfc", "value": "5d7fdd85bdd9c6e8c330e61d51b7897e821f83148b69a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727d4e8b-fcb8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Glupteba)", "timestamp": 1685210464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685210464, "uuid": "a9003f1f-4367-4898-8c11-ac4a810f5efb", "comment": "Malware payload (Glupteba)", "value": "eb7caac34281228f4e4c4d354b258f7a", "object_relation": "md5", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685210464, "uuid": "77e94ee7-5bb9-4ab5-91dd-f66ed4349f6c", "comment": "Malware payload (Glupteba)", "value": "5e85ebb6d604f5a2a06d3c85086829f428a0c6f77c625978b259e718f769a0b8", "object_relation": "sha256", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685210464, "uuid": "a6706133-d01f-449b-8e27-0e82351fb640", "comment": "Malware payload (Glupteba)", "value": "ee47cb768e3dc247ff8802da08e525135fb4849f", "object_relation": "sha1", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685210464, "uuid": "33598a13-05b6-4d55-9b33-9702deea5b33", "comment": "Malware payload (Glupteba)", "value": "24a87e24b420f42c1dbae6884036427c327a5729f3c27e706e718baf8043ca9c153439d945d26fdc71834240d3797ac2", "object_relation": "sha3-384", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685210464, "uuid": "56233632-9bbb-47ad-b934-024bb94ef516", "value": "T18416230392F3B980DD669A729E2FC2A87BADF110CE0977AA51189F5F00703B6D673355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685210464, "uuid": "09c57de2-c2ca-44aa-b454-4d6c108524e8", "value": "82b2bd7dc938b719df57a6b2df186152", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685210464, "uuid": "4f28d5e5-f8a3-4ac3-a001-62cacdf7a037", "value": "98304:mq/U05Glk2CgVBDCliYkov9tFEy6RvOfGtzKWZooEXm:VUQeh7AiKvZEzQfezKqooE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685210464, "uuid": "fc51f1e4-d193-4897-b15f-3171a356a838", "value": 4387728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685210464, "uuid": "9dfbc40e-c43f-4e8f-9339-ea82f56488d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685210464, "uuid": "cb618abd-51a4-46e2-9924-b5c4c81ebeb6", "value": "06781299.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08433f67-fca2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1685200837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685200837, "uuid": "27ebf6ea-7511-4deb-b566-635301589dd9", "comment": "Malware payload (Stealc)", "value": "5a728f79d4ac0ee280e75d2785f4c46d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685200837, "uuid": "342171aa-301c-4fb7-86c2-52c51f4c22ba", "comment": "Malware payload (Stealc)", "value": "5f07f9ce603f4916b0bebb4c3491273056382d8143edd78b081d5500e0ef9483", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685200837, "uuid": "69d1668c-f869-4434-aa5a-f5642055cdb1", "comment": "Malware payload (Stealc)", "value": "de767362ca08fd57c549338576726b45bfb3fb74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685200837, "uuid": "651f30c0-dd03-48fe-ab3a-2b51627edea4", "comment": "Malware payload (Stealc)", "value": "125d6eded30108530ea5b5713539906e98282891e9b91c6a8a998bfd3bcfb752b2360d1e2ea29b770ea6e609fd3668fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685200837, "uuid": "b9ac3ddf-e089-4efa-bb03-6b5e73f60f05", "value": "T19D06D0720B97FCFBF3972C68C8853A640DD46DF351184268FDC289FA26F9654E8498B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685200837, "uuid": "eb0de3f6-f72c-4032-8f17-e37969ade67a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685200837, "uuid": "8388aaee-df81-40ed-abd2-81ec342c5a1f", "value": "49152:OR1ZC0gMbvufmaZvlqbGgRU815tbMmrm65vKLhxWm8lQZQCYqRNAo7w:Ko7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685200837, "uuid": "b52d0e42-3cf1-4ffb-b722-39ddf352d4c0", "value": 3961176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685200837, "uuid": "2d01efc9-e388-4b01-828a-ef0cf222f670", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685200837, "uuid": "65c3a155-740f-47df-a1cf-3185dabe7e2b", "value": "5a728f79d4ac0ee280e75d2785f4c46d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6800a88-fc6b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685177480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177480, "uuid": "cd4f38d0-0b6a-4bd2-96f2-a64f9f0355d8", "comment": "Malware payload", "value": "d7bd6a17466dbe1e448956b0018ad94d", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177480, "uuid": "3c3f8692-c490-44b1-8f12-c313902f3ae8", "comment": "Malware payload", "value": "5f5f8f102490525c22deed33b94fa01b52289e7166eedccd04cfece900958669", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177480, "uuid": "5622a292-3f71-4218-879f-06b493f8e8e2", "comment": "Malware payload", "value": "a9d50d22cc9024dc6bd3297286783ef4b38d6f99", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177480, "uuid": "21429002-7b6c-48b8-b898-59bd945d4eb2", "comment": "Malware payload", "value": "6939cef781d15990c5ad1b0800f019db77783e725a824f0206346b070cf7347caadd8ee8273e4cd6b2bef02d4e2a1e1c", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177480, "uuid": "8699932a-262f-466e-bd99-ba739348e600", "value": "T1AAA1C078C775A9C00AF972C05EE138496078AD23C6748A78E96D4CE77D78601DF356B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177480, "uuid": "37175116-a0a5-47c7-b01a-98b525a35c63", "value": "96:X6rCx5wroLBS4ch7S3NF7wJJTZW+1/BrbBEnwOeelJXk6ccWeCfNYV:q2fwroXY7S3NF7wplBrlEnwkxccWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685177480, "uuid": "fd198f1b-5a75-4d4b-933f-863bef8755d9", "value": 4808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685177480, "uuid": "06de0e7e-9661-4604-b815-80c95ef5a29c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177480, "uuid": "6f2ccc87-ce8a-4486-877d-e4ce646cd50c", "value": "loc.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f40b8031-fc59-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1685169879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169879, "uuid": "0811bbf4-df3f-4024-a432-55e723a26cbc", "comment": "Malware payload (RemcosRAT)", "value": "51a7de0fb6d6ec17adabe9d4ee3f9482", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169879, "uuid": "a1c44125-a57d-4a2b-b25d-cc77aa6b9e50", "comment": "Malware payload (RemcosRAT)", "value": "5fabd022624a6b5604cf1f927d3b450346abf4ae1553728ed6447d25b7784a87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169879, "uuid": "f8b1e1e8-bdd6-4d27-818d-65ab777e94a1", "comment": "Malware payload (RemcosRAT)", "value": "5511f63d782ad07ce2857623ddca663488ca58ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169879, "uuid": "b6e78acd-26db-42bd-acf4-96992e75319d", "comment": "Malware payload (RemcosRAT)", "value": "b92741c58992029d8d3abf4fce5460d1a380721a47a154515b4985aaf86da6df4e47f6622fa2715b91bdc492fa772941", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169879, "uuid": "cb13a985-3987-4e41-8ee2-d51da67bec3c", "value": "T12116D03302D3FCF9D3F23A68C6863A540DC468F3A32D9398FE4A05FA65B16549A548F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169879, "uuid": "545ccbb1-1835-496b-8193-157236858e4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169879, "uuid": "5586bf0e-ce98-4d3a-903a-9111b1e5097d", "value": "49152:efUW3OcI3zfffWM3fekuUbbBBjM4rqXv1Zy2HXGcWf8lWNt4EfpcMJVA:4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169879, "uuid": "09afab9d-185d-4e06-b79d-f1682ff7f749", "value": 4142080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169879, "uuid": "5bf2694f-11e3-4435-bfdd-8ea234c6a8af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169879, "uuid": "d67e4136-fc7b-44fa-a0b3-95679cda35ab", "value": "51a7de0fb6d6ec17adabe9d4ee3f9482.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557fbd1f-fc9a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685197530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685197530, "uuid": "efb68244-d63e-4994-9f6c-4caf0c9ec118", "comment": "Malware payload (RedLineStealer)", "value": "a53d95ad10e6424ecc57b91e6bcd73f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685197530, "uuid": "71a7f4dd-5cce-4fdb-a006-c24df8f7e541", "comment": "Malware payload (RedLineStealer)", "value": "612a40afbbc2d8ef6c3625a74b339ed2da36480433e099a0461aa1c5dd569028", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685197530, "uuid": "3623ea66-10d3-4901-96fb-cbe2e9f49146", "comment": "Malware payload (RedLineStealer)", "value": "d0efd476a4f78240bb829ed74aa3fd0e7afcd64f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685197530, "uuid": "36f07738-23e9-45de-9050-ec554f603429", "comment": "Malware payload (RedLineStealer)", "value": "8fc321b7e9e3597c16b52303342afc6800b07dedf37a882bde8cd027765983a30f93def53de706ac4bd64961b1386af8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685197530, "uuid": "655ede45-12fa-4351-ad3f-93b95e1aa571", "value": "T1F0F42212B6D84032E9B9177119F707832F303CB19C74CBAB3396A96B1E72684E57537A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685197530, "uuid": "ffa9d15e-548b-4286-82a1-d880564a2cab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685197530, "uuid": "7e557e16-5196-4407-b7b5-5c853ef35cc6", "value": "12288:tMrty90v2AzIfELXj2PQpxMlfPErp6IqTvoTJejUnQlm35M6hUp85TDE20gHr4z/:syFAzYEWPFleYIqgJejfw5h75TY20gLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685197530, "uuid": "486cf508-aab9-46b1-8bbd-c6cdf0f8d9ef", "value": 778752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685197530, "uuid": "8041a4a7-8806-4f88-9ef8-f67b626b42fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685197530, "uuid": "082f15dd-3702-4690-963e-026c9eaeb46c", "value": "a53d95ad10e6424ecc57b91e6bcd73f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c67823f-fc96-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Empyrean)", "timestamp": 1685195851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685195851, "uuid": "525ca60a-8c0e-4e9e-9d75-90702df378f0", "comment": "Malware payload (Empyrean)", "value": "9aadd0309dc0327841b892922bfb8b90", "object_relation": "md5", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685195851, "uuid": "c05257dc-0dd9-4c34-a79c-a7fd177a8924", "comment": "Malware payload (Empyrean)", "value": "614bf688144b276c4161c5338116c809b889700baa4c50d26ffaa08c7e868f3f", "object_relation": "sha256", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685195851, "uuid": "69a0232f-7121-4aec-9f19-ad6c3d423894", "comment": "Malware payload (Empyrean)", "value": "e38c00406e7eed0b416b5e229e9c5582613fa398", "object_relation": "sha1", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685195851, "uuid": "462dd0dd-d952-4cd1-a389-5e0d5b7e5bcd", "comment": "Malware payload (Empyrean)", "value": "4cd0e9622d08e01d4457787e0dceaf5cdec1f38bfede5d1456b1377fc3b589a1a0c317d8f62e2f0bcebb39d6ce84fc6c", "object_relation": "sha3-384", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685195851, "uuid": "129babc2-4794-485c-89c3-94000caa1f05", "value": "T1380733C442D9E2A9875D7923ECD76D251B30F6A3D78DE0CE67A6CC5C6FA381CC498182", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685195851, "uuid": "06b8d219-a8d5-42c5-b25d-321dcabad3bc", "value": "393216:HZgNpRT45JOC0v+rkdVtGsp+2ysAzTu1MsEr23MaDCNZL:2TAJOCu+gVGS+rsHOjrynDCNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685195851, "uuid": "3800893c-b683-462f-968b-3464db3a69f8", "value": 18368301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685195851, "uuid": "0a96dd8a-ceaf-4f1c-9300-27810ad50a96", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685195851, "uuid": "ed60c964-15a9-47c4-864a-25aed0131e29", "value": "Nitro.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6db83b9-fc21-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685145832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145832, "uuid": "aca9d69b-2ee0-4bdf-a07a-5f111dedc634", "comment": "Malware payload (Mirai)", "value": "27fd2f89b6e9cc2b33814c7d90b8690b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145832, "uuid": "30cabd73-e617-4308-a2ca-d8036edff82c", "comment": "Malware payload (Mirai)", "value": "6177b39c23c6b0c70569eed2a37d8a91fc0c8d479ab847ad3ab4b867e8b758d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145832, "uuid": "6d97eac3-9f86-4968-b99f-44939d42d8dd", "comment": "Malware payload (Mirai)", "value": "3e07fe43c9635ee0cc23fbd4d6c0664c084a1dc8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145832, "uuid": "3b8e8cc7-f843-4ef4-9c14-8761aff70942", "comment": "Malware payload (Mirai)", "value": "f468dbca1b43949c93038b30702a62305bdb2611325536f83ffe275a831977a85bf377c6c93722fcc609a517782e908e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685145832, "uuid": "787af76d-695b-41b6-a81d-3566bb4d5bc0", "value": "T11F832945BC819A13CAD0137BFA6E40CD371627A8E2EB7307CD256F21338686F0DA7652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685145832, "uuid": "7d678a69-09d8-4026-8e09-2d7b38c4abb7", "value": "1536:22DnBkNE4iC245v2gfDmHJz//cFotbscKFxZoARFKiOPqYiJvbYStWa9PChf:22DBkNGKTxRFKZS7ZbYDMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685145832, "uuid": "2040b3d7-8a1b-4330-99fd-22c1c65f6125", "value": 83256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685145832, "uuid": "81253d9c-2293-4e78-b777-1cce7d9c5cd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685145832, "uuid": "a91d3bf7-6e32-4268-b652-b1dd262e79e9", "value": "27fd2f89b6e9cc2b33814c7d90b8690b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f28006-fc39-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685155915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685155915, "uuid": "75fe4cc7-ad21-48c0-a736-78eebb6498b9", "comment": "Malware payload", "value": "76ace98cadbc3852258fd0f4737a5499", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685155915, "uuid": "7df571f1-779c-4cc6-9376-f68a5569b628", "comment": "Malware payload", "value": "6230ebc76cb08a2d2d8736282b4c12c7ced58a83aa9c79cf6acf6514da9b5d09", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685155915, "uuid": "d5f6289f-c336-4459-8828-37c3315a3869", "comment": "Malware payload", "value": "9c1d06e0734b68107afd2393d7e867062af8105b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685155915, "uuid": "4a45fea0-28ab-4962-a427-23c248b26fd4", "comment": "Malware payload", "value": "cd38bbe779e08a0db19c471cccacb9ba5d18be8299c0c46993f4e418b263156a834ead746f5029893feaf04813b17034", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685155915, "uuid": "63e6d412-d7d0-40ee-8a3e-86957a775447", "value": "T1FFA2E6565B8C4C61E26AE8BB475D900E18FCF23630C215D5BDADE2743B7D10E4B6B2B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685155915, "uuid": "ec87c99d-0192-44ec-9684-6a77347d01c5", "value": "384:nExnf+uw7pVyWiQ+Zp4wblDJqkgan//2co22aIsr1KT8gM0MJqXsxmH:nExnf+uHQiDMkgan//2122aVKggM0C4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685155915, "uuid": "307bda76-367f-4da6-9f74-3034481a66d8", "value": 22434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685155915, "uuid": "63130a43-a155-4997-9b81-bb004425f4c3", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685155915, "uuid": "aed35f82-88a5-412d-9184-3f84b6e6c727", "value": "76ace98cadbc3852258fd0f4737a5499", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf4ee52b-fc9b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685198137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685198137, "uuid": "6b9a1719-be0c-4130-8189-b8990e7a2522", "comment": "Malware payload (Amadey)", "value": "aacf669866c69553c2983113400fd433", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685198137, "uuid": "7fd8c147-56e4-4261-9df0-49cdf2252d9e", "comment": "Malware payload (Amadey)", "value": "629c71be115db2a37c97087d5aec82351dbe505523fa6d520e88c5dc8a98858a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685198137, "uuid": "8a916d01-c8bd-4d1e-8f4c-c1339b03d23d", "comment": "Malware payload (Amadey)", "value": "7d7a8c49b2ed28f386351c74f590559eda609058", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685198137, "uuid": "d70de2c0-04c4-48b5-8d05-b0f85da42bd4", "comment": "Malware payload (Amadey)", "value": "ce3015281cbbf8f90245927d5ec2c7a2596813e04468f9661faa80f078071ad7baa608d43e95e361f2461f5ed3dbd45a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685198137, "uuid": "02c3cc69-34fe-4db2-9c41-2d034bbcdbd1", "value": "T11496238B38D640FFD6C10974C5272FEB23F3DA7A48864D286DC9B245B565FB26032876", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685198137, "uuid": "052d979e-ad2c-4e13-aafe-df4d88596b56", "value": "c4e57a0a2b30a323e3eeb1b8941df733", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685198137, "uuid": "4fcc0970-a958-44da-ae5c-8f909b4ee768", "value": "196608:ZuvGaLYgMZrsB/JvhpACDMR1DJZH4RIBHhfqXs8Teya:ZuvH0JZrkJLAyMR1D/H4RWhic8TeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685198137, "uuid": "62c797f3-a026-4d85-999e-d41abb8aab5c", "value": 8909232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685198137, "uuid": "3c105035-e386-48d7-ab03-3396ef13e2e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685198137, "uuid": "1420cd2a-0ed3-43ee-a210-0ca7f4f23ab4", "value": "aacf669866c69553c2983113400fd433.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "327fd323-fc5a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1685169984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169984, "uuid": "b575cf35-3460-425a-b2a6-39c1fdd35de5", "comment": "Malware payload (NetSupport)", "value": "c80a26b806b3486c6157d8904c2e13e7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "xoomep1-com", "colour": "#8B5AEF", "exportable": true, "hide_tag": false }, { "name": "xoomep2-com", "colour": "#7479B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169984, "uuid": "4e3c4ed5-1ede-490d-90ea-2ed8fb3dcce0", "comment": "Malware payload (NetSupport)", "value": "64339638d9234ab1efe25fe180b3097a6614687c8f83b1cc0c5a1dde570aaf81", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "xoomep1-com", "colour": "#8B5AEF", "exportable": true, "hide_tag": false }, { "name": "xoomep2-com", "colour": "#7479B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169984, "uuid": "591a7def-18ed-416f-83ed-15d4ca24d070", "comment": "Malware payload (NetSupport)", "value": "54d8be3eb5bdd4a788dcef3265cab6c314be1ccc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "xoomep1-com", "colour": "#8B5AEF", "exportable": true, "hide_tag": false }, { "name": "xoomep2-com", "colour": "#7479B8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169984, "uuid": "5013417c-e572-431b-ab11-d2e91851e8cc", "comment": "Malware payload (NetSupport)", "value": "22f6a970f823ed649dcf7a2bd2239c2cf0548ba5c806ee741440df0b00a065bad72dcf4fa7b7c6393b3e0786d0fcd5e5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "xoomep1-com", "colour": "#8B5AEF", "exportable": true, "hide_tag": false }, { "name": "xoomep2-com", "colour": "#7479B8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169984, "uuid": "921ef003-fb2c-4ef1-a26b-d5a7180b3f5d", "value": "T14B21529815FEE3A7E78232C2B13D8955E8F1A4023288EA691C8DD5976C2185CE61A09F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169984, "uuid": "f8e7a483-e0f6-4829-b4a8-61bcddb00209", "value": "24:Q7LFycSVa4rfcGfHg+lIKS7q/CbEbrTjarIWwofHg+l8VKS7+F/Q4AFGHwNxZAFJ:QnFrafco3WKS7qa43EMS3eVKS7W/9NHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169984, "uuid": "019dcd1b-cebd-47c3-a4a5-928891254a7c", "value": 1439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169984, "uuid": "83152360-14a0-4653-88ea-6372529db501", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169984, "uuid": "5f7a81c4-5a95-4458-972f-c55f9cf44f57", "value": "c80a26b806b3486c6157d8904c2e13e7.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b521c10d-fc76-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Pony)", "timestamp": 1685182229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685182229, "uuid": "d000e5f6-d0eb-4be5-84bb-f27ff77f5ff2", "comment": "Malware payload (Pony)", "value": "2fc4a456d3294bb50769381e4a7ae67e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685182229, "uuid": "37c453a1-1e58-47ad-8d3d-e0fc1e618606", "comment": "Malware payload (Pony)", "value": "65d78bece51ee1c500d4058bf724b96ee87cd41eb62a34fb6cb03643423c9d00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685182229, "uuid": "0547c913-1a8b-4875-8efc-6ae9149c7e30", "comment": "Malware payload (Pony)", "value": "b2cf4ea17444d54a9947f95f5e00bc06ad68a52f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685182229, "uuid": "d2f24220-6d4a-4cd4-b7f2-2c481e64e19e", "comment": "Malware payload (Pony)", "value": "bea4deea1ca517bd7e2f3eaa0350bfe3c0c75d136bc79b7452cc025ea15f85ab1f5c3124f4cf53c90c89f88b92ab8b88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685182229, "uuid": "9ddd8980-1a42-4f5e-9376-7eb4cd2b2a0d", "value": "T125A3D099B1D0C06BFF4C72BA186644C53122A3BF5D8293DEE41D339F1D426AF471AA93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685182229, "uuid": "5be40358-2803-4cf6-b377-2820fa5379c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685182229, "uuid": "a82c0c5f-1a41-42e0-b138-1d3a76e48c44", "value": "1536:LzFRP4faiQE1oLAFbGQ09lnrKeXPE2iI5DhXprRFNF8/EIW9QZsDn/:3TPoeLAFQlrKs3XprRFNgEIWSZsz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685182229, "uuid": "7d1358dc-d5c4-4dfa-85c4-bfbf8404008e", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685182229, "uuid": "43543555-5894-460f-9add-95bb23761841", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685182229, "uuid": "74885035-8f1d-4664-b3c9-feeef686126e", "value": "2fc4a456d3294bb50769381e4a7ae67e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6338da-fc21-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685145845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145845, "uuid": "061ceaeb-2d2c-44dc-b5ed-bce1e8988b0d", "comment": "Malware payload (Mirai)", "value": "c08d8ae4b3492cc61a6244c7913482d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145845, "uuid": "83cffc70-2870-418c-b009-4613b9411d37", "comment": "Malware payload (Mirai)", "value": "674dba83b9c08ab6c783b40ec5211759ce15921614393c98407b36bd86493b90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145845, "uuid": "2673d858-f511-468e-90e7-f0cb399dc0f8", "comment": "Malware payload (Mirai)", "value": "43743beb563e5b5a73777cd057c10b3b1e950f06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145845, "uuid": "0e97f67f-7756-4ef4-866b-fe5432aafef5", "comment": "Malware payload (Mirai)", "value": "e2e7da3c27d07ffc5ebdb135113956970c1c23dc046ed2184642a29b3eaf7a9a99183add14de458c388c068003440c06", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685145845, "uuid": "cb6601a1-b2ca-499f-83a3-1a9aa275e4c3", "value": "T1AF734A0173180E47D1A25AF5263F27E1C3FEE9A021E4B689650FDB864676E33458AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685145845, "uuid": "47a2197a-8b66-4ed4-9ead-f803595bb625", "value": "1536:R+P4cNpkMjyg2Uudrd1CrfNwDu5IKPjm9ow:Ro4cXYg2UudryyDu5IAjgow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685145845, "uuid": "f610d8c6-17cb-4c56-b517-80990ee3246b", "value": 76948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685145845, "uuid": "1d35355f-d365-41b4-a9d4-1463d26c3089", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685145845, "uuid": "c0f3a1a7-9bc7-4da8-b491-f91e1a240070", "value": "c08d8ae4b3492cc61a6244c7913482d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6e310f-fc57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685168710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685168710, "uuid": "686025b3-f871-4ccb-8ffc-9026ecc10c32", "comment": "Malware payload (RedLineStealer)", "value": "0cce55748bf188a1432a82de4080a16f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685168710, "uuid": "c56d27d8-505f-4e96-ab80-6714a013ae6f", "comment": "Malware payload (RedLineStealer)", "value": "681d1a56550c9aa05660ab9b1ccaef51634f23f252ff6f4e654b85fe411c5891", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685168710, "uuid": "95ee201b-6d19-45be-bcac-be0fe81b4717", "comment": "Malware payload (RedLineStealer)", "value": "7566f25c3a639646042d1edde60682fd20a824c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685168710, "uuid": "caf45905-b19a-440e-911e-2589c55dc87b", "comment": "Malware payload (RedLineStealer)", "value": "9ec95a19c40c99b0c6f5377995c068ad4bef4f9683bda453fa3d55b86d60e761ed09cc9c02342be4275b0da2968c8e03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685168710, "uuid": "e6e59e9c-e1f6-4f9b-a181-8e302c3a7d04", "value": "T1EE3523136BF48563D9B157B01DF106830B3ABCA4DD3887673381A9EA4CF2394A9B5367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685168710, "uuid": "8dcc9fee-d2ca-40db-b985-b2534d3f57e1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685168710, "uuid": "20fec4b8-577d-4f0d-bf2b-731686211382", "value": "24576:iyYm1+hBq/NgidI0xk3GSuG0z/l6KsnjYJlZ/:JYm1+rm9zMpb0z/l7scJlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685168710, "uuid": "7c7dae3c-6a95-4b41-aa1b-99e4a23eaa14", "value": 1067520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685168710, "uuid": "f8bdf056-2a78-436d-ac1c-b8620021fe4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685168710, "uuid": "703829a8-4ca9-4b75-a706-34d6558d9c12", "value": "0cce55748bf188a1432a82de4080a16f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0949fc5-fc2d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685150975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685150975, "uuid": "37418fb4-bbfb-49e0-a566-4741fd4132d0", "comment": "Malware payload (Loki)", "value": "6c8af0fbafdbfd92df073c0df1be2d56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685150975, "uuid": "d51f97af-77bd-44d1-8c9b-0fa5fa315c3b", "comment": "Malware payload (Loki)", "value": "68fb165f63819908a0bcfb81a4b370d0df062374b1d92b89532be48a92eec06c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685150975, "uuid": "3f99d77c-8a34-4d23-becc-8efc456e8fd9", "comment": "Malware payload (Loki)", "value": "1c40a46e17f4b7c55378a44d80317046aa707c70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685150975, "uuid": "0e5a393c-b4e3-4da3-8c9b-c03355c10144", "comment": "Malware payload (Loki)", "value": "8e2033e7b6e63f2afca9aaa78162668dbdbcdc47dec8d35e94827658bd947965bb1331e05f26690b61ce7321e5b8d59f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685150975, "uuid": "364ff643-97b1-4fb3-8c1d-3974efa41b53", "value": "T154D422A8B2325413F01B7BB515205AB007F675567435D3CE0CC93BEF6AEAF62824AB47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685150975, "uuid": "9c9a22e0-1708-4422-b8fb-2d23d6ab1794", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685150975, "uuid": "52a20391-8c8b-4fa1-a694-143ba47b233e", "value": "12288:U7z5GoJiGaq5au6oGPKajT+FkZG4kpuFiVvOzUFNWcd:C5GoR5adjT+KI4CuFiVGgFNWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685150975, "uuid": "69f12c41-6ebc-4c4d-a454-d912bc934126", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685150975, "uuid": "c31a1d6b-1f1e-4acf-aa73-40a2818cbf6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685150975, "uuid": "45312e3e-6485-41e2-a933-1534e30fc335", "value": "6c8af0fbafdbfd92df073c0df1be2d56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a00c306a-fc6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685177899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177899, "uuid": "f6e28bef-7150-4c14-ada2-9c1c94716c0a", "comment": "Malware payload (Smoke Loader)", "value": "54e8da4e076d19fbf7db2deb44d761e3", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177899, "uuid": "e3ae239e-53fb-4b06-a3b8-bb29e801beb7", "comment": "Malware payload (Smoke Loader)", "value": "6b923938e9dcac76f2195ee41577022e6aa46d79a28f30a8374638246cc4dac0", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177899, "uuid": "51677129-d65b-4fe3-b791-4630b8c85f0a", "comment": "Malware payload (Smoke Loader)", "value": "561c9323e4edc7f05ed215783a9a087c93604238", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177899, "uuid": "96ada4dc-aac9-4d85-a6ba-142f831843e8", "comment": "Malware payload (Smoke Loader)", "value": "ad02d7fda5e8da367e4709c9760bc560925753d1a785d06f51f12120bad4f8a150db962dfb906f8d918a94e47ee909b6", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177899, "uuid": "a9a9b3a0-c31e-4aed-b582-2dde2ad96975", "value": "T1B8543A1392E27D94F9264A739E2EC6E8375DF6548F09376AA2186FDF04F01B2C163781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177899, "uuid": "ca9b0092-43fa-4969-b26b-610f4d095fd7", "value": "bd191f6a78cc98a8bbe61db18ad8e9a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177899, "uuid": "818c6904-29fb-4d5a-bdf9-f8e9d972c420", "value": "3072:AzVJUj9BSNtac8TeAXhJ9o7YRPgqKX5AC9AR3T:uVJUjUtaceeYZPgqC6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685177899, "uuid": "6e3665aa-c5cf-4a68-a6e4-0eddbc5d8446", "value": 296960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685177899, "uuid": "67c3bb7a-98da-465b-86e6-593315773e6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177899, "uuid": "d595ed1d-7f7e-4e61-a034-2082b4059d24", "value": "04093899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bcf6298-fc29-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685149061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685149061, "uuid": "a0fe4bb8-76e7-416e-af10-90b21b70fb62", "comment": "Malware payload", "value": "08da59d77ae966232541d99aeef08c18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685149061, "uuid": "32bfc71f-7703-4492-9371-50e5cc13f02c", "comment": "Malware payload", "value": "6bfd62f7fc7f23ca7ed2805165e5d6db59d2d378c8c028f1e4b9261a8d5f91e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685149061, "uuid": "cb2a334e-3b3d-48d3-b975-eba12e30e075", "comment": "Malware payload", "value": "2388e5ba727cbc695a9e40a6775e42a2d1f39e22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685149061, "uuid": "6f1396ab-38a9-423b-b21c-1befada1b015", "comment": "Malware payload", "value": "9a1a89901ce0eb0280c431102fe2e29d4e3864da0f919a7d76f43052a9e8edf07a6775364f436df334bc62785f6110c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685149061, "uuid": "1f2f869f-61e5-496b-9f67-a8fc6029aa37", "value": "T14B06D0325541384BFD91CE3223D9A1B38F3CEE31194A5912B700BBDE95392E37DA2679", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685149061, "uuid": "23b74f1d-a0ce-4e8d-9ff5-6dae02896537", "value": "5c406f10797a24a51e65637a1e7f84f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685149061, "uuid": "91b2cdd8-164d-420d-aa30-c0eb55e655a8", "value": "24576:96En4pN78ohwrMwjrgjtmgDZLHQyK9iOZjiud:96EnANwtLjr8YgDZLHQuOAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685149061, "uuid": "08e5f525-b6a1-46bf-8ec0-ccbd42351df7", "value": 3747840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685149061, "uuid": "3eef08c0-f7c1-49f3-8bb8-ae50095b5431", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685149061, "uuid": "21692bf1-88f7-47e8-8c53-e21fcb4a4caa", "value": "kkkkklik.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff58162d-fc2d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685151000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685151000, "uuid": "ad849d27-eddf-41d2-82ca-d6a3be3f0eac", "comment": "Malware payload (Mirai)", "value": "1ebcc7fd120d1195c5c87c9714013ba2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685151000, "uuid": "d28f4011-eb1f-43e4-bd7a-c25df0d8b5ff", "comment": "Malware payload (Mirai)", "value": "6c901ba15327da68159712a9726807fb08868309726c55ef202818bfde22a5a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685151000, "uuid": "cd5a0286-3e42-47fc-9c0e-85be88ff6962", "comment": "Malware payload (Mirai)", "value": "3b533047dee5658aa4f5f05cd21a0f0ffd0da46a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685151000, "uuid": "d855f884-5470-470c-a92e-53b342f2bc8a", "comment": "Malware payload (Mirai)", "value": "6d5125f772f57b0111a048473230b5beaa0a5cc5cd8ff1c70deabb8e310b1c2090b45ade2be9951416c61ccc1b85c10e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685151000, "uuid": "ff88a206-a9b6-480f-81cb-d4b6737c06de", "value": "T18CD33A05D8909767C6D227BAF79A428D73236B68A7D733115A28AFF02FC1B9D1D3D020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685151000, "uuid": "6392a467-05e0-4cd6-89bb-9f64b864dc8d", "value": "3072:oVfyQ+d+pceQGfabRVIaZzdhWOiwztem3U45hLtk3t4WtZxDkmydQCYMhEFg:5bRVIaZzdhoo3H5hLtk3bHQmydQCYMhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685151000, "uuid": "11fae2b5-df79-44b8-b588-c172bea89894", "value": 142751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685151000, "uuid": "f8a39a28-a837-4190-981c-901513ad0a48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685151000, "uuid": "d67ab9a6-ee37-4b12-9429-a296bc154d14", "value": "1ebcc7fd120d1195c5c87c9714013ba2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad5d6ec-fc7f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1685186023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685186023, "uuid": "19373d93-bf86-4c32-b6e3-66d35c60b2e0", "comment": "Malware payload (QuasarRAT)", "value": "a31a25dccdf70d95b56b35a5612bf99c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685186023, "uuid": "e0d04070-4edd-4413-b126-6a394a35fa8f", "comment": "Malware payload (QuasarRAT)", "value": "6e06829b7ad790369d1d0873bf494fd64ffa705d185e5a4830e2d4485503e073", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685186023, "uuid": "4536d0b7-dfdc-456e-8e0e-517314fd74a4", "comment": "Malware payload (QuasarRAT)", "value": "0e810653d256c382b804588e29c0fcb84fe481e7", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685186023, "uuid": "7e305a59-3923-4236-840b-2ae6a3520d8b", "comment": "Malware payload (QuasarRAT)", "value": "d7d2733136d008821655dec5de89a6d188d9c16e6f58adfb56e90c24029ce2f8e38afa303b2fa52817221e60d2b311f0", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685186023, "uuid": "560c579b-96c3-4b98-9d5d-b992668a7a86", "value": "T1E17533566B603E8C0D7CD618BC2B1F7F15869FE5D86EA0E291C8A84731DDB01653F83A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685186023, "uuid": "6345e973-54f4-4f91-8fdf-a9847ee841e7", "value": "24576:2XSg2xeZeRalJecyKKAkS7Nr2C5Uz7yYmdAC8cywn+H8b/7KdxinkWrrMB:QSFQlC+92kKMh+yQRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685186023, "uuid": "fff595a7-70d2-4546-814e-ea88610a14a8", "value": 1656298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685186023, "uuid": "e6084c9d-a3a3-44fe-afba-b51576962d59", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685186023, "uuid": "23003667-0f75-40a8-8c4e-268bee2b9057", "value": "allah.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd64a9d2-fc88-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685190027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190027, "uuid": "418bdf13-28cb-4ae8-8014-3aecee48f807", "comment": "Malware payload (RedLineStealer)", "value": "37e4a510d4048801a9314907421d44a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190027, "uuid": "903d968c-f15a-4914-9fe3-3e0d8e777c42", "comment": "Malware payload (RedLineStealer)", "value": "6e331f5bbd491bc4db27b5bac0164d0503e306edcc0827126e1500c4af9b86a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190027, "uuid": "be5f7bdb-c613-4e46-8f1b-a2eff012fb6c", "comment": "Malware payload (RedLineStealer)", "value": "683a04be646c4bd62eca404ae7a9321cdc9da4a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190027, "uuid": "8026bd7a-7435-40f7-b71d-59d9f64ff770", "comment": "Malware payload (RedLineStealer)", "value": "085a8a50a43d50a1343d99214b1eee6352943f918bcf4bc57f0c719374c40e5e1b850a0800a24f296318265596338146", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685190027, "uuid": "b3594952-175b-4429-89b7-d856a2cafe56", "value": "T16BF4121363E94137CDB617B008F103C31A353CA31D78926B2795E9AA4DB27CA6C7976B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685190027, "uuid": "1bbcb9ca-4081-4357-be50-dbaeebd8e7f2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685190027, "uuid": "3cc2dff1-fe4f-47a1-93be-2a2731c4274c", "value": "24576:RyL02wq5v5DYuZFFRBp5m8iZk3xSQjE8:ELFTMiFFRgRkoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685190027, "uuid": "4ba00e2b-4501-49bd-8b8e-817ddd3f6c35", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685190027, "uuid": "81c4497d-86b7-4893-ba94-836a3530f556", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685190027, "uuid": "ea948651-e2da-43d4-b364-220e72ef4647", "value": "37e4a510d4048801a9314907421d44a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd1ea1b-fc7f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685186059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685186059, "uuid": "2f1bf0d1-0583-4e12-932a-cf46b521c17f", "comment": "Malware payload", "value": "7e1348c4cc1ddab3b771afb1dd4c9cc2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685186059, "uuid": "ed04936b-db6d-4a78-8132-0c0804e73f9a", "comment": "Malware payload", "value": "6f308d6ea87ba7a786e0868014d018a928b4cabc4d354d67e8e1d7f3e7eb9cc7", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685186059, "uuid": "88b9d8b8-e924-4ee7-9eb9-736c4c653b23", "comment": "Malware payload", "value": "b395aa85edf28a8852ede1d2a59e964584a4fc7f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685186059, "uuid": "35cff883-1c6b-4bb1-805d-e4cc0412c6cb", "comment": "Malware payload", "value": "70b14ac7a158a463838201b99a02fdb77d39279075310c395686a82b4b3e6325cf024029490d8808e540188aab7d3102", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685186059, "uuid": "f343362b-b875-42d4-91f2-29ad4dd179b3", "value": "T1DE563C60AF88654DB2881D8BF02E695AB5F32B86C9B3B2CCE343780FB95FD1D3515845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685186059, "uuid": "2fdaf07f-bd73-40e9-b2ae-87a0533cd376", "value": "49152:G4duV2eLoRzGGqGLDw3jF/8ahdU79QVCp4:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685186059, "uuid": "10a5c59b-f17e-43e0-96ce-f9ad66de8ddc", "value": 6175325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685186059, "uuid": "ec49239b-e4e8-4094-94e5-05c4d39d6549", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685186059, "uuid": "9f047fea-9b5b-42b3-aa6a-064be12d6139", "value": "test.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaeea54c-fc92-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Glupteba)", "timestamp": 1685194238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194238, "uuid": "b25bcdf8-e698-4cea-88f5-fa6d3e239a76", "comment": "Malware payload (Glupteba)", "value": "3abde333541f73ad0881b155caf5bf88", "object_relation": "md5", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194238, "uuid": "5ffda20b-7352-480d-9850-9ee2bceeca51", "comment": "Malware payload (Glupteba)", "value": "6f5a969958da8b3d605fa02a7d4afc5b29b8dd219c4dbd43a780c589bd1b70ff", "object_relation": "sha256", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194238, "uuid": "560ce372-7db4-40b2-af7e-7979c70c8946", "comment": "Malware payload (Glupteba)", "value": "e40c2d05695597b507111d91e0a35409e2407f44", "object_relation": "sha1", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194238, "uuid": "9f5215e7-d356-4a30-a917-65f4c5db7fd6", "comment": "Malware payload (Glupteba)", "value": "83cd111fb0e7b13742e8773617800b40cefb7f3c943d5c80c4a5ba5306e82666fb0866f6d2d87ae0dbc590eeec27f6d5", "object_relation": "sha3-384", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194238, "uuid": "08db2a7a-8497-4615-b480-89460f91a539", "value": "T1BC16234296E27C91E41B8B329E2EE1EC3B1DF7914D0BB69912094F9F14F01B6C2B3756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194238, "uuid": "c3d39235-be42-4829-ac07-6ad4b3019622", "value": "697c6731df2df92c82c75859d21c5f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194238, "uuid": "1fa83559-4951-49ef-ae15-5fbc9ce5b0fe", "value": "98304:xgqn14Ou6VlR4QmPcjzfu+SfetrC49khkQRiqSCge:xgqnOOodcv21fUQ8qS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685194238, "uuid": "1b0fbf34-5766-41d7-8308-cec7dd301c24", "value": 4386672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685194238, "uuid": "d4e27fbf-2d6c-46f1-99fb-d25591ed29a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194238, "uuid": "5b104572-336d-4a58-9327-4b64d5ea21df", "value": "06212699.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e0359d4-fcc1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685214268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214268, "uuid": "00c608ed-c434-43e5-9254-87ee4ccbc93f", "comment": "Malware payload (Mirai)", "value": "a1f7a638dd2dcf7db26c30211f02d915", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214268, "uuid": "87dc7e6e-a6af-4aab-99ee-99aece224363", "comment": "Malware payload (Mirai)", "value": "71534ac8248a0538ed26b7314950e728b130e1c45979c0dcd2bb772c97988311", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214268, "uuid": "3a98dc1e-20e9-491d-8575-ae43ea93f788", "comment": "Malware payload (Mirai)", "value": "4d978a08dc078e695492f3a756cb14b2b7aa1c8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214268, "uuid": "26c298cf-6cdf-4fdb-b1d6-db6710ddf922", "comment": "Malware payload (Mirai)", "value": "f3cb36985cd7480d9573e268055002069c812c6e408f1d1f54e3e5a1869fc23cba74d90bd1501e04cca33502aa471490", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214268, "uuid": "0eb322b3-9153-485a-8496-d801472a635e", "value": "T1F433F170BB5AA524F33DC63A5B2B65F0CFA0CC7A6A41235EC759247CB93952B4023267", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214268, "uuid": "01f477b6-b01d-4c63-94cb-5889ebbcf948", "value": "1536:sqCdNxkq8Gj9/S/+mZR2AW4XYz24Bvx+/GS+fKKpX8j+5rE9r:pCdDbP9/S/1R2Aoc/GSMtpXO+5rE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685214268, "uuid": "7994c458-0171-4449-9e77-7dfd01a6c8ac", "value": 50948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685214268, "uuid": "4731a4d1-b9ac-47f2-abd6-e10194898f08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214268, "uuid": "15b0a58c-bda0-4f35-aa06-11ce46571e2c", "value": "a1f7a638dd2dcf7db26c30211f02d915", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcfbf98d-fc6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Glupteba)", "timestamp": 1685177947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177947, "uuid": "5304ad2d-d04c-493b-88ba-b84d787eb439", "comment": "Malware payload (Glupteba)", "value": "d4cb19e4a100388d906d6220a736aa8c", "object_relation": "md5", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177947, "uuid": "eed25a22-bf04-41fe-8266-ffb952cf5a23", "comment": "Malware payload (Glupteba)", "value": "7204761c3e58d59a881e09107d1b8bef388e7d2d2eec31394788c7935f782e6d", "object_relation": "sha256", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177947, "uuid": "831d0918-1a87-468c-a676-a6c6a76cf089", "comment": "Malware payload (Glupteba)", "value": "f67f3548b8b223e75c53aa36c827a4684030acfc", "object_relation": "sha1", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177947, "uuid": "55171682-9cd3-4292-984f-2c96dd636973", "comment": "Malware payload (Glupteba)", "value": "811a0ce7b351a696cf11877d265bc17ba4113f9a1e12f5fc63ed2599df434c9d3a273b2ec5a83aa691b14051167762cd", "object_relation": "sha3-384", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177947, "uuid": "cbbc9942-e919-4d9a-9306-4b33dd6c0fac", "value": "T150162313E391BDD4E9924A32AE5E93F8331EF6504E98775A21299EDF44F52B1C2633C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177947, "uuid": "5b8c3684-a089-490f-bccc-75f78c1d101d", "value": "bd191f6a78cc98a8bbe61db18ad8e9a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177947, "uuid": "d61a90ad-58e7-4dbc-8254-37814af909ff", "value": "98304:CHVVp2uqi61tX39zbn2cQKXNes4aMrVfmxWuRZxuBKBOBP:CFYzTXNH2c3eKokxlRfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685177947, "uuid": "cc4ba846-d7b2-426e-8d49-783dfa8e8305", "value": 4387200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685177947, "uuid": "1073f558-7080-485c-b8cb-fc1b582f9ee3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177947, "uuid": "b66b546c-2fae-4ac4-8627-aa4a398a081e", "value": "04915699.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6424c67e-fce2-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685228479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685228479, "uuid": "54fd7d71-42a9-46cf-a03e-fb97e1368ab0", "comment": "Malware payload", "value": "8245d843cd4d3e90e9edec8ebc0278d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685228479, "uuid": "7a10bfd2-7d8d-4fef-bc52-406809a1e11a", "comment": "Malware payload", "value": "73157ee8d240700d07209acb69539e3814313582253246d7550024281b91b07a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685228479, "uuid": "3baf6faf-a426-450a-93f6-aefab7b835f2", "comment": "Malware payload", "value": "4a39a6a852447f4553d0d39934d499bec4c3c18f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685228479, "uuid": "8d612ad2-67bc-4544-a859-4d295df48f6e", "comment": "Malware payload", "value": "12cee493967b30a29a9d257dea2300c44574f9aa80f2501a47716ec7bb5d5afdfd5f19f6fd952830692bb5fffb1b6fbb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685228479, "uuid": "a183d406-694a-41aa-a981-ab8cc7b9457f", "value": "T1EE848E13D6E3BC54ED268B729E2FC5E8761EF6108E5A7769321C8A1F06702B2C163713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685228479, "uuid": "dd1ea042-8c21-4541-9b0a-816795acb2c3", "value": "d302e4ac3406067f8ed838633897aebb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685228479, "uuid": "7ba5cfff-49fb-45d1-b196-9dc0d20e3d71", "value": "6144:ljiz5s5owKn5vRWOr7JR4KdNZ6g5cJqlwEQIcGcZ:l2z51wURWOr7JR4KdNDwxgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685228479, "uuid": "7d891b74-b25f-4811-9354-b287dbdfe7f0", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685228479, "uuid": "9517644b-a84c-49ce-9ed1-0987fb8d57a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685228479, "uuid": "3a24adb3-ece8-4d7e-b822-daacbab07778", "value": "8245d843cd4d3e90e9edec8ebc0278d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc1058d-fc7d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685185226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685185226, "uuid": "91e38f02-d74b-4114-add3-c26109d03415", "comment": "Malware payload (Amadey)", "value": "842f8257f1908f960c40afb036d37fd3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685185226, "uuid": "546dd5ad-99c8-48a6-8786-71afdeee8b74", "comment": "Malware payload (Amadey)", "value": "73b08fbb561c4bcd4c5a615b624f79bb3f8478f4c6efd48b2049ddcb1eba2c7f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685185226, "uuid": "ffee51f6-6020-4046-8c0c-ad87ce24d077", "comment": "Malware payload (Amadey)", "value": "4efacc00e5658e4a6ccb5770df8f6ee8abfc957a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685185226, "uuid": "29ab2c8c-2e3f-4e7d-bf8f-43da2a1baeb5", "comment": "Malware payload (Amadey)", "value": "e99443994c4e019c0ae6791718081027066eb631e465dc71439333e7f1fff05f98375e0d7c0abf01439264fdc2845317", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685185226, "uuid": "ecc46371-34ad-45a7-8a2a-6b56ad920eb2", "value": "T185352303B6E555B2EA3127B42CF513C3263A7C606A7C831A3792D9D64CB3295AD3437B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685185226, "uuid": "7f63c0ee-636a-451c-b8ae-2ce0f6eeb8bd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685185226, "uuid": "2a9e2c8a-ffd0-45ca-945f-f71ab8908882", "value": "24576:fyHA5aVbz3byOVuzBEzk3gSKcPxeM9QrY5dKUxm6k:qg5Mbz3OOMtEuXfp1OrYb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685185226, "uuid": "0184bf77-1fc2-493e-b495-8e3c59e5bf69", "value": 1068544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685185226, "uuid": "04fb4804-a41a-42c2-a6ee-20677fef3d95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685185226, "uuid": "268041ae-a485-46e4-a1e8-2d5e1d8f9371", "value": "842f8257f1908f960c40afb036d37fd3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f0586a-fca9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685204136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685204136, "uuid": "55061679-2a48-40ff-8dd3-fc77eaf3f547", "comment": "Malware payload (RedLineStealer)", "value": "e09666b8cffea068fdc6bf0a2ff27479", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685204136, "uuid": "5dab4789-fdbb-43d9-ab9f-98ca26506d7f", "comment": "Malware payload (RedLineStealer)", "value": "7423e33a3338fd207ca1d781a205a1794cff27a26b289eda3c6eae18f10da754", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685204136, "uuid": "c2e0f0de-2383-413f-964f-7aa2ac557e0b", "comment": "Malware payload (RedLineStealer)", "value": "99020a84fdb6e19988bf7b9216c5dbaece0efc27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685204136, "uuid": "2929b573-f91e-4571-9d52-76400cee25f7", "comment": "Malware payload (RedLineStealer)", "value": "84b819e5143235c54c48cc8014754712068f72df5ea7746469f9e7fd5ad02e6b45533560eb5f9aed067f255b91f8105b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685204136, "uuid": "702997ab-8d4d-4bf5-9750-0224cfe70dd7", "value": "T141F42203A7E98576D9B61B3069F703E30B397C62CC3497672A48594B1CB3385A4763BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685204136, "uuid": "5104e2d8-076e-478b-98fa-2114bc4120d3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685204136, "uuid": "545bdc61-8f51-4d70-8ef1-031b08b3334d", "value": "12288:TMrwy90HmUr7zMg/CTO7q/Ixck3BuCG8hiEnG4b0l87LYNS3PZ1UaV:3yh2HMgejV+i1En3zUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685204136, "uuid": "092fb2eb-5f5d-4040-bf97-19943776b960", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685204136, "uuid": "5cb8f606-262d-4012-b754-f19790d0088c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685204136, "uuid": "7e36e880-2679-4964-b205-c0d93d49032a", "value": "e09666b8cffea068fdc6bf0a2ff27479.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca436edb-fcca-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685218342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685218342, "uuid": "e5f6c180-9968-441f-b782-f3f85220d2ad", "comment": "Malware payload", "value": "712d60a6cbd131efccd436e2d8409113", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685218342, "uuid": "a673575d-b6ad-4461-a298-d64107c4fd88", "comment": "Malware payload", "value": "747ecb7296b0de86e990ff1e83fecc85079e078cf214c778bd2a30be60edfd8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685218342, "uuid": "5f916ebb-8005-4059-83a7-5433e275f7e3", "comment": "Malware payload", "value": "0e638a1d77cc077450e3992742aea6f78eaa91ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685218342, "uuid": "35fbbcb1-2a32-4ba5-9cf7-ab597e8c31b6", "comment": "Malware payload", "value": "03fb2f3bbd7bb287efc7fe4e4ec777dc05881368756e48ca37de65a3045db677cae567190208b2041eee01a29b287aff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685218342, "uuid": "c5709ed0-9436-403f-909d-87b1749b026b", "value": "T14F956A13BC9084F2D922633EC5F586643EA9E1320F6565DBE79D0B2ECAE02C157F4267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685218342, "uuid": "d59992d1-e998-488b-88ad-136d63cb23f2", "value": "65d9c1a9ed29f52599b050c6a36bebe6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685218342, "uuid": "545e59d5-97d2-47e8-a6ad-6246a2b1ce1f", "value": "6144:OIkF26C0RGzxjW6IahAOOb2hOPhE2ebC37Ga6A:qF26CKQQyMPCC37GjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685218342, "uuid": "839764a3-d9d4-4c2c-8889-8e4fda4cfe51", "value": 1969152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685218342, "uuid": "6246a861-60b9-4668-b336-17c8f937cb63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685218342, "uuid": "4f38240d-512d-4326-8a20-04ca137be071", "value": "Discord Tools.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f2d96f2-fcc3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685215236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685215236, "uuid": "b4a9100f-20b5-4da6-8198-cf3a020db078", "comment": "Malware payload (RedLineStealer)", "value": "23d6769a2934666f71f41a1344ec9e14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685215236, "uuid": "4d7a5c96-46ff-47f2-b85e-60c633ed8eda", "comment": "Malware payload (RedLineStealer)", "value": "7485afa90dd070adeca1f8adcb7b54f2447ff9d9652a599854a036dad28efc5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685215236, "uuid": "f6d2e003-b226-4c1e-af65-9e4827361b4b", "comment": "Malware payload (RedLineStealer)", "value": "9597d5ef1d7c62f8ae696bf523551d3f0d83e6b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685215236, "uuid": "e9f8788f-be4e-4e95-8a33-0b8bbdf4a73b", "comment": "Malware payload (RedLineStealer)", "value": "ce6a9dc472288bb8ebf877aa395da57b4ca31a1c6bef3858107fa1ed9dcba5c091a679c90bc12c575e7c3bdfb5f60a68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685215236, "uuid": "e4e6a3d2-96db-473c-83b8-238b7ca20de3", "value": "T1EAF422427EEC9172E9BA13702EF613931EB63C938D38419B3785AE1A4DB3590943537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685215236, "uuid": "012768c2-8160-4278-8377-0ac264ca0d01", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685215236, "uuid": "9c356721-fa01-4bc4-8aea-11f4a8eb20c4", "value": "12288:aMrzy90H23FDZVHU4qHDY1+hiayhuCqRNfVNRJCzKB3at18rXD34TNT2/D:ByBj0tY1+ELhuCqRNfrRJlAt1UXD3Msb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685215236, "uuid": "574223f8-fb74-4b11-9bf2-633263c73fb7", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685215236, "uuid": "5baf7f14-6c9d-4692-af26-b7cf0fd0b121", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685215236, "uuid": "7b41ad1f-baa8-4acb-93f1-c94abba8bd04", "value": "23d6769a2934666f71f41a1344ec9e14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0246aa40-fc22-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685145851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145851, "uuid": "b870f61e-4a80-4f8e-b60d-10e73a73322d", "comment": "Malware payload (Mirai)", "value": "3c7d50169783e17c6951388c409f0ee2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145851, "uuid": "811dff59-1c98-4d7c-b244-bb1c2cbf3328", "comment": "Malware payload (Mirai)", "value": "75721a0649b32415d322e7f1d277fe01e385df3e3df9e02d7cb2cd9a345f87f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145851, "uuid": "3a7f7e6f-e8c7-465c-96df-42a43cb3b6f2", "comment": "Malware payload (Mirai)", "value": "e6dc805256c277af9b1c2f096ee0ba977c60ed1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685145851, "uuid": "876748b5-b02d-4a53-b76a-cda71713e0c2", "comment": "Malware payload (Mirai)", "value": "bdc07ec18ef5a5d765f784aee247466f3de01c74c1d435fbb5af151daf971fc584ed5b21d23b429865f287914ad59376", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685145851, "uuid": "afbe5fc2-ddd1-43d2-90d6-dfbe58ba7cb9", "value": "T1CA33F782ACC1AA2BC6E0137AB56E808E332077E4D1CFB75BCC155B00779955F0DA7B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685145851, "uuid": "3c5bb0cb-c88c-43bd-b43a-cb2bb9bbcc9d", "value": "1536:HWFS3XVNk50kF4xLDKe2kksKbz1j/6X5/qo3bHS/Q:HWFSVNk5u37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685145851, "uuid": "a342b6ab-e138-4d61-b454-87e2e4237bdb", "value": 51292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685145851, "uuid": "2f304de1-0def-44bb-9e51-4a982d9181df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685145851, "uuid": "9d636fbb-a636-4be9-a30b-8ad951231c72", "value": "3c7d50169783e17c6951388c409f0ee2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94cac91f-fc67-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1685175732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685175732, "uuid": "454f909a-4c48-4711-b5ff-48480ab85922", "comment": "Malware payload (Rhadamanthys)", "value": "8304fbd7fac97b91561c0d97b4ac115c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685175732, "uuid": "ee18f4a0-43a3-4e51-8b8b-5c9f443ef435", "comment": "Malware payload (Rhadamanthys)", "value": "75c9bc2333b79f852b933e147ffc12d95a30c85360d8d0a427bab27dc564a5de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685175732, "uuid": "7a0039cd-b9e5-4403-b857-ef474fd437ee", "comment": "Malware payload (Rhadamanthys)", "value": "a7bc0fac50a5ef3f593a2cfc3b20ccb107a192ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685175732, "uuid": "a00a3dc1-041e-4df5-9fdc-f175aec4731c", "comment": "Malware payload (Rhadamanthys)", "value": "a6dc0f9e0c135f5e531499c6ac76ec65231902d1e935ca71afcfd3ac87853b42b4a37102c6c46da202aed8fbfcfc8b01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685175732, "uuid": "cc0f527e-8701-4113-aecd-7571b425db3a", "value": "T1DBF412203248C176F9AB247549E8EB3669D978701B6F80D7E3D8072E6F617F15B3260B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685175732, "uuid": "8fecee91-a5be-4daf-9a04-3022e1653ae6", "value": "c37e990f82ef6d6640b85272b766d7be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685175732, "uuid": "d5646d10-1cd0-4353-afe1-b86d12a5f18d", "value": "12288:7uP+oC4rGgQKJxexA3nsjnq7s3TWpEFXligK+AJwr5AeZKQiUYsEbVkT8TVK+6MK:7uP+KrGvCexCsG7s3ypyXGJQ5AeZAbVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685175732, "uuid": "9d5e4493-26a1-45b7-a573-f3cc954298bc", "value": 777284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685175732, "uuid": "bd334d91-7a9e-4763-ad38-110c67140bb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685175732, "uuid": "4ac7340a-ef1f-4cab-bcfd-57e03026609f", "value": "8304fbd7fac97b91561c0d97b4ac115c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff98b5d4-fc62-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1685173764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173764, "uuid": "36293186-3fb9-4f31-b1ed-557f0eb63ed6", "comment": "Malware payload (RecordBreaker)", "value": "820241820224a5c7eed0ca74b7420361", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173764, "uuid": "7d786f45-4bcd-4bdf-aba8-2e43c7860746", "comment": "Malware payload (RecordBreaker)", "value": "7740df954417683f1614403a7fa6607e7b9002ae045e25a07c8fd4e67f0b3c3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173764, "uuid": "a57d2d15-b42e-4e21-9a51-4b367e6e3b20", "comment": "Malware payload (RecordBreaker)", "value": "4ad3588ecd226fde7fe8543c281290997a4ad9ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173764, "uuid": "cd66aadb-03d0-440a-bf02-9a24020a823e", "comment": "Malware payload (RecordBreaker)", "value": "e0f6bf166278874f64198353260739c42da3e47fa04b3f1fdd2b989df6064e82c07a2f34d236e93d23ad553625baa07e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173764, "uuid": "b726a8b2-1f0e-4c49-b40e-ea7e3fdcc187", "value": "T19156DE3EAED11137D4B3CA7ACAF65AD7F962311335516C2E95CB13810813BA7BE9201E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173764, "uuid": "18ef480b-c7c2-48c3-9dce-2f3b38f1eb30", "value": "9f8af27f520ea359d999bd8cba16dec6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173764, "uuid": "18d331b8-59e0-4984-b11e-2ae3d49351bf", "value": "98304:x4S0clXTS9EIv1281Ey0l6iEz0JzA3+rBAlrHC3dNtCLChB:v/lX3I9R1EFlnxJzVA1ALI+hB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685173764, "uuid": "e4411a8f-a369-4e24-b3a4-5f3c5ea4a433", "value": 6258688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685173764, "uuid": "6bd47a22-d7c9-4f64-9e3c-4bd5ac916ab1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173764, "uuid": "d7c7a2f9-67b2-4a71-b4c2-871bd419a715", "value": "a02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0dd27ff-fc68-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1685176289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176289, "uuid": "5e3e213d-af7f-4d85-931a-266ac918c382", "comment": "Malware payload (Fabookie)", "value": "3fbd744372d53f4fe9f34e8173c6c21d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176289, "uuid": "e9e409d5-3002-44d3-8729-f9f7a28965cd", "comment": "Malware payload (Fabookie)", "value": "77bce6278ca4ff5863280c4cecc53cfdd3097ae67f617d1e62c66bab8d313ed3", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176289, "uuid": "1ae7ba09-47f2-4094-9f11-c9770ba93f12", "comment": "Malware payload (Fabookie)", "value": "c3dafc1edb048a9b1901c28a38521d0c3a1019a9", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176289, "uuid": "0d704a1e-0d9e-4018-afe6-9e55cc60856d", "comment": "Malware payload (Fabookie)", "value": "1c2ac4332116feda8fb1641ed2739415e8552c13a9e8a3143867e44e2b2b907005acc27d4fa43f1c17c542e6813c3ad1", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176289, "uuid": "1a1708ce-6900-4945-8fe6-093aea1f14b8", "value": "T120E4F600E5410452CC9F5F7A8A639A35A7733D62BF07979B3208B6763A336D16B71B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176289, "uuid": "4b5d0934-8e30-442a-8d5c-72e7d4597dd9", "value": "415314d0031f15135fbc02f2ca18bb2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176289, "uuid": "def83315-8e86-4930-9a89-03c30379d833", "value": "6144:KvY7uKa7GjX7jpbERxpp521t+6eslnCUGwfxIRLtxIRLuovZ3H3AdKy9HGeofJgG:3/04rlwppx6eDaooojmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685176289, "uuid": "24411343-2dcb-41be-b183-cded3b04d748", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685176289, "uuid": "2454a541-f3f5-4bdf-b32a-4f90afbb6fb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176289, "uuid": "bba37848-876e-4d8b-9ec2-be8cdae34f76", "value": "3fbd744372d53f4fe9f34e8173c6c21d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd6cff29-fc7e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685185706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685185706, "uuid": "bdfc75c9-6145-4f31-bd23-fca2b075a89b", "comment": "Malware payload", "value": "20004dea61cdb68d6b89a9d0690434cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685185706, "uuid": "5eb85b3b-3514-4cee-929c-a327d50ae9c1", "comment": "Malware payload", "value": "78c6ae28110bc8236e3ffcba0cd76e889a91f8ca76ff2699691dba040c92f313", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685185706, "uuid": "3fb641a9-5bbd-475c-a2be-df607de089cd", "comment": "Malware payload", "value": "290c22d532966f5cd2609bbe2bda81b47def097e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685185706, "uuid": "2ddf13bd-89c8-47cb-a798-0ba34a73f2cc", "comment": "Malware payload", "value": "4547c9c4a19b7329c3753b1500fa72b65590618436fa93e2312f6a9fa8263b6d44c84f791b8027fbc35d782979504ec9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685185706, "uuid": "39ad3754-0bd1-424f-8234-4166d0fe818a", "value": "T1783623C1EDC111E4D48B7634192BEEEE76B92DB617E0C99BA6E62F825C335D01B31903", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685185706, "uuid": "289f68cf-fc22-4003-a34a-c88e7b5a2a43", "value": "33e8898cacf7acb8355d4b9d962a8738", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685185706, "uuid": "3c577c2a-295a-4139-983d-e6ec9787ddbd", "value": "98304:SJ40m7FgKc3JDoHbkLMwmyw7D25WU4YN1LH1q4FBQbQIWf158QfG9qgOVnl9o:SJ7mKKmDoydwvYx1LHMuQbQIWIxQgOX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685185706, "uuid": "c1b85ec4-93c0-42a0-b71c-3c24c6b05898", "value": 5189632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685185706, "uuid": "4077abad-5b59-4fd3-816f-2ce764837a77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685185706, "uuid": "a394bdf8-17c5-47e1-9dc1-0001ca9dd8fe", "value": "20004dea61cdb68d6b89a9d0690434cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35e6b85-fc76-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685182226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685182226, "uuid": "a037f98e-bbb9-457f-b7af-33eb3d3c3e1b", "comment": "Malware payload (RedLineStealer)", "value": "7d05a570a4d3ebf2a95b1cee5f2f9fb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685182226, "uuid": "d60a8103-8841-48e7-94ff-2b04b9240612", "comment": "Malware payload (RedLineStealer)", "value": "794d42db9cc36193303038a836afd3d15116e6ed5956c7472a232e7e44f878c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685182226, "uuid": "9b8060a6-9b4c-4187-963f-5628411a4633", "comment": "Malware payload (RedLineStealer)", "value": "2ed679127149b63fa7be7f9dca00fcd5702ae60c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685182226, "uuid": "bd09b577-37bd-4ff4-9bac-655779cac1c9", "comment": "Malware payload (RedLineStealer)", "value": "614d32f99f63d69e2871d1c67b8ac63586dfd226f08bd8708e2028de56380f025cb702d8e3272dd98d857c815f8ef968", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685182226, "uuid": "6181d3e0-dfde-4088-a2be-af2ce8bae638", "value": "T1BDF42313AAE8C523E9B1177058F243D70B367DA14855D32F2790A95E2DB2BC5B87233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685182226, "uuid": "d067e817-9561-49fa-9989-0c84b52b3c36", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685182226, "uuid": "28efe377-cfc8-482b-bbc7-fe950309e908", "value": "12288:bMrCy90rqM9iMobx15ckMGwmQ+/8dc+d26L4IkqO+5ZSGQ7XK8f9Z3+dJLk3NTkE:Byr5wmQI8TwBIkqSGeXK8i/k3OSdka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685182226, "uuid": "14df4522-fa4f-4b07-be0d-cf244082968a", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685182226, "uuid": "540e0062-41d4-4237-b023-a9b0b2e39652", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685182226, "uuid": "7a6dc94a-5c22-4539-9d75-4f3d4f51567b", "value": "7d05a570a4d3ebf2a95b1cee5f2f9fb4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e958c50b-fca6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685202932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685202932, "uuid": "700cc30d-78cd-4020-8535-8e0575c84180", "comment": "Malware payload (Amadey)", "value": "ca0e3ac8fc0b7842cd3af01d50908c01", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685202932, "uuid": "80ee13dd-ce63-474f-a660-693b83b3e832", "comment": "Malware payload (Amadey)", "value": "79957de6b1fba01b1cb4b6ff6b848474cc8f06a1042f2ea59e0c87e9dcfb64e2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685202932, "uuid": "97207d7f-0f4a-499f-8099-c62a465b7cb0", "comment": "Malware payload (Amadey)", "value": "b10c7ff6b67023532c4727636a1cd6ea26592807", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685202932, "uuid": "4aa2b6f2-bbd8-45b5-a593-42d3dc6f9208", "comment": "Malware payload (Amadey)", "value": "50b9f11366c28d635ebc89cf3283c55c4f6a402c54ad8bebcf860934b1a75feb41c0ea30a780e81adf338e9b98b4b169", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685202932, "uuid": "7225a2b5-940f-4201-8cb4-95be6f8fc337", "value": "T190F41253EBDD4972E9B6137069F707C30A3D7C718EB886AA3341A9550CB22D4B53272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685202932, "uuid": "ede77574-f1ad-4f90-a28f-9444b022257d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685202932, "uuid": "4f8c1702-39ca-46f3-bcb3-4a7fcb7482a7", "value": "12288:yMr5y90q3FyPtnbj10023HRZ9VC8ScJ/YGU8pJPVwAzqm4ccxT8Gmbw6Mg6ZJ:byzyPtuDVVSwwNcN9zqmeYvbwc6ZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685202932, "uuid": "447525ff-1e64-48fa-9783-9f4d1dbd20df", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685202932, "uuid": "8431d90b-1afa-47ce-a03f-0e83b0868424", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685202932, "uuid": "6d55a5b3-74e8-46c6-8a43-588edb1d11f6", "value": "ca0e3ac8fc0b7842cd3af01d50908c01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf47f65-fc8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685190993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190993, "uuid": "36f19b27-60b1-4d23-9b1b-5542f9a5c7ee", "comment": "Malware payload", "value": "0db5f10e97308f505a215ed12bbfd7d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190993, "uuid": "e78df1c8-be5e-4c33-a9a4-910e5835ed5c", "comment": "Malware payload", "value": "799faf05d2d2578b126496e5b3b7ab8fdb048703b41bdf4b808b3f0701e08eeb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190993, "uuid": "8871de5b-86b8-4fd8-bad8-1e5afc425718", "comment": "Malware payload", "value": "68ceaaf8672418aaa6639225a0084621976cd43b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190993, "uuid": "7a57b824-a688-49a2-ac2b-0213524890d0", "comment": "Malware payload", "value": "39d5c133517ee5bf490835f082029a2dcdd43441185b87597277ce538cacc43a17281637ac26b8bd08f0f784a828aeb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685190993, "uuid": "fac57492-1940-4403-84f8-949fd077a57d", "value": "T1C1F21839BA712A0BC8D498BE71F74328B2B55A0F54F9C61A3C771E8EFF6098054175B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685190993, "uuid": "8564e50a-d21b-4186-9032-e528c9a361b2", "value": "384:yY2ju+BPH7KJ7gBTRbcXKaLy8j8WJoyudwIwIZZd7JFU+LFxW585u94F:LQJT1cXKay8j8WJRghwIZVO+K5Ha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685190993, "uuid": "da6e3e06-01a6-4660-9e77-2327c5e9a198", "value": 34676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685190993, "uuid": "6398bd39-4222-47fa-bf60-0153b47d4788", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685190993, "uuid": "0d8c79df-82b3-4c5d-99b6-f6edd233e2fe", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f0717e8-fc36-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685154650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154650, "uuid": "6d975f4c-e958-4400-bc7c-98dcf1d2cd61", "comment": "Malware payload", "value": "360755c975be99ff8d74d09c67dae4c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154650, "uuid": "33f92fa2-330f-4e0e-a07e-8f41d5518d48", "comment": "Malware payload", "value": "7a007f13e59f015da82f04e7240cea6f4218dee1c40ba3b41c906f7bcf388e7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154650, "uuid": "b65fa1d1-3411-407d-b94f-8c87fc936fcf", "comment": "Malware payload", "value": "3c553334b75a2eadeb9451cc8c592e51b35bbe9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154650, "uuid": "312d16bd-a609-45b2-88c3-b20272674288", "comment": "Malware payload", "value": "af7ed73fe38337789b759bb03dcaa692e6c985cc8db6fa77ff1ae4e2f3d7a4203c9b1721aaa5964e1cbcf3314b6d4826", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154650, "uuid": "16dcfb68-8a06-4787-846d-f2ef9a7649f0", "value": "T1B7829D99B320C9CAC18409365D23DAFCB6713D3A9C254E477EC4670F3E32715EC06A6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154650, "uuid": "e8e06b2d-5e47-4f5b-af63-a7e94497d0b0", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154650, "uuid": "f0f09e41-079e-45ed-b727-659392a2c505", "value": "384:wXLDTs8hsF6qtK8lzQ8+Sych3mYvCPHxu:wLXVhaTtDE8VfCPHxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685154650, "uuid": "8d8432a2-5671-406d-8859-ed24573448b1", "value": 17786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685154650, "uuid": "fe35ca37-633d-4407-a1d3-a6e566ab6284", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154650, "uuid": "bae58c0d-891f-49b6-9285-be8841665938", "value": "SecuriteInfo.com.HEUR.30538.9298", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892c99e2-fc35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685154238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154238, "uuid": "81a6ccbd-60fb-48ee-986a-b59c3866300d", "comment": "Malware payload (RedLineStealer)", "value": "fc598c90037c0e64a829c96237646894", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154238, "uuid": "ff88dc3e-84d9-4b16-9b31-b13d0bbd0701", "comment": "Malware payload (RedLineStealer)", "value": "7a0a5df9b468d5f49ff9aa38908ce60a5846f9ac4c6b28f23c6d47aa537d6c95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154238, "uuid": "465770a8-6511-4642-b61c-6c5977e876d5", "comment": "Malware payload (RedLineStealer)", "value": "28cbc38dcdec066e8de1581433d5d40f138f9d16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154238, "uuid": "7116d13f-5bb2-4bbb-837b-c014779eff9d", "comment": "Malware payload (RedLineStealer)", "value": "886ce583093ad30a2f71f4ced160f238568fc4643be1e397b957e20a18bce8b0b2cfc1addb4df72d0d5a61c89a551158", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154238, "uuid": "a5555e7a-bed8-4bac-a492-b7d7bde3f4e9", "value": "T145F42341EBE88573ECB10BB15DF247D32B3A7D224D3496AB2B24999D1CB3581EC31366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154238, "uuid": "e0fc3128-1433-46bc-97dc-8cfd055f7445", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154238, "uuid": "e80a5c4c-4f56-4cfa-ab11-fca1da661f9d", "value": "24576:byaeek3TbiUN+vf/LJC59uAWqY8PNk3lSsC:OliUNElC7ufUA8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685154238, "uuid": "6b3ea07c-fd9d-40eb-bbee-02fcff26cd45", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685154238, "uuid": "b3e3371e-b4b0-43c0-8669-314ddd867fb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154238, "uuid": "795f2f68-b89f-4c33-b506-882ac8d1e0f9", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b48dd74-fc35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685154188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154188, "uuid": "245d4155-7068-41e3-9101-83b23d7cc328", "comment": "Malware payload (RedLineStealer)", "value": "2406659d2927db46b52ba05515f4d8c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154188, "uuid": "62abbb1c-01a2-41d3-a0dd-1e508af06a8d", "comment": "Malware payload (RedLineStealer)", "value": "7a75a26cc0c53a8c1f54cf5c14ef03140e0ff78433c2381b68e2ee58685920aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154188, "uuid": "9379153c-02f9-447b-a2a4-ce0a2e1a2194", "comment": "Malware payload (RedLineStealer)", "value": "3dafe4322deeff7e6cf83921322643e8f2f6f84b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154188, "uuid": "782cf7a5-cec0-4ee0-bb09-4630342d6fc1", "comment": "Malware payload (RedLineStealer)", "value": "57d6439c66225f3015fdccf6ffabd6450c061fd63b9b370309809295e71acbbc4dd6c62346cd00a86f8bfe39266813aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154188, "uuid": "8187058e-812b-4fbb-8b0a-1bef75ba42b1", "value": "T1A5F41207F7D88572D8B25B702CF213A71B3B7C96CC74D76B6652589A0CB2284A978337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154188, "uuid": "9d26c4bf-18c6-4939-9699-ed1f8fd74da5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154188, "uuid": "5afdbc1e-77ba-477c-bbc8-9ddfb35a6168", "value": "12288:PMrPy90pKY7ejrhN6egUvxlviD6ETf2dzFj9tVQY8l9n3+j0Lk3NTISU7S:IyIShQePqD6ESdzFj9tSY8Gak3CSUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685154188, "uuid": "d41c9b3e-2e10-46fd-a568-ef0cb16e719a", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685154188, "uuid": "64a47935-5668-47ed-9475-4c439049ecb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154188, "uuid": "20f3ced3-f338-4a23-8cc5-72d94dd9497c", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc40ed4-fc73-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1685180656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685180656, "uuid": "ccf0884e-e212-419d-8290-d2dd3f118bf0", "comment": "Malware payload (GCleaner)", "value": "37919df3513244e674889a3155247a95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685180656, "uuid": "029fc358-31bf-4b0c-ad6b-d54e3d88435f", "comment": "Malware payload (GCleaner)", "value": "7b124db887c3785837d35639006089c7e9c9a5788bf664ca1a9b4cfda41cbded", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685180656, "uuid": "90c7a249-3076-4e5a-bbf8-726a79a32481", "comment": "Malware payload (GCleaner)", "value": "24d0ab9dbfb7c806be4656ea5f232562783d0703", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685180656, "uuid": "c3408209-3ae1-4edb-ae0b-e65e290291e1", "comment": "Malware payload (GCleaner)", "value": "4d456374387ec9d08954911bd856f918e13905b4668131b4a1023d59cab2709b7a84f7e5ed0b8bb34d59184d4ed0735c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685180656, "uuid": "6ebf8e17-057e-4397-9dff-065352bb7ee8", "value": "T1E6A53331EACFC4B9D152BBB24C81415C8CB672354D11A98639A53DEDF83A8F5F42AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685180656, "uuid": "8660cbc4-daa9-47c6-9f89-204c856be046", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685180656, "uuid": "f6f2d48a-3b3e-49fe-83b2-241918baed5f", "value": "49152:Ci8BnEse+ZOg4Y2sA3vdt+7b92q8vofZC+yz4s8wum:Ci+ZZOrYVsvdt+78qlRyPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685180656, "uuid": "c179fff9-00ef-4d88-abf8-b0085a7df4b0", "value": 2192933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685180656, "uuid": "9e1d16e9-c368-4046-897e-cba0ef815f94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685180656, "uuid": "ea8bac42-06f6-4b7a-b7df-b1e4b3d1bc7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74cd513-fc35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685154315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154315, "uuid": "2caa65d7-9465-4632-b9c8-e3215d485c2e", "comment": "Malware payload (RedLineStealer)", "value": "d55e70af4fd2fc5f891229884ccf771f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154315, "uuid": "482838bc-9293-466a-a07b-9c2a419ea1ee", "comment": "Malware payload (RedLineStealer)", "value": "7b74061571313b2622d4cce47f122c12d94081bfdc1f4b60a95b3fd1415555dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154315, "uuid": "f8b7f3c5-9580-4395-9c7f-54d34b9e6ac9", "comment": "Malware payload (RedLineStealer)", "value": "03351a22e95f7423691071987af390690285b8a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154315, "uuid": "73f97fe9-5a91-40f0-882c-06f40ad1a3c0", "comment": "Malware payload (RedLineStealer)", "value": "5bd38a69ebf703d3e599565248b9ee505d53f6c7ee40f40b10124ca56151c30e68f5e552c3b3a70b08d42141375f0544", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154315, "uuid": "1a8ced3c-1b3f-4a08-9e46-230f8b36f252", "value": "T152F42257B6E45436E8B227B419F706C30B36BDF34D3597276384989A2CB368895B033B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154315, "uuid": "6f05da05-238d-4a8f-9938-288ab145fb8b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154315, "uuid": "6179549b-7b3a-4269-9f99-50783b578dee", "value": "12288:kMrfy909PlUbwU/V8QoxL4ffhJKrKlxLHa4Xy4cFOAVm8T9F3++ULk3NT6Ssi2:TyQPSDNnDqYxGl4om8+/k3oS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685154315, "uuid": "af57cac7-5ac4-4bd6-b636-e2ebec87249a", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685154315, "uuid": "4871e6d7-e3ce-4ef9-8e4b-d7fa99e276e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154315, "uuid": "2852d964-0eda-4e05-adee-61e4c1704e88", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22022a5f-fc63-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685173822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173822, "uuid": "19063691-6819-4e90-81c3-c7de54920d67", "comment": "Malware payload (RedLineStealer)", "value": "6709f7f0fbc3ef4374d534189995b318", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173822, "uuid": "afd83f37-d5bc-46c3-8742-680c08b24fe8", "comment": "Malware payload (RedLineStealer)", "value": "7ba619b5a51b8a41dc204705f2ba4c61fe4a39a940220482ca48f0bac4dd4603", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173822, "uuid": "0fbb58d6-c0ce-4312-9d17-4e93035d2a8c", "comment": "Malware payload (RedLineStealer)", "value": "050788934dd377978af125b25e38a71214250185", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173822, "uuid": "0eb0400c-f391-4a00-9a3f-cad92376e285", "comment": "Malware payload (RedLineStealer)", "value": "9e4d967a3850d8873bf38673bc971e2fc7efd61fc78be64a2a8281f3e7a47b95c39f69b029898a8df6d9bf9413a23b76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173822, "uuid": "d86e7a83-46c3-46e7-a722-09041088d6e9", "value": "T176F423537BD80471F8B52BB018FB16430A36BCD7ADA4A37A7645A48A1CB2781E4F5336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173822, "uuid": "bdbdf3b0-2693-4a63-a09b-549f194794dd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173822, "uuid": "490fe19d-eb7b-4055-ac20-6e3783e06198", "value": "24576:jyhgxaKuEtskTD2v5B1hY1Kkzjm8I3k3KSp:2hgxaK9tnTCB61yP6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685173822, "uuid": "d80a11cc-0a79-4576-ab61-cb955388b451", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685173822, "uuid": "07a1746c-bdee-442b-adae-cdab63a68e53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173822, "uuid": "f9b6a283-e625-4475-9741-1c664de5a935", "value": "6709f7f0fbc3ef4374d534189995b318.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "507c1265-fcc1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685214272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214272, "uuid": "886d11b6-c7c5-4242-a566-e692eee39749", "comment": "Malware payload (Mirai)", "value": "01a822be1cf81e7909261a9135ade309", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214272, "uuid": "47dc8470-dd04-4168-858b-e2ee07e5aa45", "comment": "Malware payload (Mirai)", "value": "7d03288f96b552d4c85e2f72a45191be495e2ee27243aa21fe7abf520a6d0ac7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214272, "uuid": "dbfa3fce-0185-46db-9394-3b032abc50d9", "comment": "Malware payload (Mirai)", "value": "dd35599bda531301c9dc3d05808781410485a34b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214272, "uuid": "d0b718d0-48a9-4db7-a4a4-ad55b28b54d4", "comment": "Malware payload (Mirai)", "value": "495ed1fd36062fda7d6b24723a04486241bba0b2defcb6e35b5b8633e54a027e652747bb17ec023726ce7a012acb973f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214272, "uuid": "6c375016-1f67-40fe-a6bb-8b8885fc39ba", "value": "T179C32942F8815A12C1D613BBFA6E028D332963E8D3DE7217CE255F2137C651B0D7BA96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214272, "uuid": "efd594b6-f5fb-4a85-b6e6-3bd6536017a3", "value": "3072:QeePRPRzWYm1lt7lovZWP/F1X5D7Fb4iTiciR:YRzW9ov8nX5Vb4pcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685214272, "uuid": "0e81a142-38e8-4869-9fe0-289dec5d23bd", "value": 123420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685214272, "uuid": "64dcb85d-3a1e-41e5-84de-136bbeb29a7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214272, "uuid": "a9ac4be8-6582-4ec2-8990-2b1f0f43ca50", "value": "01a822be1cf81e7909261a9135ade309", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c6de39-fc69-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685176492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176492, "uuid": "cc57ab69-edfe-422a-af48-152a4f48d63c", "comment": "Malware payload", "value": "9fd51ba7e1b8b8c4586354338df32acc", "object_relation": "md5", "Tag": [ { "name": "94-158-244-118", "colour": "#18F1FD", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176492, "uuid": "ec038917-3364-4e16-add4-0a260d2cd999", "comment": "Malware payload", "value": "7d1302fc5aeb3aa1233d44cea8263ee577041c92d7aab5cad69dce94574ef49a", "object_relation": "sha256", "Tag": [ { "name": "94-158-244-118", "colour": "#18F1FD", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176492, "uuid": "5efc8cf9-2933-4fd1-b4c4-f4a7f18652c5", "comment": "Malware payload", "value": "30f194d6f87be214031410adeaf5f9df4f7945e2", "object_relation": "sha1", "Tag": [ { "name": "94-158-244-118", "colour": "#18F1FD", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176492, "uuid": "573dbacd-6a9f-4857-8884-9bfe4a007a1f", "comment": "Malware payload", "value": "a2cc45a4e5b5ecd3d2d38c202b60174ff673228025a874441bdab5b9b3053e34611f5e26daad24fa6b607bcf652fe068", "object_relation": "sha3-384", "Tag": [ { "name": "94-158-244-118", "colour": "#18F1FD", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176492, "uuid": "52ae1392-48ae-4f51-82a4-d558ef2202b1", "value": "T15EF0AC00070FBE5D1A9BE2C9A338C1904FD744C6E01D7A32E2580A4F4F3AD9C04DE814", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176492, "uuid": "5593bc24-dd22-46d7-a535-2dfd9803300a", "value": "12:BvyXBhzd+mPfGS5w+1lnxTPfY8o5kLXfDWQknmSuoc1zR6wGJ/:BeBhzEmPf2Clnx71cefDmh3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685176492, "uuid": "b2061c94-7187-414d-a303-af9324bdf86d", "value": 600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685176492, "uuid": "a6603da1-5422-4126-93a2-649022e42660", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176492, "uuid": "bc2ca57f-f71b-4604-afdb-3c80c159d193", "value": "client32.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a875686e-fc8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685191657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191657, "uuid": "b656b20b-a2f0-4bba-907a-81ff6a912ba6", "comment": "Malware payload", "value": "1a284745a1abf4d9a3f1c3262f957585", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191657, "uuid": "e7ba5f6b-45cc-4aa4-ad48-519da946718f", "comment": "Malware payload", "value": "7d3c9502e69cbda7f7b6e9432d2a639418b222fb68225180a11e9540e388b077", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191657, "uuid": "ec64703d-1248-4b91-b396-8e88ae9ec82b", "comment": "Malware payload", "value": "1810b4d52ed239a25a3e570f706d145b4bf86c34", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191657, "uuid": "ccaf8682-60a1-4cce-a695-e21c75a41c2d", "comment": "Malware payload", "value": "f283796ffe42650ae81b9f8d0645d4fc9a1691e71eafab26c9648fcb521ae9b66267aed0682194492f0f354478096484", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191657, "uuid": "a9f0a038-7bc3-42dd-9251-8c404b8b0172", "value": "T141E09BCF409448814814CEDEB7021D158405E1DC85DBEF493CC54377C88871C3950FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191657, "uuid": "f8ec2983-c6a5-4cdb-9a99-0fe161a16c68", "value": "6:ebB3w5/KRpUfrg9FNk7CTKpUfrgoNk75jKpUfrgYIhFNk7+Y6KpUfrgEzjNk7gFY:iWKjpNkGyKNkgSIjNkqimzjNkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685191657, "uuid": "a431d91b-8c37-408f-8278-0e468a131e57", "value": 402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685191657, "uuid": "0f94941b-4f64-4e13-a829-448891c15b2a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191657, "uuid": "c3ba6d81-d565-471c-9242-2eb0e6086c00", "value": "ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2814e0fb-fc8b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685191012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191012, "uuid": "dcbda39f-1bb3-4fe4-af7d-565631f1cdba", "comment": "Malware payload", "value": "5af649f6a7380c8e281174ff9c659f5c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191012, "uuid": "4e83ca02-6315-4528-9b38-9c6a5975289a", "comment": "Malware payload", "value": "81bd511500ed773449bac19f146a9ac13a5cc883eed7917be1ae2a123739db1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191012, "uuid": "a67a10cd-2b51-49ab-a254-821d673638e0", "comment": "Malware payload", "value": "4366df0609764710a6f92fe37ca12d4f660db9dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191012, "uuid": "cb99d1ed-5e75-4539-a60c-7c21e1cdb0e5", "comment": "Malware payload", "value": "71907b7debbbf3a60ecc9a3fea60379ee3f60433fd01b5c0b9c3409318f37abdc6667361dc7c6ad2f6c7680a5567ec10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191012, "uuid": "1fa5f0eb-35e2-4641-8308-1fe23a69d812", "value": "T17EB48E62B3068F94E336D5710AF38368B9E4262206F755C6D372D624BA012FD6C5FED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191012, "uuid": "a721f59c-81ab-41f1-8e88-d8161b57e7d9", "value": "12288:VGd6Q9iDALikKTuEwLCz1e7PKmL3yoRwUODrQ2drMA2+SzFJ4jE167o/KwgEPVek:odN9iDsikKTu1LTL3yoRwUODrQ2drMAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685191012, "uuid": "6c146932-ea48-4591-a0b9-21631d7d82a5", "value": 533156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685191012, "uuid": "b4715652-3f77-4d6e-b5ba-25e9dac8857e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191012, "uuid": "fe44d1a8-9fea-4612-80be-e73837ff363d", "value": "mips64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d80c68-fcab-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685204945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685204945, "uuid": "44d10eec-6235-401e-b886-1c070b702589", "comment": "Malware payload", "value": "816a07696832ca54449afb95c0d8a54f", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685204945, "uuid": "f0ade031-5e77-4735-8f6d-8883315b793c", "comment": "Malware payload", "value": "83cf9fb418ead6b97f8bcaea08a824ab312c47471cc2134b15aeb977fd7671a1", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685204945, "uuid": "f06ddf8b-7423-4e89-83d7-4bbe3d8923f1", "comment": "Malware payload", "value": "d5e6a6502d0c77b18ed60db9c47b9c38f488a2ea", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685204945, "uuid": "ee0a4d3c-5832-4fa1-af45-496167aedf90", "comment": "Malware payload", "value": "76c7ffbe796168ea4d7f1acbfda66069f56acda6f09444ac40b8815bf9b7ef402884427f76321ad50819737bbef2d42d", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685204945, "uuid": "930a8b21-f601-41f5-a76f-b597fd17df86", "value": "T176A28E628CD0E02CD592C37D19BAD6922B640CA6F6563CE74CF02E7E5806C7E8F458DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685204945, "uuid": "a9e9aecc-2525-4e1e-860c-36038d82bb54", "value": "384:hXyS8LA5hPEabgFwjFhUbT8CmzihC2do5ld5x3IJ0Sphfn8:Z4LAf83Fw5hUS2+lzZO0Sphfn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685204945, "uuid": "52bd0c15-ee2d-4e4e-8eaf-b6770929ff4b", "value": 21339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685204945, "uuid": "cee31afd-2658-4d9e-b218-39a9c2625a7b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685204945, "uuid": "178c4199-7daa-4620-bcb8-0d67e264bf35", "value": "ExploitFixer-2.2.4.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f7d96c-fcc1-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685214288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214288, "uuid": "98b4ba9d-88c8-4e7d-b3c7-eac2cbde38c1", "comment": "Malware payload", "value": "b120a92828fba85158eec0374ce87c67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214288, "uuid": "0767fe77-1fed-4b36-bd45-318767526a24", "comment": "Malware payload", "value": "858f693fc9bd3aa44397059433e1cc0ce018d596f5819ef776acc2e2fcb60843", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214288, "uuid": "adccf50b-b0a2-488b-a6a6-6a641df7708f", "comment": "Malware payload", "value": "1dcc7608c51e00b103b1b6a311a9fe7022a87cf5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214288, "uuid": "4316e701-3d71-4f69-89ea-28b84dd93c49", "comment": "Malware payload", "value": "635ec4361384a805f0bec75ab98edfc772c7585a1f40b49d1f28f8c3d6434faff8b58a230bc5e27673c0c44fc02c49d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214288, "uuid": "54d9e306-2c87-44ce-a8c5-3064e8aca69d", "value": "T1D923012E1F5F1A09DB9EEEB48DCD1B612B123927ACC95A11F0B444873C02AA27DC8D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214288, "uuid": "b95c8951-56fc-4a01-a462-d3c1f9e2dab2", "value": "768:+WwkVM8BHRlumdNsuUIa230zmwjhUGGLzJwPpdt4mHQ2hytBGGdsLKH5k:+RkVM89RUmdiDI2zhzGLzJw7xQ2hKBGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685214288, "uuid": "4164d80e-857b-4a87-a8e5-712a8b0d55b8", "value": 47888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685214288, "uuid": "dd716d05-3b8a-4c54-bcba-4a1cd026ea68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214288, "uuid": "132d80ba-6071-442b-8f17-7f1a6a6d4c08", "value": "b120a92828fba85158eec0374ce87c67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e886a731-fcad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685205937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685205937, "uuid": "b8739a67-5ce1-429e-8c8e-21d373a5c14f", "comment": "Malware payload (RedLineStealer)", "value": "f702483a359c7020469e258bf3f4f043", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685205937, "uuid": "bf057025-40d9-4fb3-9826-5adda79f0152", "comment": "Malware payload (RedLineStealer)", "value": "863addada972eb8ceecd469cb98f357e81333c0c4f3c1185ff00fa0684b9c420", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685205937, "uuid": "a9a3b8f3-c0a7-4f19-91c5-a563b2409f28", "comment": "Malware payload (RedLineStealer)", "value": "ce00aac79336f34b53a001bb8af0c9c385e2adb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685205937, "uuid": "4e911694-e834-4e10-b254-3a0f3419121e", "comment": "Malware payload (RedLineStealer)", "value": "28e2ef83de74b42c707265784b7450ae212a1a15941efe6963802823ce1fd18f06e3e6f0294b9b11d0c4eaec3842241c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685205937, "uuid": "48dd8a78-f64c-4f57-9ee0-0412f05859fe", "value": "T161F41242F7C94013D5B52B7044F602D30F3ABEA29C75936F2685A99A2DB36D4B47233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685205937, "uuid": "7ee2db8c-4f77-4281-9764-2aff7e9ebeea", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685205937, "uuid": "03a2ce30-1def-46ea-9cd6-49cc4750fba8", "value": "12288:FMrwy90+VYaEnXijdbsyZGAuPwFALEz+6yI+Z0MTkeE8zKh8q+alD4/hPrWjBkNA:9yXv+ab/GAuUSI+ZTTXJqR45PyCNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685205937, "uuid": "bfd3323d-6350-447f-b912-53edb770033a", "value": 778752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685205937, "uuid": "ddc8380b-eded-453f-940c-ea7e80b4ebfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685205937, "uuid": "2c55df10-e57d-46da-8d4f-cb6a224f6a66", "value": "f702483a359c7020469e258bf3f4f043.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84bdfe79-fc6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685177853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177853, "uuid": "7a9cb53a-ea33-4d2b-a2a6-df784e59db0b", "comment": "Malware payload", "value": "f3e968ba5b17cca9be62e5ca9c9b06f0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177853, "uuid": "8c449ea9-fa4c-46cb-897f-f371478a8759", "comment": "Malware payload", "value": "869abff3b6b8d0d0e854a0b7708ece00ab0e578902c694b816a35f102aa9ea5b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177853, "uuid": "d6178aab-9b69-4e56-ba51-d1bf5190ac6d", "comment": "Malware payload", "value": "65fe252a722716c7c61563c3ca6101f50a21bda8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177853, "uuid": "a65669d4-de6b-4faf-920c-ef10d76e9d7b", "comment": "Malware payload", "value": "478defc157148fb893bdf5101e4d90344b2c48504ac2c609d6ef4cd4336f138d4cbfd0005aa777381c5a02f8e4a0e90e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177853, "uuid": "a00690ed-8113-46f2-a0e0-a5c3eaf4ba33", "value": "T18C34F70070D68135D5721C328DFAB69CA738B6100F275BEB739825399E242DDF6F4AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177853, "uuid": "6f96cc72-56b5-4e6d-a1de-dd994259d3ab", "value": "8ad88ac708ddb8f8b13f36cf34d63196", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177853, "uuid": "bcf6488c-1648-4365-a591-6045c4ca12ba", "value": "3072:PRYHxx1X/nD7OWQHBJB79Vd1i+qfsidTij98UwXVoM9EoJfsy9Om4QNYYTAFRNln:PuM9GFoMmEXOm4KMvAOeHz5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685177853, "uuid": "2623e3e4-e559-40ee-91d3-0eec6f3062b7", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685177853, "uuid": "650ad4a5-c9ca-474c-aa2d-3de1f6dee3e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177853, "uuid": "ad719923-6b24-46f4-83bb-63e9b7479b34", "value": "02705399.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1172c48a-fc5a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685169928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169928, "uuid": "e0bd82c2-544b-46c9-9170-542491e0c9d0", "comment": "Malware payload (AgentTesla)", "value": "58c12a77327df8eaa7ce0ab5c7c8e2d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169928, "uuid": "94360282-4f0d-4c3b-a965-3639027daf96", "comment": "Malware payload (AgentTesla)", "value": "883f6c086c4a79af02a9fd8a9bb11a0b0f6c75f87ff33f59b97b2d0aa7d25015", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169928, "uuid": "46903449-d810-48ef-af5b-c21116033101", "comment": "Malware payload (AgentTesla)", "value": "76c59fc66b7c8e71db05acd9ceda4362f28fd196", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169928, "uuid": "51505717-1f5a-4ef3-9d0b-c962a245877c", "comment": "Malware payload (AgentTesla)", "value": "530154faad67375b5ddffbf7b15d2abc87b5afc0d1c91629b6c00141146630da7e707acd0461f758beac1a78cd38881f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169928, "uuid": "223ad371-8a16-4275-a87c-ba45dc978371", "value": "T10CE4124032297F56C43ED7FD8931797193FAAA2A7272E38B1DE7B0C7A150F810641A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169928, "uuid": "e5b40bbf-1612-4d7e-9e20-6d4c4706fc85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169928, "uuid": "458eb6f3-e58c-4ce4-8744-c16c4af6ceb9", "value": "12288:II2mzZBEP85REHaJZFOJGWUJVa5/h6VxSrbdgztjFrBwJ7h+aj:V9BEP8cHKZFoBiA5GxSrbqjtBwt1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169928, "uuid": "5be1d254-5c3e-4289-88d3-a4b3708f5b0d", "value": 684544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169928, "uuid": "746a433e-7e7a-4ba6-a7c4-a967e4c97599", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169928, "uuid": "6cfa1818-df41-493b-a747-a20208c490df", "value": "58c12a77327df8eaa7ce0ab5c7c8e2d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f220e22e-fc57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685169017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169017, "uuid": "f561029b-da2a-4356-85da-5f9939b7473f", "comment": "Malware payload (Amadey)", "value": "66e354924c5b9adb47892ebc6aa31050", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169017, "uuid": "24e1c109-e57e-44c2-b25b-fa9baefdf2a4", "comment": "Malware payload (Amadey)", "value": "888658fa748c5f189417a35ef382ce67f67e425bc851ae38ceb9a9f1913d266f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169017, "uuid": "24e18664-5e4f-40b2-8b67-0cbdf569b050", "comment": "Malware payload (Amadey)", "value": "a30f2b389f6287576de051c8d38521d0fecc14dd", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169017, "uuid": "852b6cb8-726f-40c1-a85e-baebf807ac85", "comment": "Malware payload (Amadey)", "value": "6425f669520ea7560fa869a28475f7503720b142e504e11ec4843f4152e2dcc169129bc76f9dfd743a70de2d26e309ef", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169017, "uuid": "f3506d25-86d8-4fe4-be65-d19d45dab294", "value": "T1FDF4231367E485B2D9B203B029F612D31A3A7DA76CB8E35B23055A9B1DF3381D875327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169017, "uuid": "45ef2a86-f0e0-42fd-a1ae-a2486f6d4587", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169017, "uuid": "8258b906-d074-422a-b575-cbc726d54c5f", "value": "12288:VMr+y90jN9ODKnFF2D9m+wKrB8qzrb8R4Qe2lzgy8p9z3+RGLk3NT/S6:nyIAJm+rrBzzrb8R4Qeny8uOk3NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169017, "uuid": "09efa294-7141-4106-8fc3-b7c79952f548", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169017, "uuid": "c1b45464-fa3c-45bb-bf13-7f9d778ad9ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169017, "uuid": "db20e3b1-c034-4803-a398-6670b8b27884", "value": "66e354924c5b9adb47892ebc6aa31050.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a03d2e-fc59-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685169615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169615, "uuid": "1ca92100-266b-4b7d-ac08-0841298f2037", "comment": "Malware payload (RedLineStealer)", "value": "a590b3753ad56d72d3123b25b43e4403", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169615, "uuid": "2a4ae25e-7f73-4257-8d80-6c55cd6ba564", "comment": "Malware payload (RedLineStealer)", "value": "88f23032c2a8449748602819c8733418c68cfeccf68a9403b6286d74cd28852b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169615, "uuid": "8ca1605f-0e43-4f4b-a520-dd2b56bb79ef", "comment": "Malware payload (RedLineStealer)", "value": "56c96384ce952f9805cfc569177854ffd213bdff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169615, "uuid": "513eb22a-7ef2-435b-ba09-1c4f921e1d59", "comment": "Malware payload (RedLineStealer)", "value": "4f782df55f7ecfb0f4b5a95f854ac15bc85408fd8560cfe4375e1e07db2e466b89e4e74fbf202a8d848b59ce40928de8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169615, "uuid": "2808ffe6-49e3-475c-8467-6e83513caca3", "value": "T1A6F41292A7E59433EEB617B01CF602870B3BBCA24D64E66367895C4E1D72385D93033B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169615, "uuid": "53943685-e280-4a25-a1f8-d71846df04d7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169615, "uuid": "7009a8d0-6f1f-40fa-ad7f-eabea8d95467", "value": "24576:5y3M47QhRYPJ01GZMD/yx6R0m8UBk3fS6:sc4EXYR01eSX38q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169615, "uuid": "0b5d0050-e7c6-43ad-b60c-778ff87bbd0e", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169615, "uuid": "1870f5aa-5a64-4de6-92c1-5e8467eb972a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169615, "uuid": "288f4c54-3067-437b-9677-0e7b1e16a116", "value": "a590b3753ad56d72d3123b25b43e4403.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20941657-fcc2-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685214621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214621, "uuid": "e8bfd358-2ee0-447a-a45c-687e64e5e975", "comment": "Malware payload", "value": "16bec322d174587a7b546718df820238", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214621, "uuid": "b76b8724-0b55-4071-9002-b2bb6de2c8f9", "comment": "Malware payload", "value": "8a9b9d1afdd1d4f8fdadcb4525992a98dd373a33c02fc171c42148df0bff623b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214621, "uuid": "76b8f8aa-1616-43d3-8eeb-d8a0ebab1338", "comment": "Malware payload", "value": "2939f2fb33044bee05243f26aaadc8c6366001ce", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214621, "uuid": "6aab03a9-23ae-4880-835a-2f6ce7ad92c0", "comment": "Malware payload", "value": "0315e415f779cc0117b3c40427530f3b27b28498786455507bce1db009e3b74da9a258a20edbbbe04f91ed79c0c5c8b8", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214621, "uuid": "22498fc5-8d4b-456c-9c4f-818d90f08212", "value": "T17213F1349A195F03FC478BFFFA1B5E0B1BE1A49B4F05ACEB29647682F9818E1D001496", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214621, "uuid": "f5d9f702-9366-4015-a13c-6a3cdd3bb995", "value": "768:8bvq63OlMB2xL2Zd4Qs/jyWpSKLOjjiEG9c3j2trDlxRpKk8vG+Y20UYfg1/5Wwf:M13OlMYFJQsbyWHLoiZUj2tlz0G+Y20G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685214621, "uuid": "b53617a3-a4c6-473a-823c-5774a5afaa27", "value": 42772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685214621, "uuid": "479e1fe7-d401-489e-ad5a-cbe8670f1769", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214621, "uuid": "7980e15e-5e46-4162-a77d-959ad029facf", "value": "16bec322d174587a7b546718df820238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "199c3d8e-fcc2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685214610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214610, "uuid": "ee619342-5245-4a7f-87b8-b7237a96463a", "comment": "Malware payload (Mirai)", "value": "a317bd8e54050e96aca5ac67ae0f157d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214610, "uuid": "94571967-dc35-49fe-a47b-f08cff59b57b", "comment": "Malware payload (Mirai)", "value": "8add179c65e9e3893ff28c0dbf0ba431248ec1a27885aae68d143abd09af4fe2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214610, "uuid": "7afbf5f2-3187-4253-8418-942a0c1b6c08", "comment": "Malware payload (Mirai)", "value": "80f8f5142993ebe73a400e9e66c703374a643e3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214610, "uuid": "bd80d9df-dce2-4f95-a9f7-5e23eaa3193e", "comment": "Malware payload (Mirai)", "value": "70c6ad3687b4928f7300b6118a20da1f5da9fe9ea128100dd1cbe5e3ac2df7850183d1b280195015c026e400f5856ce6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214610, "uuid": "7d8657c8-d9aa-4d8f-8952-d03ce6a6dee7", "value": "T1F0934BDAB4009D7DF84BDA7A40164D0AB57073900BA30F27A3A7BDA3EC731A56D17E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214610, "uuid": "81339b2d-8db2-477f-8d83-3febd9a7aeb0", "value": "1536:crB2r8ZyKs5SKOMAS+oOCykYav+J2/L/I38dQzv3j7gcA80E7PjzlgLSfm5eTBnZ:YY5LRN+oOCykYYywL/IlzYcD06YSUeTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685214610, "uuid": "4ee73168-bd93-473f-bfd4-ffaed64aeda2", "value": 96788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685214610, "uuid": "c57a1920-6373-4d61-a368-a78f3caccb75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214610, "uuid": "f17fbdaf-c689-47c0-968e-4316616512e3", "value": "a317bd8e54050e96aca5ac67ae0f157d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22684c3d-fc63-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685173822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173822, "uuid": "c56decdc-1cde-4d7b-9957-ec78ab35fce1", "comment": "Malware payload", "value": "a78d6e450c92da7601378112fb7843b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173822, "uuid": "472f3dce-0ea5-4a03-9a4e-658b84b7d4cd", "comment": "Malware payload", "value": "8aec7f3354e9897a3eefd2e32357081ed1e7f5f49dbfd26d34947460a00d1938", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173822, "uuid": "9ed91450-c8b3-4b15-917d-c0b262a386ed", "comment": "Malware payload", "value": "3e4190b321c460e2f117e650caa9782b2dafc5ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173822, "uuid": "53f57be6-f88b-4b93-838a-b2f2aaea3631", "comment": "Malware payload", "value": "ad02d3ee1ab10d2deb9d81b0c61b502c48ad67ddeb0bf7d189fa05c24a2f844fe9d161d01c390cb45ad4cdba1f4f5db4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173822, "uuid": "cdd72b5f-fa11-4bf9-8238-ce1ebcc3486b", "value": "T1E8747C0392E17D54E9665B339E2FC6E8371EF7244E193B556228AEEB04F10B2D173382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173822, "uuid": "78db4683-559f-4921-bde7-e4de48b16267", "value": "bd191f6a78cc98a8bbe61db18ad8e9a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173822, "uuid": "bfc4aa43-68cf-43ea-9986-c11974e88209", "value": "3072:0KFVArjg78B9EbcJG8dbiT7CuHLOhwEgJyWIEk22uu/CPc3DAyPAUgOZv57AKX5h:XFVAc2hmT7CurOuEcKpTApUBv57YYa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685173822, "uuid": "1aaecab7-ca46-4898-84ea-c774711a9174", "value": 370688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685173822, "uuid": "b121f1e2-40f6-48f6-87c1-b84215ac4b2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173822, "uuid": "bf2776b5-1589-4391-a8c9-694b098d801c", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59fdcd7-fc8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685191705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191705, "uuid": "aad433ad-a436-49d9-86a4-11faabb776ad", "comment": "Malware payload", "value": "741bac7157d3ca67aed4627deee4a6f2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191705, "uuid": "c2179134-ba42-4b01-821b-737683b3ecf1", "comment": "Malware payload", "value": "8b7de63f78c5d2f96f46e7d486563805fe34d7df33cd26d68e2c4ccc25ed1e83", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191705, "uuid": "0bd598fe-fd7c-4135-897e-f73950e86eaf", "comment": "Malware payload", "value": "66e8940db21e127eb8b8c1f03295671eaba3e2e6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191705, "uuid": "55bce136-7845-496d-ad2e-ab6f16e2a11f", "comment": "Malware payload", "value": "1c544a5ea2e1c4d92c4cbce77bd37269436f2e1f1b7751e70a36bbb180d8f2b5decbb574ec0c5eed6bb387f1df29e2c8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191705, "uuid": "de21f088-78bf-41a7-8ff8-d7bc372b04b2", "value": "T170F0D4DF005894808900CBDE3A560A259408D3D91BEAAE0B3EC942B6C88A61C7170FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191705, "uuid": "698d5455-7ba7-439c-93e0-a270ae39a351", "value": "12:3WKtnKBNkQnEWFNkQnGFNkQnPFNkQnWNkh:GtrkQkzHkiHkZkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685191705, "uuid": "2460cd6e-59c7-425d-bd1f-efc9135cef1e", "value": 476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685191705, "uuid": "019142c3-5ea0-4ce8-8948-57e19dfe4ddd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191705, "uuid": "e524a047-8b51-4b20-986a-8bd407df1856", "value": "mmm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e4bc56-fc5c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685170822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685170822, "uuid": "267e411c-4ec8-414f-be71-61208f17fd87", "comment": "Malware payload (RedLineStealer)", "value": "91187848941b11ccedb98fb9ea9dadb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685170822, "uuid": "bcb90987-00a4-4c93-8ead-01aac34608e0", "comment": "Malware payload (RedLineStealer)", "value": "8e84f8b321d330ba0b012dc3deee1f3cbfcb17e452824c43826a3de5e0b2e51b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685170822, "uuid": "ae49bd7b-c501-430d-b086-bb1f6d1a2213", "comment": "Malware payload (RedLineStealer)", "value": "8cdc87e9e4f2e17fbbf00cb2c5e64f60a5fef890", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685170822, "uuid": "af74d6ee-0354-4cb5-b7ac-dc56f9f5fa08", "comment": "Malware payload (RedLineStealer)", "value": "f12d72f9bfcf46532fea857fc6e4797750b84dec083a18d633a3958e3d34b176b8248cd80b006fab4937491f4ef3b2da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685170822, "uuid": "17937a3d-35dc-45ec-bc2b-665b3a99f8af", "value": "T155F42292ABD98433D9F527702DF302C30B3A7C968DAD87771755A8AD0DF26A07970326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685170822, "uuid": "ff4e8856-df50-4736-9bb1-648cd6806042", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685170822, "uuid": "54d59d17-25ef-44d1-81ca-72fb4e9990d1", "value": "24576:yyeWF4G/x2fdQQLh7GcAXcutm80Vk3pSpB:Z3EfaShVXuIX4Ap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685170822, "uuid": "dc25e466-c22d-482f-bde6-ad33b40145e1", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685170822, "uuid": "25079649-6f18-4b3b-b085-303f6bc179a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685170822, "uuid": "e68099d7-7eb9-423a-9add-b40a1ee97e8f", "value": "91187848941b11ccedb98fb9ea9dadb7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a0ecfe-fcaa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1685204349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685204349, "uuid": "a2baf315-048c-4fa2-b14e-24e033978fe1", "comment": "Malware payload (ArkeiStealer)", "value": "73aa3e6b65d553eeadc6d60bb705de3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685204349, "uuid": "0de6dbfe-18a3-4ca0-b6ee-6fb41096fca2", "comment": "Malware payload (ArkeiStealer)", "value": "8f2ebdb2fb211c100be3020b4440cad39f1098522763e1f52c5c9774938975b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685204349, "uuid": "58a656b8-06c4-4a11-8d20-a1531817eece", "comment": "Malware payload (ArkeiStealer)", "value": "e57c9f1f6004573ba711fd5e4f383b48d44d78fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685204349, "uuid": "e2e8d5c1-b012-4bb4-89da-549dbc1cbad3", "comment": "Malware payload (ArkeiStealer)", "value": "39e7266e78856784b087defc0afdd971761c315ff7a12261fa2bd550e6122ad561cc7d9d38f6a55f8a1df8ab0e5bf5a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685204349, "uuid": "89c4cbf5-c052-4280-a64b-8bbfb83012cd", "value": "T114947C03D6D2FC54ED269A728E6FC6EC761EF5508E09776A2218AF1F04702B2D173726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685204349, "uuid": "1e616b47-e374-4e4d-89e7-93dc65c492d5", "value": "d683fcb523ac92743f5db043ced73806", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685204349, "uuid": "a8e56f74-9386-4c8e-bd63-fe0c4a1e5c2c", "value": "6144:I74COR8QoFyuA7b8ezbi0uN050HcsCW92Ie7kw8bHF4:IktZoFyuA7b1i0uNjx2Ie7T8bl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685204349, "uuid": "3036c5b1-3d19-4100-ba65-444b1e04a248", "value": 414208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685204349, "uuid": "1b205d55-3411-4695-aa4a-00568c098b20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685204349, "uuid": "39be5b68-2d39-4b8d-af08-de9508129bf9", "value": "73aa3e6b65d553eeadc6d60bb705de3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c820d7-fc69-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685176514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176514, "uuid": "c650aed8-d89e-4e6e-ac8a-fea4d0688a0d", "comment": "Malware payload", "value": "feac8d47b2be2327505d38a42d94d52f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176514, "uuid": "b842d50e-26e6-4efc-b809-bac0e22725f1", "comment": "Malware payload", "value": "9232e6906bb66630992344f56b88cf1b99d3732c170a215f3fd4b37e8f909f95", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176514, "uuid": "3750b0a7-4c97-4351-b974-cbadc29ae364", "comment": "Malware payload", "value": "45903e7e7b2bd369e3bc3f032382a6129d37faa3", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176514, "uuid": "b4daa305-5ba3-4554-8716-a3eb2001ec85", "comment": "Malware payload", "value": "7e7ccaadb6f4af062af67f7eeba5358f0ae251578f327d3c7d65ec287186b2d46c5f997e392e201bf2cde0a5f3af5dd8", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176514, "uuid": "35df30ff-15ab-4443-9127-1fd0f6b5e625", "value": "T1ABD0A7180BD183A95C63C4E6ABB9878DE6D0401A7AC923284F144DDF414580676A3310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176514, "uuid": "0c19c1f8-71e4-4572-b74c-8766a4d27b8e", "value": "6:CxBR2hn23f99oRfFihflPQ+ZfJumJB1hn23fyuvn:cnW23QfFuhfJumJJ2agn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685176514, "uuid": "7e412651-1665-4fc8-87b9-48361c90b205", "value": 218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685176514, "uuid": "3e10da9d-d35d-4e15-a3ef-e6e4fcf45dc0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176514, "uuid": "862ff7d7-9cc0-456e-84d8-b4007123b1ae", "value": "sett.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3366f492-fc2d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Meterpreter)", "timestamp": 1685150658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685150658, "uuid": "8e4ef2a0-24d4-4a7e-ba70-4e9f1c4769c2", "comment": "Malware payload (Meterpreter)", "value": "783ddc6a4471862321e852037f9c6288", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685150658, "uuid": "6fcaf4dd-97dd-4678-8ac7-df848b4751b9", "comment": "Malware payload (Meterpreter)", "value": "935d4f84f1f1afb65dda0ea548d7e1b77551a1ad2f2a38dcb98a35b23c8a583a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685150658, "uuid": "565b791c-ec66-4429-878d-f33c7446fc59", "comment": "Malware payload (Meterpreter)", "value": "1404a93c4bd941e395b0c0e628c0f61520b05cc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685150658, "uuid": "493698e4-12f7-46fa-b6fc-62011070c2be", "comment": "Malware payload (Meterpreter)", "value": "7f3be119ef73e129da7b32212299983a17cc04276548dbe500aea85b90531b2aaead42303d4605c751cc2b1d5d9fd276", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685150658, "uuid": "df6d68fe-f4c7-4f60-b46b-41409913af98", "value": "T1FC146C5632A400B9E973913DC6934B07E7B2B45A03B19BCF07A443BAAF1B7D1653D722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685150658, "uuid": "53de25f7-9a76-4764-9133-1ca58fa3f327", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685150658, "uuid": "28335260-e203-4ad4-bf91-4f25c6bb1d94", "value": "3072:0b/NPtQdKGlffCIL6T5izPZ/M0Tcgy0mc0drnew60CxXj6nxwsHMr:0UfFLmqZE0TZTb0drnwj6RM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685150658, "uuid": "4e28002e-6f5b-4575-a382-ec2169913b0a", "value": 206848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685150658, "uuid": "d6263fe4-a7e2-4f8d-a484-47e23ace2af2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685150658, "uuid": "0a2a6f43-0c63-46a6-a2c9-4ff1d1285067", "value": "reverse.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6d0f9f-fc9c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685198433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685198433, "uuid": "3c8003e4-5364-4ce8-a18e-186c220d0d4a", "comment": "Malware payload (Amadey)", "value": "3f0fb5207ddca09a04c6a7f9a5d9bf62", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685198433, "uuid": "734cce26-8892-42f2-ac5d-bf843a874f09", "comment": "Malware payload (Amadey)", "value": "939127201975aa85223b1e34c69c6da44343362684f550ae3e4a9241fa90dc15", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685198433, "uuid": "54739c8b-302f-4b45-9736-6f2019063558", "comment": "Malware payload (Amadey)", "value": "2c77b39e5db7a6f94ab92e87d945f11e484d73fc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685198433, "uuid": "b08216b3-74a7-4271-8407-979276baee24", "comment": "Malware payload (Amadey)", "value": "670c1dec418df953cea7dfa5a3d9b9e7ce63125291c7b94aac5ce3a3c9d53c067ae8adf90ca62d83b0bf5484c5d234e5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685198433, "uuid": "b104785e-95ae-4df7-948c-76d0f0b7bcb3", "value": "T12EF41203EBED1837EDB417B485F913A30A3678F09E7143AB1691656E0CB3694A972337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685198433, "uuid": "a08ae595-2f4c-4699-8b92-395fdbc4d5d0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685198433, "uuid": "01f86b37-f074-4318-bf82-7248a58c4dd1", "value": "12288:KMrQy90oTlfuLzGKFm38R+DldOIrCIRVDbDJFOURN/btZibyfYCShhJCJCX2mN:my/T1ezFFm38oymCgdJFOcSdhhQS2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685198433, "uuid": "3be99c4b-3ce8-490c-9677-c47f327ec6e3", "value": 778752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685198433, "uuid": "2b295c70-3af0-432f-955a-47f8818c1578", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685198433, "uuid": "033e079e-1df5-400b-ad5b-33e430b5751d", "value": "939127201975aa85223b1e34c69c6da44343362684f55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba8331f-fcab-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685204735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685204735, "uuid": "ad332f69-fc1b-465b-bddb-131be1919aba", "comment": "Malware payload (RedLineStealer)", "value": "a045d8b0c07eb93a5e36d175f0dd1136", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685204735, "uuid": "78fad8dd-9ee9-4219-8a4c-791682972092", "comment": "Malware payload (RedLineStealer)", "value": "96f483e12c7b4b3354eb3686996ae038a94acc4a41a18658fdb05b51dda5c3f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685204735, "uuid": "d7a1db23-390d-4284-8e2c-e414ab2fa248", "comment": "Malware payload (RedLineStealer)", "value": "e3b72fab3b1adc6eb0b1e0a657b79776625a0a4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685204735, "uuid": "945a37c1-8bac-40c5-aa4a-5dcea9203236", "comment": "Malware payload (RedLineStealer)", "value": "6a734697a1711bf36e43fe1978bf4c114c9a6e87cf3eb0c97766281bafb473f006519ac9172a50b0fea7c968254d1d54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685204735, "uuid": "b69c0811-d90c-42a6-a5e6-0c705422897b", "value": "T130352353E7C595A7EDB6077418B306C32F7E3DB29C395B2B234194591CB28886832B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685204735, "uuid": "1a69329f-ef27-4408-8c87-d77d3377cc39", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685204735, "uuid": "ac8ee66c-77e6-4d25-8e62-89dfb85fa3c1", "value": "24576:UyRdrlvZnRPplpjI50dzMGjXyNC7i4pUKFOV4jLtL6ZQiC:jRFlfplyKlTyNC7i4pDOVewO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685204735, "uuid": "bdad33e1-0e54-43ec-8471-d3c7aa943255", "value": 1058816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685204735, "uuid": "9e45a432-b717-4cb1-a348-dfb26eeecea5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685204735, "uuid": "2977683a-fa9d-43d7-83df-46e716a709c3", "value": "a045d8b0c07eb93a5e36d175f0dd1136.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df2987f-fcc2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685214617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214617, "uuid": "b9d1af7e-c0b4-4361-85e4-16ba2f58162d", "comment": "Malware payload (Mirai)", "value": "93af9cac6f1f870dbcc738f9b67f4f01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214617, "uuid": "1c84dea0-c901-4ef0-856e-9e2c4d61b175", "comment": "Malware payload (Mirai)", "value": "99678ae06a03cb8292dc8e336915e6d77c00c399729dea868eadfefde8892ae7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214617, "uuid": "3326aea9-b0b1-468d-8431-d6205913d5b6", "comment": "Malware payload (Mirai)", "value": "9a4876dd9e8cd341ceb7fd5785659b18da421e6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214617, "uuid": "9f0fd2d6-a88e-4438-8caa-f2e7e49e141e", "comment": "Malware payload (Mirai)", "value": "774a7dd602502531fe789c246e5a795ea8b093364aa1419cd19f95e4eac5a25b8f874eb1caa162645ab034bc60556eb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214617, "uuid": "42bec4c8-f364-43b1-936e-8ccf8022bda8", "value": "T19613F11FFDA6434CDF99153A13812F2492AD4CAF49AB2F4B2C0217366517931EFE612D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214617, "uuid": "082e0276-d219-423d-a203-2c9324f1ea2a", "value": "768:QI0BoAoeI5q4pjPN7i+cezBUavo46h3hJUMBuyRBYRk5SbTi5q:W8rU4/i+1zWVh3hJUMBuaiuSaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685214617, "uuid": "0f170e58-1086-4797-83c6-f950e010d037", "value": 43080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685214617, "uuid": "180dcde3-8f62-4736-bde0-2f5f6d3074a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214617, "uuid": "daa5149d-02b9-4660-89d6-1ae86cab4dde", "value": "93af9cac6f1f870dbcc738f9b67f4f01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f660746-fca8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685203533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685203533, "uuid": "54c91ad6-3522-4aa0-ba20-f9bd8c7b1771", "comment": "Malware payload (Amadey)", "value": "79431ad1125d4fc913bb26787f60ea74", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685203533, "uuid": "f9ab3eab-babb-4159-bc53-aa32883c5427", "comment": "Malware payload (Amadey)", "value": "9a6398c7817ec4db453a1d5421c6fc4053699bd470bc2cbb2518c066c117593a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685203533, "uuid": "d6b1dda8-41e2-4f2a-b347-d518dcd44d3b", "comment": "Malware payload (Amadey)", "value": "f0ccf107d303db45a7b5b737a11cb4542839b4ca", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685203533, "uuid": "32f2c021-c95b-4443-abf0-8dbccbbee103", "comment": "Malware payload (Amadey)", "value": "ade25a78bbe65ec4ae0726a6a35388886991baf6912b06aa0a8f8bb86c65ac108605f43a64a64af2a471409f2dd538a6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685203533, "uuid": "b6646ddc-8659-4516-ae53-bd0c2955a270", "value": "T131252367E7D45472F9B6573018F20B931E3A7C971E28475B13868C5B0C726A4E83A73B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685203533, "uuid": "439077d8-b8cc-4696-a11a-f5d17e8621b0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685203533, "uuid": "979ded7a-e0dc-41a6-9f0d-606114e5972e", "value": "24576:AyfElzj9tBlUS186RHB2Uf9QUfP6KMjmm8OfdLhE:HfczjBlKYHt6eP6qOf1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685203533, "uuid": "95fb62c4-2500-4370-a031-bab0635377b9", "value": 1057280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685203533, "uuid": "751fb150-af37-4e7b-a980-02365ebbc3db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685203533, "uuid": "7534bc2b-eb58-49ab-9797-2c82d765d8ed", "value": "79431ad1125d4fc913bb26787f60ea74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea14710c-fc68-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685176305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176305, "uuid": "a2060136-184e-4290-936c-63908f487002", "comment": "Malware payload (Smoke Loader)", "value": "005ee5d7136ba3d8535158c59d4da359", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176305, "uuid": "cf039e14-b4e1-4f20-babe-8bef5e588459", "comment": "Malware payload (Smoke Loader)", "value": "9c995cae1ea620bc32da91ac6d20234493c51bcc4e5fdea5521b70882212a5c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176305, "uuid": "57bba912-edd7-4ef9-9287-6e1ebe6097c5", "comment": "Malware payload (Smoke Loader)", "value": "ea42f650725a911dd3cc85812d41c17e398515af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176305, "uuid": "a70c70d5-8848-41d9-bf76-353428d399ae", "comment": "Malware payload (Smoke Loader)", "value": "70e7c2c2cf9f153dc245044a2346fa9901377c4712bebeb388baa8d938e5185946cd62e335918da3c8fb9fe66313b2c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176305, "uuid": "59c6eae1-1b40-440b-9d84-c2e183c02677", "value": "T18C543A1392E0BD94EA264A739E2EC6EC776DF6948F09376622185EDF04F01B2D173391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176305, "uuid": "6c223924-f8bb-442a-87ab-424f60953a49", "value": "697c6731df2df92c82c75859d21c5f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176305, "uuid": "f11d7222-a06c-4ec6-8104-e0c76250579b", "value": "3072:HAVEn6hQ/Ddsbek0cS0yoiLL0fGEyfTRKsGGFZOkZw/HvEUm5QO9ky:gVEnxDdsbekDDFikfGz5sOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685176305, "uuid": "c6fd08c8-4f81-4a0d-a3eb-860c5dd9987a", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685176305, "uuid": "a9403364-5657-4c0e-9b93-3cb89f9f934e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176305, "uuid": "5bc17131-5343-4e19-9b40-1177b9649ab9", "value": "005ee5d7136ba3d8535158c59d4da359", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e611c742-fc68-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Glupteba)", "timestamp": 1685176298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176298, "uuid": "42f03135-7bb4-4274-a8da-dc219e31e8d0", "comment": "Malware payload (Glupteba)", "value": "cc9e58ed1bcae82f769f3b55b18af80e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176298, "uuid": "76c76ba2-fc91-4f46-9872-b08280ab635b", "comment": "Malware payload (Glupteba)", "value": "9f3ab2c5e5547a8bbd9bb223e322601873f1d53e5c2272989b85c759b6ac875c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176298, "uuid": "993cdcf7-4303-4e58-9bfa-8e3b81815ad4", "comment": "Malware payload (Glupteba)", "value": "7e70920b8063d8c192a934451b4c1362ab29bd0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176298, "uuid": "1ca99599-6cbb-48bf-9ce5-5a9a8d37b3d1", "comment": "Malware payload (Glupteba)", "value": "a9a37192c850d9ee665da70d2699c831919997e4587d7a184a8b5db47d13a58aea6a6af9207f3ed4399adc9d00b90b79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176298, "uuid": "9edfb124-e2a6-4105-a699-133daed3c881", "value": "T12716234382D07D95D56A8B33AE1ED6E8BB0EB6984E5E773732192EE714F0063C173291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176298, "uuid": "0294b1f9-755c-4763-bbc2-db78e3dc2087", "value": "697c6731df2df92c82c75859d21c5f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176298, "uuid": "81480b27-4145-4b8d-8784-4f3d74fff8cc", "value": "98304:/wwnuY/s3I4HHAgK5AvrW46hqyBPHtRMqZ37q:/Rnuw6Hc2rJeqyBPHtb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685176298, "uuid": "d777a9fb-2611-453f-aa25-85b4500b328d", "value": 4386688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685176298, "uuid": "48359541-c28b-437e-8abd-09ee668e44ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176298, "uuid": "ac50f28c-4250-4a10-8cd9-104421eeb337", "value": "cc9e58ed1bcae82f769f3b55b18af80e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c47e412e-fcba-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685211460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685211460, "uuid": "36a03a0c-330f-494d-ae29-33cc02644a88", "comment": "Malware payload (Mirai)", "value": "363e396c216128c0b680ea4969c03454", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685211460, "uuid": "d93f0aa2-ecbb-4e5a-a0b0-1f5edd5c8664", "comment": "Malware payload (Mirai)", "value": "a05ae421b9eb7fd32c1dcf46b01d89cdc4025f6c145ca59d611f4d4e50bded30", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685211460, "uuid": "d0ade3e1-9765-48b1-ab55-04c185e937f3", "comment": "Malware payload (Mirai)", "value": "204b2dacaf4948fa48cc3484a5725e5cd904642f", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685211460, "uuid": "f018c214-de4a-4f79-aa43-b90252768e1c", "comment": "Malware payload (Mirai)", "value": "132fb9afee9d13b399fb44114d9a11f2896f9664c59f83af9068cbf251e7365ffe128945a90da776666989a8a8607408", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685211460, "uuid": "459813cf-19f8-4c02-9e62-9964d8781881", "value": "T1AFB36B176292C6FBC08352B52BDFA2A18823F5390B32721B73947EA53F19CC95E5E741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685211460, "uuid": "ca212c28-7fed-4686-a473-c036098a16d4", "value": "3072:cc2nYeFrXBYVmGsiTd3LVpha3tJPCNgOXikYuM8R:f2emGHLphadJPCNgOXikYuM8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685211460, "uuid": "925de27c-ff8b-4006-9a18-a23d70227b56", "value": 113968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685211460, "uuid": "fa8d8b58-e8b4-40cd-88c5-0aa6d36eb380", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685211460, "uuid": "e5bcd2a8-ac8a-4d57-afc6-54cc7924cd34", "value": "363e396c216128c0b680ea4969c03454", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f5b580-fc59-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685169619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169619, "uuid": "f234bf77-97bf-481e-88c6-61aa56fed3b4", "comment": "Malware payload (RedLineStealer)", "value": "b0470307b280a5f149ac58137f771b96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169619, "uuid": "6a2fdee8-2d2b-4338-aa5d-c3313c280362", "comment": "Malware payload (RedLineStealer)", "value": "a0a4c74d44a1e303fd48da76ebc399383c5078847acf1cdda402c3bfaf01ecd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169619, "uuid": "725ad768-641c-418d-8dc4-490d527d90e0", "comment": "Malware payload (RedLineStealer)", "value": "fbefd528ea9a05f52695d5ad83fd5294184795c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169619, "uuid": "f18515b0-2195-4fc5-9888-98a2024933ca", "comment": "Malware payload (RedLineStealer)", "value": "70c2cce902b166df7836a793286a69dd12ce1b3ecc2f1b9735f44f27ab8c8a8a59333323f0f9cc7b186396225315143b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169619, "uuid": "7a608a0d-331e-447f-8867-68d0df772a8d", "value": "T1FA35239367D94162EDF71BB149F602C30F3B7CB54C28959B0A43E8475CB3284ADB672A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169619, "uuid": "ca8845dd-a5ed-4547-9933-06814661b6a0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169619, "uuid": "a7d5e83b-d541-4943-9636-70dd51a1847b", "value": "24576:XypGVycNTCfMsrMpiL8QZ43+SZwZskJxCiqvaTNmJ:iAVn50rMp+TABZwyCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169619, "uuid": "6230719e-f1ed-4a89-a3c0-a4906e577a98", "value": 1067520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169619, "uuid": "9d98d4e1-c313-4279-8169-98c182189d66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169619, "uuid": "f105c45d-fb24-4fcf-b552-036195d64fe3", "value": "b0470307b280a5f149ac58137f771b96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "666ddb31-fc6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Glupteba)", "timestamp": 1685177802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177802, "uuid": "d15c308e-0089-4c26-87f3-a9eede877f94", "comment": "Malware payload (Glupteba)", "value": "642fc23efb6d42f577934c398c2406e4", "object_relation": "md5", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177802, "uuid": "21bb697a-0d87-47f3-a95b-9e2c8bddfb94", "comment": "Malware payload (Glupteba)", "value": "a11ce3ae1aa7add00a98929d04a49fd322c4be0a9dacd182d32807d781e26c85", "object_relation": "sha256", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177802, "uuid": "3ad1ffd1-651f-4e45-af0c-e5a95b35a459", "comment": "Malware payload (Glupteba)", "value": "80643163fca07c8d53633283123421eba1c2c98d", "object_relation": "sha1", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177802, "uuid": "27aa2062-5f08-4642-ada9-f86969e3c139", "comment": "Malware payload (Glupteba)", "value": "f7ae74be8996f3ced6bf05dd90da5deda9eb65ed9b35475d24d4d31d08ba87f932b6d653fe07197a8d77907756aed06f", "object_relation": "sha3-384", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177802, "uuid": "f6a234ec-4d05-4791-a021-c601e4001856", "value": "T19A162353E391BDD4E9924A32AE5E93F8332EF6504E98775A21199EDF40F52B1C2633C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177802, "uuid": "e6d811e3-b5f2-460d-acd2-57975b4c7f97", "value": "bd191f6a78cc98a8bbe61db18ad8e9a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177802, "uuid": "7ae141d7-e71b-4209-9763-99a267b5c638", "value": "98304:CHVVp2uqi61tX39zbn2cQKXNes4aMrVfmxWuRZxuBKBOBz:CFYzTXNH2c3eKokxlRfa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685177802, "uuid": "749d219b-8ba5-4e70-9017-a30cfe009a84", "value": 4387200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685177802, "uuid": "bfcd5bf5-0b94-482a-a314-03491bd3318a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177802, "uuid": "4a94d4d0-a9e6-4842-85f6-6d0dd853c2d1", "value": "02047599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3fc76d-fc76-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685182346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685182346, "uuid": "701b8b1b-7672-4048-973a-fa65376232c5", "comment": "Malware payload (RedLineStealer)", "value": "37e93811f8db4008e562781ee51fe1b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685182346, "uuid": "34be54c1-c604-4422-8402-d16946067a87", "comment": "Malware payload (RedLineStealer)", "value": "a1bcbe90057803651cffcf70d5c3a9c5ba4655258111b64d332c6edce4740765", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685182346, "uuid": "cf04cffb-3cad-414d-8c06-c0f8c821ccb6", "comment": "Malware payload (RedLineStealer)", "value": "b9e514c64673bebd11a3c6526fcf4dffef49295f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685182346, "uuid": "df8f13d3-d5e7-4aac-9e89-d1c0f15ca1c2", "comment": "Malware payload (RedLineStealer)", "value": "a452071763c80e7c700c77199336a41d2db4624db65ab9aa05fd6fae671ab2e0fde8d7374c2034ce00b6d07218cbf94a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685182346, "uuid": "ec6546ec-8ff6-42d0-af97-0b3444494c38", "value": "T1DB64DF21764CC077F85B15718AE9EA769AB874711B6F51DBF7C04A2D0B227E2AB30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685182346, "uuid": "6ebb9499-8f3d-4b51-98c0-b6b776c7844c", "value": "f0ea3dd20c636e704dca117c1f251a95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685182346, "uuid": "f1561f52-bbbf-4fe9-8fb4-ca912d1dc686", "value": "6144:1maCQXoyVqj0rQGsIXhg4HfsyO1owUFY2MjIWWm/o:EQXVVqYrQGs34HfsJ1owLNIWWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685182346, "uuid": "010d7f85-38b6-419e-8ce0-d623619a3929", "value": 312952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685182346, "uuid": "1436c93e-bb98-4277-b107-fde21db867b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685182346, "uuid": "4d3a3266-f259-4809-ae3a-4a1ec28439f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c75b14-fc33-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685153324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153324, "uuid": "e946837e-641c-4386-83e9-f5dde7547c0e", "comment": "Malware payload", "value": "c642dea006346c7c4e9644b128440a43", "object_relation": "md5", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153324, "uuid": "d7522675-037c-4e92-8daf-4f370708ece7", "comment": "Malware payload", "value": "a36c8ea0188ddc3ed8f06c8e352bb314bc222fef6f9baeb211cd97ac62462dec", "object_relation": "sha256", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153324, "uuid": "1213dc15-3d5a-4efc-ba98-9780428be669", "comment": "Malware payload", "value": "1e864f8e4ba0d3dbe44b5954e1b0da4f29df39d0", "object_relation": "sha1", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153324, "uuid": "828721ef-4fa2-45b0-b1dc-8994052f9d51", "comment": "Malware payload", "value": "caa89e887899c561b9468625817566b8acf125773245d9f023f6017d6fa27638aee9fadc50832f0ba91ee0ae7465c88d", "object_relation": "sha3-384", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153324, "uuid": "62454f07-5e8a-4dc2-9cba-df49742b527c", "value": "T176B2E024F93E4FFBB09D7DAF6EB547AA3C8C44BB07135C6643C9E4DCA8924702561851", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153324, "uuid": "936384bf-d5d8-4933-af61-35301ca15723", "value": "384:ROKbct47XekAtQep/SUyuWKRH2Cl0F9q0cyZnITjI4VB89sxihXet/GzvtdVKp/V:Jot4LFiUYpl0F9epjISB89sxotzUp6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685153324, "uuid": "bfdf8bec-310f-49b1-b2f8-3478bee4d03a", "value": 23994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685153324, "uuid": "72560466-ba29-41cc-8115-330cf3dd1f27", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153324, "uuid": "3caafc36-1404-4a61-b6e3-fe98555331dc", "value": "May10-2023-Invoice-DocuSign.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db65d0d-fc34-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685153843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153843, "uuid": "8efb27e9-ad25-4d8b-811c-9d4b2ab07f8d", "comment": "Malware payload (Smoke Loader)", "value": "9474c7bedf7928e53d3654a93714a1a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153843, "uuid": "c9591566-2fd1-49cb-8b12-6c9869a89ca3", "comment": "Malware payload (Smoke Loader)", "value": "a4a4d3f4f4152c5a00f03f56b2f8e73392f7de2b3fd8a0c7e8bfda533d7a66b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153843, "uuid": "26e511ad-96ed-4891-923c-2162cb670083", "comment": "Malware payload (Smoke Loader)", "value": "a93a3f5715dca93ba4e3dde62472225b13d481ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153843, "uuid": "47be21bd-7825-4ed7-944d-3ec2b5278616", "comment": "Malware payload (Smoke Loader)", "value": "1116906b6f9d0732e50e4e9a4c50a594fb8ad930af632b15fa134db88319ca1f13dfdcf6e78f25d565c2034c0947510b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153843, "uuid": "71e915cd-b0f6-40be-8250-10741e1a1abb", "value": "T1DD543A2392E17D90E9264A739E2ED7E8771DF2544E0937652218AFEF04F017AC1B3789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153843, "uuid": "41efe28a-36a2-492c-91ce-5da353eb46dd", "value": "bd191f6a78cc98a8bbe61db18ad8e9a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153843, "uuid": "4c8aa778-b84d-4e9b-bae7-1e2828419067", "value": "3072:2j8ZJmDK0Lu/udXSlgk9n3MPW7Pazde89+/AEMBH1/StvKX54J9zuJHN2:cAJOdFdXSWRmax6AEMBV/+nJNuJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685153843, "uuid": "21d908f9-8911-45db-8f7c-09dedfacf7a0", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685153843, "uuid": "adc9df65-b2e5-44bd-80ac-59c33f4d0788", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153843, "uuid": "ba449c79-2b98-4168-aef1-5b365716454b", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d5eecc2-fca7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685203234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685203234, "uuid": "45cc3c63-fefc-4c6b-a5fa-5988348e4b0f", "comment": "Malware payload (RedLineStealer)", "value": "c91cb7852b7127d1bfac5a4c5cc8ed0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685203234, "uuid": "90487ea3-dab8-4be7-bab7-44f4b82c92f5", "comment": "Malware payload (RedLineStealer)", "value": "a4ef8452671e67065db2373e5954dd3a0ac5cd6a85ad9be032eb1538d888fc07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685203234, "uuid": "034054d8-49cd-4a4c-bf2e-48b3d970951a", "comment": "Malware payload (RedLineStealer)", "value": "34c7b65076353671e8ac42ef76a7a63913c7c1c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685203234, "uuid": "0ae6b867-d9bf-4eec-ae3b-66df335095c8", "comment": "Malware payload (RedLineStealer)", "value": "5011de1a7a28c261a0034aaa54ef507f9f8f5d822a45d0f1860391e5c774aca993ac0faf0ab7acd48d63959c889e0f01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685203234, "uuid": "711f4ff9-1605-4243-a8ea-b411fb5301c0", "value": "T16CF42323F3E88071D8B52BB45CF307930A35BC514EB9531737846A995C726E8A5BA33B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685203234, "uuid": "0f2e580f-dec6-489f-8e6f-7f57334ec177", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685203234, "uuid": "46c19b04-8726-472d-a759-ea7fab07a578", "value": "12288:yMr1y90CT7/FUS79b1oprwPLA5dbLsFqFaw01v9xXWvPwt0K5jBFwK2NodmgAk2S:fyvUSHgGqF4gFa99sv/NK5sk7n66gDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685203234, "uuid": "f3484e27-6bf2-4873-b7ec-833d9861619b", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685203234, "uuid": "a0db68dc-d564-4906-b0ae-8dcd619c5ed4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685203234, "uuid": "c07b44f6-6bd9-4759-810f-e8e3443f6cf3", "value": "c91cb7852b7127d1bfac5a4c5cc8ed0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1467a362-fc7f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685185825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685185825, "uuid": "fbf1c756-849d-403c-97b8-ad6a4bbe8316", "comment": "Malware payload (RedLineStealer)", "value": "bd4ac78d250485733476ff8c6ff606a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685185825, "uuid": "b4908e26-aaf6-45ac-8053-ee2a22006b3f", "comment": "Malware payload (RedLineStealer)", "value": "a5993a7804ee3b2b2bacac43c8594c034aa4c6762606c09dd3a3f913bfaf78d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685185825, "uuid": "2f3cf247-e9ac-47b2-83fc-1e7eb13cc1d2", "comment": "Malware payload (RedLineStealer)", "value": "edd9d7b907450997165906679498ec2b95bed03b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685185825, "uuid": "49a5f659-4554-4e3d-afa8-3c5a0a5a7340", "comment": "Malware payload (RedLineStealer)", "value": "22bcaa6082560bd5b67ace0aa8ba6c9aef55e15570a1f40138ab9e1eb7f46c82246517d00596ea6c38ba83288a68949a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685185825, "uuid": "2572b037-1acb-4676-afaa-85b52aadc48c", "value": "T1B9F42313BBD98553EDF12BB048FA07C30B3ABDA3DD64825B2B8589570DB2645993073E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685185825, "uuid": "75b04eb6-7f19-438c-9523-4ac5c4db9ce1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685185825, "uuid": "6b70e6d7-4114-4bc1-b205-2d26baab481a", "value": "12288:cMrhy90WyllxxK30xclVx8lvxWx7t6AqrQujFm8T9w3+dULk3NTdSQRb:lytq8x85W3/qDFm8NIk3fSQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685185825, "uuid": "c80b46f9-7129-4753-8e4d-61a98ef90ac9", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685185825, "uuid": "da71d878-a7af-428a-a9fd-0d319b91ddd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685185825, "uuid": "fd975d1b-886e-4cba-87e8-a6492e7cfeb3", "value": "bd4ac78d250485733476ff8c6ff606a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9257c0-fc6a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685176822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176822, "uuid": "22ecbcc9-c6d1-4c2e-acc3-12843f231cb4", "comment": "Malware payload (RedLineStealer)", "value": "8265b661215a9b4701ee031825aa51f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176822, "uuid": "8e0fbcb7-8d97-4261-bb64-0be02673f385", "comment": "Malware payload (RedLineStealer)", "value": "a59cde2afb692efa87a8d4b70f86a6b3ab5e311fcbe5519be47fc805f1e3dad8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176822, "uuid": "0bbbf78e-b5db-4151-9014-075280afe26e", "comment": "Malware payload (RedLineStealer)", "value": "b5ae6462b2e29ec96c452785a57532e9fe5085eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176822, "uuid": "19956163-3b19-47bf-9f9e-f784c405c409", "comment": "Malware payload (RedLineStealer)", "value": "53f5dbc40ef6dcf16d5b1baabf90b26e8cfd00dfe6c6a3e7c0959d4e7902f22276b246e946c6e0f2fb2804f09b0974d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176822, "uuid": "9c90a665-2d46-497e-a55a-165043f2614f", "value": "T12CF42283A6E48133D9F917B02DF602D30B367CE58DB9462B6B47994A1CF2694BC70367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176822, "uuid": "ebef6e93-5ff5-4760-9aed-87cf4bd08759", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176822, "uuid": "ea5e6eca-8b0c-406b-be7c-722f99bc1616", "value": "12288:RMrJy90DOnyoThLYHyJS0gG/InV+PmNs8MbBW2UY8l9g3+K0Lk3NTbS3MF:gyKOny+1zoS/aKmNKtW2UY8XPk35S8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685176822, "uuid": "c7b87679-d4f9-40a6-b1d1-01769bee89df", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685176822, "uuid": "8e02b0b7-4e2d-42ac-819b-5e7bcbbc2eb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176822, "uuid": "81052855-5647-4f3a-aa46-5dad82b3b4be", "value": "8265b661215a9b4701ee031825aa51f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69eb1b32-fc34-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1685153756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153756, "uuid": "320575c1-3906-4fec-b18e-9f581d3a0027", "comment": "Malware payload (Stop)", "value": "ceab39bf650263391746697917a1338a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153756, "uuid": "49235a11-4a25-40ef-8bfb-35b5fc2f1512", "comment": "Malware payload (Stop)", "value": "a5b31ba24b4f2fff4a559084e8efe01a379ccd53ef0368656d2ba9d198e16466", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153756, "uuid": "a6457517-9a40-4933-9434-e2a54d863f15", "comment": "Malware payload (Stop)", "value": "f801cbfa3bfcded7c10f99e4b372b0c567ece25c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153756, "uuid": "4a1c8e65-4f4f-4ad4-a560-ffccea26a0e8", "comment": "Malware payload (Stop)", "value": "9392a0af60541849a7c0c19f50dcf25e886ff0a9999af253520d102bb0cb87d8fa2b9d1fc1a58d4074cb5fb8127333c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153756, "uuid": "b2a14c96-52ea-4162-b267-6d28248b76b0", "value": "T17505E053A3E17D95E9264A339E2EC6E8371EF7588E193B6621189EDF14F00B2D173381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153756, "uuid": "925d2d56-7993-439d-bdc9-407457abbe48", "value": "bd191f6a78cc98a8bbe61db18ad8e9a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153756, "uuid": "755ecf79-de21-43b2-b37f-f69b4e596f8e", "value": "24576:l2RPnFbGosfuKn2F3gGO/0ZtUjrpLGK7Y:QPxGosfNas8ZmjZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685153756, "uuid": "49ba7007-dd89-4f7c-b02d-9ae070bff5d2", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685153756, "uuid": "8f4df3ae-fc3e-4a32-995b-68d2d0f9d64f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153756, "uuid": "997c2e56-c2f3-4c84-9140-6f636141eb1b", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e96eaef-fc73-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685180768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685180768, "uuid": "d213b58f-2f1e-4454-8627-6a3fd9d321b7", "comment": "Malware payload", "value": "c5d00da17262165b5dcefef37f45a900", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685180768, "uuid": "ea5cabc4-748e-456b-b9d4-851ec81078ed", "comment": "Malware payload", "value": "a6e8af6519ec46204bc61cfd01ec065f5f332fa2d853a1857996d620c0006aee", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685180768, "uuid": "03437d43-b83b-4c51-9ed8-051b14e22763", "comment": "Malware payload", "value": "94ef51088a7fa4937c0f4860256b7c0dc79537f7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685180768, "uuid": "8461789d-e867-48f2-8c4b-15407b4f7603", "comment": "Malware payload", "value": "88fb49e4b7f0b84ae976f6008c2293cd2a434d94cf470ee5c2ed03ecca856dba57fdf452f0c88d376a28d9d3feade867", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685180768, "uuid": "b63a9cbc-1330-463f-b001-7424d818c7cf", "value": "T1E3173347E72AB45AD5EF1231C672844725DF8FF44A818381BD29F3AD06FBAC44B01AE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685180768, "uuid": "a041d8fc-5e20-4416-8e5c-f80f48357231", "value": "393216:qSKP32esuoZrERzBTLML3UZUjHHZBgO3e/AHVQGOT/QgkPJeT+x7oyE:hKPJoRERtnMLEZUjDXwsVQT/QgkPJgEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685180768, "uuid": "d9cda409-dbca-45a5-a02d-271f1f6ff723", "value": 18529786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685180768, "uuid": "f2a9e9e0-7e50-490c-a0e7-445adb90417a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685180768, "uuid": "86a5f5ef-ce4b-4d77-8ef4-096f0bf3d049", "value": "com.arisina.miya.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c378952-fc7f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1685185945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685185945, "uuid": "5ec67ad0-ac26-4e06-a5de-12c890735417", "comment": "Malware payload (DCRat)", "value": "c246e9024a70360607d9b4ac79a46b67", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685185945, "uuid": "5251605b-1be3-449c-aad6-7b025163e42f", "comment": "Malware payload (DCRat)", "value": "a77a1931d350c7ea71868bc6050276352ec91d322aebac8c8b2b68c95e8cfefd", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685185945, "uuid": "0313ac6e-f540-44c2-bf1e-41b52a16269e", "comment": "Malware payload (DCRat)", "value": "b21023c5fd01f3f8493f165a1beba532437e8513", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685185945, "uuid": "b33a18b2-825e-4a45-b22e-d7c10d72d2b0", "comment": "Malware payload (DCRat)", "value": "47e4ece4c6c1675a003b08b857f8975c15a32150856b1b0c640de2289bdd9cb529a1ebad908e7ee41c4c4a96e8224603", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685185945, "uuid": "8bca6e64-4a21-4317-8625-c5383caa7fa2", "value": "T10C235D4037988136F2BD4BB4ADF3E2458676D26B6903CA5D6CC814EA1F13BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685185945, "uuid": "2f761404-0136-4322-9efc-588e1bf500de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685185945, "uuid": "fb1ebcb7-2565-456f-8f45-35124faffa41", "value": "768:Xg3d9ILWN6y+8i9telDSN+iV08YbygeOwEvEgK/JHZVc6KN:w34N9tKDs4zb1VnkJHZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685185945, "uuid": "bf6086ca-8f83-424c-88e6-21ff6b11c4ea", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685185945, "uuid": "5dab1636-c9d8-4a2a-8eec-95e40702f009", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685185945, "uuid": "0cd34a7f-ba9d-40cd-8804-e4fb6f45e329", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2ea043-fc8f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1685193032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685193032, "uuid": "520c4830-60bd-4894-a368-a113a9114242", "comment": "Malware payload (QuasarRAT)", "value": "a6c317dcb5b9f43c26d53121a696eadb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685193032, "uuid": "1b4bd0d1-e622-4b93-97dd-b0b727c0ecbc", "comment": "Malware payload (QuasarRAT)", "value": "a7e7d00dbcfded8345042410b362d04338fa33dea700a9cdf18679578f6d51af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685193032, "uuid": "6ff892fe-46ba-4657-b403-e457aec431a4", "comment": "Malware payload (QuasarRAT)", "value": "10516eb3ed753b9f224f2170da50cde5f0e32d2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685193032, "uuid": "44423b0c-a7e2-4b22-b45a-8021db92570f", "comment": "Malware payload (QuasarRAT)", "value": "e0077d72da64f2838d1e2d1a4a4c240cfaab56f98317f4ecc1a95e1bdcef13d42270758f160e8f0c309e7f7fa214b64c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685193032, "uuid": "7a9961da-962f-4095-ab99-0d7bca3d6daf", "value": "T1ECE56B0437F85E33E56BD2B3D5B05022A3F1E82AF363EB1B519167BE1C53B5488426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685193032, "uuid": "cf43b4e7-f213-4933-b040-09cae8d6f39e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685193032, "uuid": "25a8c448-2da7-4461-a47b-3629d2a788db", "value": "49152:bvyI22SsaNYfdPBldt698dBcjHsRu6nBxHOoGdG5MbOTHHB72eh2NT:bvf22SsaNYfdPBldt6+dBcjHf6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685193032, "uuid": "1849d331-0bb0-4013-a1bc-a6475488ff42", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685193032, "uuid": "bbdbafae-bc83-4784-a243-667f48a8cffb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685193032, "uuid": "ae1319b9-848b-47b6-a5ff-58d5c1fba8d7", "value": "a6c317dcb5b9f43c26d53121a696eadb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e7b7a57-fcc7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685216739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685216739, "uuid": "6166567a-0e0e-467c-bcff-40ebd4bc4eee", "comment": "Malware payload (Amadey)", "value": "abce72ebfd8744407c0808faab3037d3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685216739, "uuid": "5adb6f8a-5cb7-4c6e-ba8c-f5e57160a05a", "comment": "Malware payload (Amadey)", "value": "a7ec85652cd9b80a544cd9001a00e2d7f41dcc9f72498da59ee79a02b5ae7aba", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685216739, "uuid": "8f80a8b2-06ae-4424-a5f3-580d4ceabf4c", "comment": "Malware payload (Amadey)", "value": "9c49a41845832e58e597ef97430cbb4fa3937aa5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685216739, "uuid": "db962281-a91c-4082-9fa5-c3f68adb37b6", "comment": "Malware payload (Amadey)", "value": "a288843e0bc895bba143715f9b40ff5de1ef6caf7419257ba24f5d7fb3af882ee189039edea3bf76d49ed8f8b3e798f9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685216739, "uuid": "94a0935c-e560-47d0-89ed-ec8447017a57", "value": "T19EF41212B3F5A833C5B527B02DFB02C31A34BC95897C976A278AA95E1D327D45837327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685216739, "uuid": "3387e2d0-9391-4fb2-839a-5ecccb9dd20a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685216739, "uuid": "19c50e99-1045-4194-9355-a2dc3ab6a616", "value": "12288:FMrTy90s3shiKarex27TR4bIRWL7YP+HunplvzRqxfrYxKDd14GY:OyH3CiKC3rm7YgunpNzRkUgwGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685216739, "uuid": "b1f6993c-de48-43af-8c92-80eaf0f9e093", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685216739, "uuid": "7b3ac17d-446b-43c1-aceb-a0becf89ef05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685216739, "uuid": "cb50db11-4488-4fc2-a494-8205dbab83d2", "value": "abce72ebfd8744407c0808faab3037d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f95384-fcde-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685226898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685226898, "uuid": "ca68cec6-69a7-457a-86a4-4f748cc87c07", "comment": "Malware payload", "value": "0c8e88877383ccd23a755f429006b437", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685226898, "uuid": "8efcab84-ef3d-46de-b711-7e1641d95b41", "comment": "Malware payload", "value": "a864282fea5a536510ae86c77ce46f7827687783628e4f2ceb5bf2c41b8cd3c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685226898, "uuid": "597950da-1412-44ba-b5a1-6565a56ecb00", "comment": "Malware payload", "value": "69b3d913a3967153d1e91ba1a31ebed839b297ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685226898, "uuid": "a5fd8719-7c28-4de4-aef7-b223dc948da1", "comment": "Malware payload", "value": "ff5a316620968d67dfc19ed58fc468377136e413be3aee77ee3fac5a359dc0e9666e30070cf9a092c0ae9bf647e67b7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685226898, "uuid": "58a21b87-277f-4aa0-be41-27fc3f849094", "value": "T1EA458E84F742FCFDD59A42B406D7131793BAF480A719FB272650FE38091AB906EA3B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685226898, "uuid": "ec9af27b-4dd9-4f26-ad91-c37fb9ee6b1f", "value": "f6da1794eea7809ac5969477dbb4fa70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685226898, "uuid": "91f743f9-2ad3-4d64-bf48-0138d608cf73", "value": "24576:utP7hdO1s6Skscec1SgnyN9HPFCCNhQI6GOfaFVIVrYwcMavDiZn3m75/J7:gLO1qkscec0gnyN9HPFCCNSI6GOfaFVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685226898, "uuid": "f9c1f40a-d1bd-46ca-9c28-4a7cf1c524a2", "value": 1261752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685226898, "uuid": "4933495a-2312-47ba-b8df-b08dbbbd8a1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685226898, "uuid": "45d4574c-1a64-433c-9196-13872fb94bbb", "value": "3pckfwua", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f65a7687-fc2d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1685150985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685150985, "uuid": "3ff0228f-a1cb-4350-aab9-fff8342828fc", "comment": "Malware payload (AsyncRAT)", "value": "25344f4f54ec2afff00c28ca9c2a1818", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685150985, "uuid": "10db869f-10f3-404e-b929-ab9381b72316", "comment": "Malware payload (AsyncRAT)", "value": "ab43a51e3aeeb62be9d7c78800f45557b0131add4a882cf63f6c02e1c4421846", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685150985, "uuid": "7b937f93-4bfc-4ec5-9fa0-f771f86d652b", "comment": "Malware payload (AsyncRAT)", "value": "0df15c261a110d3a32a61b919a1b30e15d48ebab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685150985, "uuid": "bf1429b2-3349-4f8e-ba04-c3661a26edaf", "comment": "Malware payload (AsyncRAT)", "value": "bcbed852bbef5cb16e9264bb1649ec220302b5228a5a3663398433e1e7fb84e6ead748b1c3712b0f5e13992b83df39e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685150985, "uuid": "7cb09584-8fe4-4353-8308-a9bbb68dfb81", "value": "T111E3CFF9362E8D90D5F31F3AE370A9BCF4E9AE90F642A0E0338A75D113892706D1556D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685150985, "uuid": "6fd6e2ce-8e4a-4e60-873c-4d75b50e2982", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685150985, "uuid": "db1ed9b2-4662-44f0-a088-9772d0441548", "value": "3072:KT4TeHj43Erh/LQo8F7FG0cAKOXN9l4necXq23zppMNPI7CVh:KUaj0SLb07FNvKOXDl4nzpwPI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685150985, "uuid": "d2ae7d0d-7f17-41aa-968c-2f2d9b5b9399", "value": 144896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685150985, "uuid": "bbd151d5-3854-455e-bce1-3a423355b873", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685150985, "uuid": "ec7c544f-da28-4c2b-ab52-e754aecf4d38", "value": "25344f4f54ec2afff00c28ca9c2a1818", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59c5128-fc58-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685169318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169318, "uuid": "c505b30d-211b-4fa8-b119-de7d7d8ae47a", "comment": "Malware payload (RedLineStealer)", "value": "874d0ad2701a3bb9ad61515b20ac8889", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169318, "uuid": "5e6ad711-195c-4139-b31c-4ba8dcef808b", "comment": "Malware payload (RedLineStealer)", "value": "acc1a732fd108b8cf44c27a1bcbfe1a99db91839c04f5e124256f731bf34db7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169318, "uuid": "df6ec1dd-662c-4209-8002-f2a16ac6b0e0", "comment": "Malware payload (RedLineStealer)", "value": "899cd714da27a8e6bd619356995fd2ecfef2a403", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169318, "uuid": "1bc529ba-f3f6-48ac-b4da-3b5ef25befb4", "comment": "Malware payload (RedLineStealer)", "value": "9b807cdea1db87336063e411d370001b396b759028479aa013191be42655f45ccc57e963b00fd5e47aefffae1d715c61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169318, "uuid": "e2c1fd5a-5709-44ec-b459-7d72bfb7f23b", "value": "T1D4F4226377D88132E9B117B028F247D30B3A7DE19968D75B2385997908B3AC5B8B0377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169318, "uuid": "eb9a9a11-7f7b-4739-a585-0653cc60c945", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169318, "uuid": "92e842c8-cd38-4428-a50a-5ca0ffa9446c", "value": "12288:4Mryy90ivlF5Iq0y8S1dt3NNkppk10HeEPAZrY8l9M3+s0Lk3NTtSJa:qyvvl/Kyrdt3Na+HEPANY8Lhk3jSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169318, "uuid": "5500df87-652c-42f5-9337-326adad3e6a3", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169318, "uuid": "9a84c63e-c1a4-41a5-b87a-06648f9d2d72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169318, "uuid": "845341fd-f0be-4e83-bceb-e05790894b9c", "value": "874d0ad2701a3bb9ad61515b20ac8889.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f8fffa-fc35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1685154018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154018, "uuid": "16ee5296-13b0-4d24-af76-c3973c1cb98a", "comment": "Malware payload (Fabookie)", "value": "b2efcc4247bfffe4a6a09b4b66b20e33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154018, "uuid": "b56f6f69-f5b5-4c3f-ba8d-ea143f722697", "comment": "Malware payload (Fabookie)", "value": "ad94eed4366e551f560d769134f0fd351a8ee9d5cec143316210659d0142f9b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154018, "uuid": "6f5cedef-ab36-449d-b34a-81ada7f6a403", "comment": "Malware payload (Fabookie)", "value": "7670168decc098bfaa6c1f0feee1675609ebb382", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154018, "uuid": "9e4b0662-5f70-4a4d-b88f-681c5285bf48", "comment": "Malware payload (Fabookie)", "value": "ec5ebb505925eca71837b983771fd12d364f771e267502433b4af28e51ac51e372aa94c1fc7992fc9f11e3a79bdb4c5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154018, "uuid": "31c2aae1-10a5-4294-89ad-cd52cc665a5c", "value": "T1C654291392E17D94E9268B739E1EC6EC771DF6548F0937692218AAEF04F02B2D173790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154018, "uuid": "f4b1d126-d375-4d8e-8ab5-d410bbe294dc", "value": "5ea1866af0e097b7b73a6d1cadb8810b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154018, "uuid": "7d8562ea-0f5f-42ed-8630-e09dd53722c7", "value": "3072:Y1Cpgxl1bmnuCzQhgAeaoOoi+4+8lHNbLRI5zjiznOV0G5or9Zt2N:YKglFFcDRpmh+93Or", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685154018, "uuid": "e3d53ac2-9d41-4c58-9604-953a9e585d76", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685154018, "uuid": "6689d2e9-b197-41b3-bc64-53ca1ef60963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154018, "uuid": "98bc1ae7-01d5-4ec7-83aa-414da5d48c12", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4784885-fc58-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685169316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169316, "uuid": "d5c1d754-889f-4490-99d1-70d36c3308c4", "comment": "Malware payload (Amadey)", "value": "9d200b0387de1e398da83520462f3239", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169316, "uuid": "4e485cf4-4729-48b5-9a02-c780202c218b", "comment": "Malware payload (Amadey)", "value": "ae0dfbf89886ecefb560bf41dc7132465d564734b136a1f62a06ecc2415f352d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169316, "uuid": "6ee77f59-ac37-453e-804c-84e2f305042b", "comment": "Malware payload (Amadey)", "value": "315ac45245576945aa8cb20edc302fd5b4013875", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169316, "uuid": "5defa601-b032-4a9c-8939-12e01aaf23ea", "comment": "Malware payload (Amadey)", "value": "74302c4b07b92d4465ed6eebb1891b05683ad5fd1ddba32e94cbd83037233fe44bc9173d02982c835ecc9c754da79c67", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169316, "uuid": "0f47166f-e537-4c2e-9869-22af746ac0de", "value": "T137F41363B7E58532E9721B3115F303D31B3A7CE2DD78426B138598AB18B3286687537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169316, "uuid": "f05d9567-00ea-47d7-8294-05d5406a6dc5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169316, "uuid": "8f309204-6f17-49bd-88c6-83b614641d24", "value": "24576:LyBRq/3Jet2S3Y3Hrjk3U7WKXkUK8tUk3aSrjeJ:+B43otlg/kFI0yHdve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169316, "uuid": "35a9d7f5-ff83-4ddf-9859-312880f2ff55", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169316, "uuid": "5699fcbb-5dd7-4712-adb1-66d7913a1420", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169316, "uuid": "c000feae-9d31-4bb3-8d09-a6158f9e35c6", "value": "9d200b0387de1e398da83520462f3239.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f90436f5-fc59-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685169887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169887, "uuid": "d7cf786c-50a7-46b4-a683-0802fe9ee087", "comment": "Malware payload", "value": "cb14599be1244383f956b5217741dd07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169887, "uuid": "13111b4e-224e-45fc-b294-b9a61302726e", "comment": "Malware payload", "value": "ae6d04788360a1bee982e06ac93f0bbce04c0b8c4b754a57f2f1385519d6c721", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169887, "uuid": "b7f31b68-ca1a-4dba-8a85-7033b2428f00", "comment": "Malware payload", "value": "594723a7a51e5cd76a4a8de27dcc41b2b102eff8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169887, "uuid": "49cb2ffe-0532-4ef4-a854-11e7ed284a9a", "comment": "Malware payload", "value": "48ca7782ecfd6d7b2c5f05e03f5837e30eaf15908e40422714d54d5ff0d1c6711a1a62a2d85ad60b44f8d6813d69265d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169887, "uuid": "b87cdc5d-bfc8-4ca4-b74e-8df5ab4e2171", "value": "T152B522816BBD8990F1F7AD55A1F64FA3580E75584C698404826832EF7C7BFDAEE30207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169887, "uuid": "934f15be-f72a-49ab-a64c-4bfa180a7e7e", "value": "49152:1ZRiYmI5cMYNFMEDsGLKxkQARvBG7y3rWb+:1ZR9hYFMog/ABByy7Wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169887, "uuid": "cf3d5240-6f96-47d3-bda9-b0cd2d194562", "value": 2367843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169887, "uuid": "0afcdf27-8cb8-4ea3-98df-f52c09693b47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169887, "uuid": "27999b59-60fa-44f4-ba6d-e5374a7f3bbe", "value": "cb14599be1244383f956b5217741dd07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d0c9a02-fc67-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685175585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685175585, "uuid": "a6664651-114e-47e7-b21c-d8a431010804", "comment": "Malware payload", "value": "12838e82541973a0e63820a421d4b8f6", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685175585, "uuid": "78f1ecfd-7652-4a97-adf2-3ccea1b9c54d", "comment": "Malware payload", "value": "b146dd7f30d4ed7536f62fae414f34f45ca32173224ad3b4bc0a14651108b1ba", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685175585, "uuid": "8b5faa7d-cdf0-4983-a710-17f29e2b5fd9", "comment": "Malware payload", "value": "6cca7441a420f3d3082f6787abeb6c5a6d9ae99b", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685175585, "uuid": "ee6b851e-6f52-474d-ba38-f100de39e575", "comment": "Malware payload", "value": "b57de2b1ec841516e2443f5f850883552aadef9ccc4a290ebf5f839a7636dce16cafaec6da1103c83fbfe8b4708d5b5b", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685175585, "uuid": "3fc491b4-7247-47ec-931d-bf2a2e41e0d4", "value": "T1A741CB7CCF69F8E0033DB0A088492E2620949E57D6B58E24D9574EE62D7C20ACF2B18C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685175585, "uuid": "393c2f83-6b86-4c2f-bc3e-55e49d6d48cf", "value": "48:LGfEFWuJqs9HZNjd+SfprcKyK0hE6S1FtfsC5P3RX5ZWiaoIhSNtV:LGfEFW87jd+Sfpbaq6S1FtfsC5P39Efs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685175585, "uuid": "4c85b929-ad4a-42db-aa54-80e1b545212f", "value": 2219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685175585, "uuid": "6cdb9ae8-de4e-4260-8a02-8a120f4cd9a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685175585, "uuid": "fbee61aa-5082-4f4b-b9be-cd56acc0708a", "value": "6471bc8dac218.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f2f547-fc67-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685175575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685175575, "uuid": "3e8728f5-263f-4e70-a108-13128b3d74ef", "comment": "Malware payload", "value": "2bf18395638967388a293626e977ec05", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685175575, "uuid": "b77e697b-0018-441a-ab8e-3a04d9ccf3e9", "comment": "Malware payload", "value": "b2069732f98d91fc2b2814c687115ab927191a0db26dd21a9ac0f7f79a65672b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685175575, "uuid": "babccb46-32c4-490c-905e-c71704564821", "comment": "Malware payload", "value": "c8534f92211399f890e3757da136c899f14b53b3", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685175575, "uuid": "2c59559f-191e-49fa-9f84-e45b6b8c73c0", "comment": "Malware payload", "value": "caaf8675813c4c8d8cabd1603a071d79e13acf45c6d8f9753da530bfcf27a42bbb3c962f1777585bc4a27ed6ab4098c4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685175575, "uuid": "3ed3cead-1969-460a-9cc8-a3e07d887f35", "value": "T1F6319C5E371A800A50FEC8E1E256C01EF20EB597C54CA2C9738A596BA3F5CC5329F45A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685175575, "uuid": "0d1414a0-65fa-4d88-8495-a115e46b50eb", "value": "12:CQsKWK9c4uzOvvKz9s6tcUDDdleCEDhzVAmTuFuhfJu7vFFeleCEDhzXQDvFuhfE:CQ5WKa9VzW62UD2u876UL8n/08KLzc3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685175575, "uuid": "bd58100e-e8d0-4e3c-ba20-5c0781892980", "value": 1669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685175575, "uuid": "721d8ce7-a574-4345-9e09-38663d182e23", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685175575, "uuid": "94eac41c-fcf1-4379-b3a4-5dc6c60ca62d", "value": "11.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b160760-fc6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1685177810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177810, "uuid": "37e125cb-7a7b-49db-b692-8034391f97f4", "comment": "Malware payload (ArkeiStealer)", "value": "0c6c4a34cd3bd4465be8f1adb570d559", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177810, "uuid": "a79dec36-2851-4e09-8da0-590fb36f3b76", "comment": "Malware payload (ArkeiStealer)", "value": "b37ec988b2a33b8da250f693d73a8eeda60965bec127db92b4298cbc6dd9efb2", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177810, "uuid": "e526225d-5522-42ac-88be-72230e494898", "comment": "Malware payload (ArkeiStealer)", "value": "b1607869c4afa9da49555ad5ab757c4f29ca0cb9", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177810, "uuid": "38b95ab5-923b-44c1-989b-ea87a663da64", "comment": "Malware payload (ArkeiStealer)", "value": "611e10c63c389567fa75d35e21a3bac98eccc558dc206a3d4468d5d74575d5a425125256491bd78e31c937210cf42ec0", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177810, "uuid": "8992ca1e-a739-416f-8f26-8bc4b78ca511", "value": "T124948D0392E17D54E9264B339E2EC6E8771EF6546E093B6A62185FEF04F01B2D1B3781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177810, "uuid": "abf75ef4-7cdf-43f6-bcce-98c91cc34ecc", "value": "697c6731df2df92c82c75859d21c5f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177810, "uuid": "6800674f-03e9-4213-a1dc-a0b15228cd63", "value": "6144:avNHLiq4qWWu3nVhzYnjTtWPHdoXYMH9UbeK8ZSl:avt2EQnV5iWPHdoXYA9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685177810, "uuid": "b4db29a3-d240-455f-a158-61551cc325ef", "value": 413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685177810, "uuid": "2fb17343-6a28-4889-8655-9b32053dcb1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177810, "uuid": "796a396a-bc5e-4056-8404-3f539e13daa8", "value": "02296399.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9725fef3-fc28-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685148678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685148678, "uuid": "fd4862e1-ff93-4441-8553-04aa5df57b40", "comment": "Malware payload (Mirai)", "value": "afe5b1498b69b100e393b4e9e76ac9f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685148678, "uuid": "14f4344b-a3ae-45d1-bdc4-985cf081d51a", "comment": "Malware payload (Mirai)", "value": "b5e8cfd57a3b7c5279294ccf295dcc32d6fd060e1ec702b8b6aa4a273ebfb33f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685148678, "uuid": "b0f69078-86b6-4988-879d-a38fa518b4fb", "comment": "Malware payload (Mirai)", "value": "5060c9587f4e86eb36c988f1b03f11488a692208", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685148678, "uuid": "b3c34038-e159-4b8c-b13d-68a03d77c2fd", "comment": "Malware payload (Mirai)", "value": "e0d34913d75f017c73e8d75be7780ea15fbbde1be83f72ffa2486d20f3e56991526a4885cc4875a978d9d1020dd713d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685148678, "uuid": "f87a4962-ac14-422f-ae67-087312a5a284", "value": "T157836B21BA392E1BC4E4A43B22F74750B2F1574E26E8CA4E7C720E8EFF2194465536F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685148678, "uuid": "6111890b-10cb-48bc-9bf9-0684c911cf00", "value": "1536:BWl+3c2ipmJopPo18bMzu82tPxHhVT5DtFAa:NcM6PjVNrAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685148678, "uuid": "7aeddbae-a451-4f21-8b97-a5323939ff2d", "value": 83264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685148678, "uuid": "c845324b-4347-4342-a4c6-acb487b612a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685148678, "uuid": "74a942ff-36b2-478e-94c1-500fa32ea18f", "value": "afe5b1498b69b100e393b4e9e76ac9f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8441555-fc8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685191683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191683, "uuid": "b2e02fe8-2c2e-431f-af8e-0fbc60efb7df", "comment": "Malware payload", "value": "637ffb755ded6b43a1d5f66fc5a9ab5a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191683, "uuid": "e63c4591-5d02-475a-8309-a9581db9ea3e", "comment": "Malware payload", "value": "b6b173eb6d5728eaf2005277946e33a86efd9806544d3550ca9547063cab8788", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191683, "uuid": "5d4b31ab-f2a2-4972-bcf4-31b137761a7c", "comment": "Malware payload", "value": "8b0767b82eb6bf62c760790b389b219f57980f3a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191683, "uuid": "8b76cd65-9b02-4025-a6c4-595b475ecb7c", "comment": "Malware payload", "value": "4eb0b3ea162ceaba4e9bf8666e521155b2e0cbcad9ad9ef2330113e55a30911370bb74f6801e45431c7f64e025995033", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191683, "uuid": "c5799e7a-51c2-4f5e-8a2d-52e8b4a51466", "value": "T180E065CF459448810808CFDFB7120D158445E5EC45DBAF0A3CC60667C88C71C3950F8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191683, "uuid": "6d65f7e9-dc13-480c-af58-a7506e9ff893", "value": "12:iWKrpNkcXInyKNkcXIHSIjNkcXIximzjNkcXI4J:DKkcqkchKkcwzxkcPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685191683, "uuid": "8dc3fd0b-5aa5-4302-a5ce-c7a6ca8d1327", "value": 403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685191683, "uuid": "dc4bb757-220d-44ae-9e00-3bfec5c06123", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191683, "uuid": "7fc89dcc-f3ad-4f1c-861c-eb86540f3161", "value": "j", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de71eb5-fc5a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685169922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169922, "uuid": "20151d7e-f9e4-4af4-8ade-8018285b0e7d", "comment": "Malware payload (RedLineStealer)", "value": "ed09bcb617a96719be727279a86c4a2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169922, "uuid": "ef54eb2f-1a04-4fe8-b058-fc7c0b5adc1c", "comment": "Malware payload (RedLineStealer)", "value": "b6b1bfd726b0a6fa06c4d77634d4bf12bc878113f881bf2e813e4981f5def520", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169922, "uuid": "30ff330c-d28f-42de-a06a-08e7986509b1", "comment": "Malware payload (RedLineStealer)", "value": "03a7ed0fda0d8e5b79dc15715312e3f54edf3d35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169922, "uuid": "afb9427b-5035-4ab4-936c-e1cfaf126968", "comment": "Malware payload (RedLineStealer)", "value": "e4507c15d2c966ac9fd9214384e01939e18425240e6ea04dbb3154750861f09f0391c3b8c1f4814fff0ff5d66fc6f143", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169922, "uuid": "d358d891-47e3-4477-bdd5-fef20f575d78", "value": "T177F42343EBC40477EAB617B068FA06C70B397DA68E7CC36F5745C91A2CB16A5A471332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169922, "uuid": "8feac39e-53ae-4855-9c76-1ebb4e19c56f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169922, "uuid": "36960adb-7a48-4f8b-a11f-4b2de9b1cc26", "value": "12288:RMrBy90qmuy3KfoDBoRYH+F2DC9YJZqxIc0VY8l9s3+00Lk3NTmSqTc9m:oy/JsQoD+RY+F2u9YJZOuY87Jk3ASdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169922, "uuid": "6e238eb7-e929-43a1-a419-c02f149d94d3", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169922, "uuid": "6f2a63c4-7821-4505-b6ae-cebbcc6f4163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169922, "uuid": "d0d62830-7310-4c3f-b9b7-c788c0420f6d", "value": "ed09bcb617a96719be727279a86c4a2a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9429d9d-fc2d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1685150963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685150963, "uuid": "01e0a538-9eb8-454e-b69a-d5db8373f05b", "comment": "Malware payload (Loki)", "value": "924352885feaaa329d4ec33b6b914de0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685150963, "uuid": "466d6fea-ce8f-4bd9-88f5-3d7af5478427", "comment": "Malware payload (Loki)", "value": "b92ced67b97f15a67cf73811af0ba832c9177cbb31322c0d23802324baacde1d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685150963, "uuid": "c8282e98-5455-4f7a-b797-cc17912bbf10", "comment": "Malware payload (Loki)", "value": "37b99d4cc332eb76262ba61db1c913684bb8f9d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685150963, "uuid": "5adbc843-911b-4828-8f66-4475c2e07be0", "comment": "Malware payload (Loki)", "value": "8d046761326a2a3e17f92d920beba9fbfb7923d22a9fd193f6cea0362038f18115a04ccd9ddd95e5b844b97b0632beb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685150963, "uuid": "706ebd71-8a2d-4af6-a19f-24ccdc66b254", "value": "T119C422082638421ED0DB0B78186475BA023B2A533523D75B3DE9B3EEDF39F152694E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685150963, "uuid": "293b88a7-9c4f-41aa-9e80-120091845fcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685150963, "uuid": "68da3a7c-eb2f-4b58-bebc-77879e55105a", "value": "12288:4GtPplTY6RhKuG5uwRBXijXpyXZa3PianyOkFrAYJ5NKX:4GJTDELhByjXp+KyOkF1bE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685150963, "uuid": "990b3363-5a86-452c-93a8-065e16b310f0", "value": 567296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685150963, "uuid": "cba2e679-f6c2-4471-bf44-e350511bd8b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685150963, "uuid": "0561fdca-9b96-41f0-9230-71b415177989", "value": "924352885feaaa329d4ec33b6b914de0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0aba03-fc61-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685173219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173219, "uuid": "393f6135-91c0-423c-a644-bedce3bb861c", "comment": "Malware payload (Amadey)", "value": "0f2eb67de0f886883c6ac2358cc3457f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173219, "uuid": "4a5c22db-9eba-425f-a349-641add22617f", "comment": "Malware payload (Amadey)", "value": "b97da34da00fa97f48d40c0643fba7bba8194307f3f775738444f93f6d863f4d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173219, "uuid": "2f690d4e-ec00-486d-b5c8-6087adbec134", "comment": "Malware payload (Amadey)", "value": "8a74b7bb1fb4f9380266dad2857f1ecca120937a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685173219, "uuid": "1fa3456a-fb1e-44ed-84c6-bb4627600561", "comment": "Malware payload (Amadey)", "value": "6f491757ce5cda527cfecab2f1949fc22bcd10147ee8d52d56751dcc70c51bd0c6746f181da7db46e08d8c61a474181e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173219, "uuid": "4f6f1ad1-742d-4d39-8208-11a3cc9f721a", "value": "T1CEF42352A7D85032D5781BB06CF707D31B397CA2AEB8835F2302895A2CB2795E975327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173219, "uuid": "3a75b34d-43d1-462f-8949-bf945096672d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173219, "uuid": "84be869b-5733-48af-882a-b00fa4f6f1fc", "value": "12288:oMruy90U5aj1SU+0yU6UTYMPepIDHgWw6/gh2f7UK8f9X3+zJLk3NTcSXA:2yHMjnyZ20IDH7w2gu7UK8gxk3CSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685173219, "uuid": "656c4f10-7159-44be-bd65-7043659a9437", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685173219, "uuid": "7f23736b-0301-4ddc-92a1-bf8478a18f2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685173219, "uuid": "c2df8383-e2e0-4a5b-bcc9-b4a35f1a392c", "value": "0f2eb67de0f886883c6ac2358cc3457f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a26796e4-fc8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685191646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191646, "uuid": "4b56de10-2d1a-498e-b004-f0663558d7f1", "comment": "Malware payload", "value": "93d1425ae11215df1d4b0df8219bc562", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191646, "uuid": "fbc3191c-2a02-4fe0-87f6-eca049d63f36", "comment": "Malware payload", "value": "ba09a4a4bf8d3136e3ea471d7cade5f0f73c0544c3a0a9be284bfd9cb6140a2f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191646, "uuid": "c1f56cf9-199e-4fb8-b360-cd81c6f51ab9", "comment": "Malware payload", "value": "61a71e70d7d47625f437b4219bff0b7e9a8870d5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191646, "uuid": "e7f6e540-c613-4262-acff-4b1bbdfd9d58", "comment": "Malware payload", "value": "9e9ec7d6d1d6eeee48fed6678b4bff49b02eea743d0c8539abf49a61858cb8c72a31e80d7940afaa4741cf576b7586de", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191646, "uuid": "e066bd6a-875a-4d52-bd8f-4b4b14c277c4", "value": "T1EFE030CF459588800904CBDEBB120916D51BD1CC15EB9F897CC50266988C60C35D0F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191646, "uuid": "827fd94b-943c-4198-b816-60bb9326a3f8", "value": "12:iWKj1pNkF4HKNkF4HSIjNkF4HmzjNkF4Y:DOhkF4ukF4yKkF4GzxkF4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685191646, "uuid": "13923ae5-939f-4d5c-b60f-3e32570429b2", "value": 424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685191646, "uuid": "87c7931a-e4ca-46e9-a1de-c31c81e02849", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191646, "uuid": "7164cdd2-5dc7-4e5c-ad6b-8c0ddad4807c", "value": "b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c520db32-fc34-11ed-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1685153909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153909, "uuid": "072a7f9f-541e-4f3a-b281-85b9924244bf", "comment": "Malware payload (TeamBot)", "value": "4cd369fbfa75841df0d28a0b6eb64d96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153909, "uuid": "a521fbe4-f650-407b-9b6d-cc2442365315", "comment": "Malware payload (TeamBot)", "value": "bb178f666699a5eba12b4e6eb3386cba3ccb030839252eb3cf2e6fb10140c6d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153909, "uuid": "830cce63-f328-4ea7-9166-53ac97740a50", "comment": "Malware payload (TeamBot)", "value": "a1ecbb4875a09087511bdfb05b24a0f61e73b94f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153909, "uuid": "e543fac7-c06e-46cd-b462-396c021c3f6e", "comment": "Malware payload (TeamBot)", "value": "a9c12db93ddd90fe88653186e3eef7ff33b7e517163459d5764a5b46c80aa8994f0e8995b25e3b8d4f7adc16fbbbef2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153909, "uuid": "590c4adb-ed7e-4f6b-aa97-c6e84d5737e0", "value": "T1AF05D00392D17E50E5668A739E2ED6E8371EF7544E4B3B5662189FEB04F2172C2B3381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153909, "uuid": "eed457be-c80f-4183-b0b8-4a083c14007d", "value": "bd191f6a78cc98a8bbe61db18ad8e9a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153909, "uuid": "8ebb670c-b462-4e6d-a001-51f284d3ecce", "value": "24576:6HmItSfB4bEvite/dJqXLrBHI94GfslbyWBche:omqSaYvoe/dUbl8T07Bke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685153909, "uuid": "8d68ade4-8285-435e-b0de-d39b70869ed3", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685153909, "uuid": "9c9b699e-e3f2-4e12-bc4a-2c0f36c375b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153909, "uuid": "0e4487c0-8eb5-43f3-9eae-2a3998d0d4f9", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e4629b-fc86-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685188830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685188830, "uuid": "3ec7e4bd-9761-4830-b5f1-ab649c583a05", "comment": "Malware payload (RedLineStealer)", "value": "f98b61ce131d7d8aa2cb4e23243399db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685188830, "uuid": "cbecf44f-9925-4f1f-a5f1-75322ddfad52", "comment": "Malware payload (RedLineStealer)", "value": "bc58388c430c936d390ccaecb9c0767aa672692a31e9269f0b64a17535619cc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685188830, "uuid": "71a2f37c-e607-42c6-acd8-aa1e54e51393", "comment": "Malware payload (RedLineStealer)", "value": "4bfbb1c9fa000eb24812e1d2afc720e8b8c2390b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685188830, "uuid": "0a86c115-cc48-476d-a42b-83bbf7d323dc", "comment": "Malware payload (RedLineStealer)", "value": "7c6d1f0de5ae545aba405a389ea0a1c7ab0c56be625dad6d591b1326cdf9851ec58674d6b521f43b3c55b28d3588289b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685188830, "uuid": "e0a19b67-2a72-46a3-a1a3-ea902ff71508", "value": "T19BF41253A3E84432DCB1577059F307C31335FCA68DA8975B2615A8AA0DF3689B972337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685188830, "uuid": "fe7e458c-96ac-43a6-8ba6-3abdd9d9951b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685188830, "uuid": "9ed4947a-185a-4174-a95f-0afc6119220b", "value": "24576:JyMl8cbyVGwseW8Y0tw++brm8uJk36Sv:8hVGtTi8iN09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685188830, "uuid": "e71db5aa-15b3-46d8-8307-13da235aa895", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685188830, "uuid": "34d0108b-f272-4ac8-b402-9959d14ae21e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685188830, "uuid": "84152dc3-894c-4d97-8637-4232a3c14da5", "value": "f98b61ce131d7d8aa2cb4e23243399db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04df229f-fc5a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685169907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169907, "uuid": "83eed323-e9f7-450a-ab7e-345a653bd0fa", "comment": "Malware payload (RedLineStealer)", "value": "450a6e669b8102d056ce0062d4c53ca2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169907, "uuid": "4d957522-4188-4cc3-8182-6f26ac19e93f", "comment": "Malware payload (RedLineStealer)", "value": "bcc2976b84c1ca63f98f6eb708230cfdd8feceeb4db7bd527ef3c2f6c861af67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169907, "uuid": "a15cfa96-4730-4126-b82a-15d2c9d86ef6", "comment": "Malware payload (RedLineStealer)", "value": "23d79cc87999952e7857b531db80bb93baca457b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169907, "uuid": "b4841a44-206d-42f6-861a-91e1b16644c7", "comment": "Malware payload (RedLineStealer)", "value": "3f558e210b57aa91403d43153eccaa45ec49956b7edbbe9b4a5b4b5d30b6e5b9be7fa23b103eb0aad96e8be94ad29a9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169907, "uuid": "fb4bac8a-1716-4684-ba04-23f463910145", "value": "T1D7F42213AAC89172EC7127708CF603E70F35BDA39DF4866613999D9F18B2694D035B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169907, "uuid": "7207c376-c26b-462d-8d4c-872a84e43222", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169907, "uuid": "3e108626-eafb-43cf-b44e-37567bfbdfb2", "value": "24576:MyPOsZrL6RqQMeyuGJVpo5Kwj+di2b4z:7V0AeyuGrpox8ip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169907, "uuid": "6364bd53-a013-4f51-ac02-28f08cd07908", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169907, "uuid": "b2af7b18-566f-48ee-8867-12f92bf8c745", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169907, "uuid": "6fd3ea44-2163-48c4-9988-641a80fa0935", "value": "450a6e669b8102d056ce0062d4c53ca2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d06ebaf-fc2c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685150406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685150406, "uuid": "47e65317-a981-4da2-846a-101da911777f", "comment": "Malware payload (RedLineStealer)", "value": "f3ea299f7271137cfecf96f4e5d95793", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685150406, "uuid": "743bce39-bb1a-44b7-82bf-6885f70ebdf2", "comment": "Malware payload (RedLineStealer)", "value": "bdfa972772e5e39ca0278b2b100bc364d6ed2b1e0dbedc7bb50606111cad395b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685150406, "uuid": "0d44c660-1210-4cb5-a808-447154f7a46c", "comment": "Malware payload (RedLineStealer)", "value": "2d4a118eacab84e67927a23514c80431c5d746c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685150406, "uuid": "fd776d7d-a921-46f0-b759-7af11dd99e95", "comment": "Malware payload (RedLineStealer)", "value": "cee431059de272d6000ececc17fe317f569f7d0d6e11aa1ffacee82c16444533ae5b736aac46a3c27435af48c9853e2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685150406, "uuid": "20f0bb91-e3be-4134-ae93-ffcbc526e97d", "value": "T1FFA35D20679C9F19EAFD1B74B472012043F1E08A9091FB4B4DC1A4E71FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685150406, "uuid": "bd434081-2358-461b-b3c1-522466c6ec87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685150406, "uuid": "bcdcd778-6253-4c54-ab5a-3b3f4eb3df1c", "value": "1536:1qsIlqWWlbG6jejoigI/43Ywzi0Zb78ivombfexv0ujXyyed28teulgS6pg:zIReY/+zi0ZbYe1g0ujyzd8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685150406, "uuid": "a075bae1-aa44-42f2-9e80-bf47a39951ad", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685150406, "uuid": "d1d081b6-4ba6-4173-b25b-1fea8cc02414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685150406, "uuid": "3cfa144f-9142-46ec-bb1e-4690ff1a1238", "value": "f3ea299f7271137cfecf96f4e5d95793", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d3bb3a-fcc1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685214259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214259, "uuid": "d5faa992-2e54-4349-8ad9-0f4575bae522", "comment": "Malware payload (Mirai)", "value": "51402ab81d9b027afffabccfa7cbc964", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214259, "uuid": "1f53d0f0-caaa-430d-83d5-9599b7783fae", "comment": "Malware payload (Mirai)", "value": "bec94285f53aba8dac815a0d7748fbea67d574181c2dab21f70e09b9e0cad29c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214259, "uuid": "7c179ee7-4088-4045-b732-27ed244dadd0", "comment": "Malware payload (Mirai)", "value": "ceb53fda074f46bc299b85dcdb39383080aacf34", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214259, "uuid": "7ee1fd6c-1e75-4642-a3ec-e74786d92435", "comment": "Malware payload (Mirai)", "value": "1e20990fa3c4027c77c35c070396fbc2b7768ae51b1c1c8086fecea1282b26026bffd42c5cf954782faf1faeab3d1343", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214259, "uuid": "6db9d5e7-476e-4f42-b1a9-f739a86aec0e", "value": "T15813F196DD038C48C367803E401E5C67650B7EE347A26FB26B691A18F7F9B4B97236C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214259, "uuid": "f7e4d3a1-342b-4b43-b49b-0d27dc6e8014", "value": "768:cOHUBSfaWCfIcLuyr+dYL3NlFWC8NfPPcJMRfRCOvywalajaaEe0witM6Yoi1c8R:cZAfbCftuyrkO/+yMRfM0hz/Eez+q1cG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685214259, "uuid": "168cf875-c0a1-46fe-b5d7-1c4a6344aa89", "value": 44028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685214259, "uuid": "55eec486-1147-4d60-97c7-87b899e7685f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214259, "uuid": "477e66e7-3cb4-4d15-8619-6bc7fb97bb79", "value": "51402ab81d9b027afffabccfa7cbc964", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d78ba95a-fc5c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685171120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685171120, "uuid": "e671e442-7ffd-460a-80ea-71c87d807e34", "comment": "Malware payload (RedLineStealer)", "value": "f1a0d8259318efc3014036c94575179e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685171120, "uuid": "4dea4676-8fa4-429f-bcbe-b550f9cdf4c8", "comment": "Malware payload (RedLineStealer)", "value": "bee726a38c8d1ce19987ecef456cd1c6e52a77d3fcbe380439573a62c94f2c1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685171120, "uuid": "0b772005-7638-40d3-9af7-4822d3558077", "comment": "Malware payload (RedLineStealer)", "value": "017790f3090d0a37d515aefd09745623f823f957", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685171120, "uuid": "78bd4b14-4b04-4810-9283-faf478ad18cf", "comment": "Malware payload (RedLineStealer)", "value": "20cf3581712a3d748c857187ca321a55f72574524479dfb97eeed160a448eb4b2cff8fd0d0bfc85119ba0aa66168237b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685171120, "uuid": "f037aa45-075c-462a-82d3-d99f0d3d6172", "value": "T13BF41353A7F59062D8B12BF05DFA03D31A39BC725975C32A2705ADAE0CF26C1A93531B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685171120, "uuid": "4732e0dc-1272-460d-b648-e33a8e4ac182", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685171120, "uuid": "d820e1df-4469-4acb-8cd7-6ace0717eadf", "value": "24576:KyruviGm49bEIVsjbJP87BK8LY8cIk3XSN5:RcLPaIVsjbV87oL3zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685171120, "uuid": "b6b84d82-27f0-4306-a0e3-4540b55924de", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685171120, "uuid": "4dda9b7c-b194-49bc-95c6-6fae483dbff1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685171120, "uuid": "4bcef529-a02d-4f9d-b037-d50d300de559", "value": "f1a0d8259318efc3014036c94575179e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff0927d-fc59-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685169899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169899, "uuid": "2b0b7e10-78e0-459b-b7e9-a1fe20b15b44", "comment": "Malware payload", "value": "e3b3e2244d71ed56d47ff42c3fcbaeed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169899, "uuid": "aef03170-9774-483a-8b70-c1819d9f3767", "comment": "Malware payload", "value": "c00e1d7e8814cf8be74c3c34556c35ef6bb3d211098ac93e55f52e23c5087157", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169899, "uuid": "98dbbe07-8159-4375-b4d6-6ac256241226", "comment": "Malware payload", "value": "e4200343eaf76ef6dbf5473ab41394c6a1e09a2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169899, "uuid": "0fcfe90e-0b63-4371-8a2c-334532d1d857", "comment": "Malware payload", "value": "bcc047931952cafe8cdb5fb967871edaf14f976f0b479c8b9549f6f23140a53fc412cc6835cc4958c9dcd7dbe8a8825a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169899, "uuid": "175ec053-341c-47c7-9821-14a6270df68e", "value": "T180759E32B6C19476C2333930CE5FA3B9B56DBE211E34664A27E41E382F78582751C69F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169899, "uuid": "22487e6b-1f31-4871-bac8-81ba3820c306", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169899, "uuid": "feac9306-48b2-4735-9c52-d3a174784db1", "value": "24576:YnsJ39LyjbJkQFMhmC+6GD9MWnAxrOgeSAYvPYzqD2AQOLPiL+Wgck2nPC4YEK1+:YnsHyjtk2MYC5GDuWnAteSAYvPsqD2Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169899, "uuid": "b10cc7d3-f4f4-44e0-b219-fca570ee5f89", "value": 1565470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169899, "uuid": "3aeeb9d0-cf29-4af8-b8c2-6f21f5fa6a8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169899, "uuid": "fc2d88db-31dd-440f-8d25-c17f60deb755", "value": "e3b3e2244d71ed56d47ff42c3fcbaeed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ae6cfc-fc2c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1685150385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685150385, "uuid": "6ba4b3df-6e8c-4a2f-9fac-62d91fa6483e", "comment": "Malware payload (AgentTesla)", "value": "8a4e7633cd4638e903e0d88842b94fd2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685150385, "uuid": "8c012f5a-7266-41f7-a4b1-edea19f792a0", "comment": "Malware payload (AgentTesla)", "value": "c13d10d9eb5505c91c1982dd55019f8d5e5121952be774dc80eff344453c50ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685150385, "uuid": "69678976-1bb2-4b42-b20a-0c657cd7eb55", "comment": "Malware payload (AgentTesla)", "value": "a8f2d447da5359eb0190422ebe5c957a836f43a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685150385, "uuid": "412273ea-196e-4b76-ab22-bb7de8ba3d5c", "comment": "Malware payload (AgentTesla)", "value": "fe7ac0eeb7f06e648f4fdb50f912e6d93ee5e0d291c16fac9f56b203982e69294f5bba0187cd01965d7e8c3b7cb555e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685150385, "uuid": "ff993c5f-c811-41ef-8d4e-2b5b53d04591", "value": "T12BE412583269981BE0273FB445626B790BB67F957034EBCB2CC233DF42E6B914612787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685150385, "uuid": "93e85170-b99c-44e1-a32c-cfa27be4e5b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685150385, "uuid": "45ef39a4-2724-4502-81f3-b27b411ba92e", "value": "12288:t7z5GoJiGaq5auBwaAqApQAGu7Y0k9cx2cqtaXYJL3rcWeqTjaE:p5GoR5aIlALPGQ46wtaELbcWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685150385, "uuid": "24b8c18b-261d-4c26-b89f-f99a94c925ee", "value": 697856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685150385, "uuid": "7cc57784-8235-487f-8a39-f92d7a0ff5c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685150385, "uuid": "6b88befb-76d8-4562-8284-8541c3b47b43", "value": "8a4e7633cd4638e903e0d88842b94fd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5d452d-fcbd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1685212844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685212844, "uuid": "8f43a890-7aa4-428e-8a92-92d2a9bbdef9", "comment": "Malware payload (njrat)", "value": "c92a47af2e8654a296aa7f034953ba81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685212844, "uuid": "761d03e7-0605-4995-920c-137b2328cd4a", "comment": "Malware payload (njrat)", "value": "c4abce38821e544e46dd29744a80170cc3039921659455e2aa209d3733d29bba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685212844, "uuid": "8f8858ce-39e6-401b-b1ce-27af73ebd387", "comment": "Malware payload (njrat)", "value": "2f1af4b877016cfff87fcf0fe4e9862f2a35bf58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685212844, "uuid": "c93148f7-cf39-425f-9ae6-89f5456e1139", "comment": "Malware payload (njrat)", "value": "9714c087c1e9825c6e2e4b1dc51ac590dadadce9c62000049f51cebe77a0487b124b2b9bcc802a8874d232421f7339b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685212844, "uuid": "4adc7a42-a32a-4906-9dee-7f09616e25a1", "value": "T1F6539E8DBFE1857CC8BD15770573D412077AE00F6E23DA1E8EE5A4A936236C08F64AE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685212844, "uuid": "c3f25624-6600-44a0-9fb1-efc7f736c8b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685212844, "uuid": "e8485d18-cbca-4196-a23f-773d5b595fb0", "value": "768:lr+R1NkrFV6NmFrM+rMRa8NuNHtR+qZ/DrnWDnhwdeyPxB2YsWpN4Q9Ala1B9s:lr+R1CxV6A++gRJN6rqnhw0oxBlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685212844, "uuid": "9920d5cd-fd57-41e8-aee2-123cd44e6bb6", "value": 60928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685212844, "uuid": "73c48fdb-69c9-467b-a4d5-97d8fe2295eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685212844, "uuid": "839d9b0f-404a-44c3-872a-afe7dbd82a9b", "value": "c92a47af2e8654a296aa7f034953ba81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b86f9b3-fcc1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685214264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214264, "uuid": "e6a6ae47-ae2f-4bf0-9f92-bff33b472b52", "comment": "Malware payload (Mirai)", "value": "a3524006161a30eab69b016a3a8c9a19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214264, "uuid": "ce74d877-9868-41a9-b55c-9441cf5f657f", "comment": "Malware payload (Mirai)", "value": "c4ec486013b3cd4653dd2680acfe2df65c8d5b8ce25b27c9984229e7ffe6edb4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214264, "uuid": "afd276d6-8330-4aea-ab4b-919a47099147", "comment": "Malware payload (Mirai)", "value": "ae0d7e1ddcb395669949ee88a30167f1d6345396", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214264, "uuid": "b2a32d60-47a2-4241-ae07-22bc95f63a81", "comment": "Malware payload (Mirai)", "value": "4c9bfe9fd32347d5dc38f267b65e838365861ad4df538abcc27d13ee841399885e0275a682a3d73aa027fc6a99584095", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214264, "uuid": "3025ff7a-1bbf-4d33-8d45-08a805a3a5c0", "value": "T16B2483867FA03FFFD81ECC3702959B06029D59095399BF7B6A28D408BA4B14E59D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214264, "uuid": "3eb4bc93-3bee-4d6a-a995-a0282eebb3e8", "value": "3072:9ginqTujhbNABRaLZWCznQcsHFU0+I6jWvibjyvUx:yinWkhpABRaLwCznQcslX+wvibj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685214264, "uuid": "f9c3aeef-e7e7-40c0-89f9-6002ea16f8f0", "value": 222352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685214264, "uuid": "84bc78e2-82eb-461b-a424-bd4e1cfeaa9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214264, "uuid": "27c0e58f-5e02-4266-af6d-eabb3e024cc1", "value": "a3524006161a30eab69b016a3a8c9a19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a88935-fc6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685177750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177750, "uuid": "0aa5df91-5505-4b16-b53a-f3739edad2d1", "comment": "Malware payload (Smoke Loader)", "value": "5fefb8203422194dd4684515c0ed6cd9", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177750, "uuid": "fbebd993-e5e5-4bfa-ba8b-7c8cc2171a07", "comment": "Malware payload (Smoke Loader)", "value": "c5b4a032661a477c9397cf02cf946a3d321099bd876fd29f5352335b67f9a564", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177750, "uuid": "dc5b9785-1db9-4187-9db7-0e4a5c787a8e", "comment": "Malware payload (Smoke Loader)", "value": "682523706a1cd9d7e53f77413a6217b803c8ee9e", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177750, "uuid": "fc71d705-fe41-474c-9683-21d2ac3c2793", "comment": "Malware payload (Smoke Loader)", "value": "e5fba959ed5be4a09df365a0cb073bfa8673d7538e07df0b7d1e8615a141890669558aa9e9f5e142991ba62f4e51a03b", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177750, "uuid": "3da66e81-9e66-4d64-b40e-fe0f02d0b80c", "value": "T14654390392E17D94E9264B3B9E2EC6E8771DF6548F1D77662218AAEF04F11B2C173381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177750, "uuid": "05a6dcce-2113-4e09-9f25-78d5d3fe5dc6", "value": "bd191f6a78cc98a8bbe61db18ad8e9a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177750, "uuid": "a024e787-78e2-4b25-97e8-edad5a11f116", "value": "3072:TOQTwP/BcZtTUr7bLTZV7xyQ763vjDACpH+4Nzn7sKX5At95k:6QTwPQtcHHxVYvjca+4z70t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685177750, "uuid": "7a3cb6c7-7146-493c-bbff-03b91eabb77a", "value": 297472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685177750, "uuid": "b5892d2d-984f-42d2-afc0-d740803e18ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177750, "uuid": "13c0e3e0-2a46-4304-bc44-9d73dc2dff71", "value": "01867799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2fe4ef-fc67-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685175743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685175743, "uuid": "4d98c9b8-79a8-4d87-a437-172873346ba1", "comment": "Malware payload", "value": "9e210d931dec7fb3c7ce948fdcdb834d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685175743, "uuid": "6e091779-c22c-4609-9845-d43c8c47e2e5", "comment": "Malware payload", "value": "c615b57a74eefbaa313b34fcd75289db5d298d50640f242200044f4a9e7bbe80", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685175743, "uuid": "a639e349-9fd3-4f74-9e55-8ed1d014bf56", "comment": "Malware payload", "value": "e1546c717cbfa9c4b7f4181a8e501f461ec2882d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685175743, "uuid": "f6fe790c-1f4b-42dd-98f3-1144a9d76492", "comment": "Malware payload", "value": "85d9200df99fdb9f60c3840e6139fa57fb0288ed7241c1a85830e33e3b1563ac0ffad6a0ec28f679854f36dda02c20f4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685175743, "uuid": "3085a241-6039-4a73-af7c-d9c9e1777cc6", "value": "T1B015CF70378B9787D21E40714A914FF2254F98DA27F3A5E1760E8B3B9C1A7C3142D6EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685175743, "uuid": "518bfda7-c4eb-4e5e-a9f0-46d6eb4d7d3b", "value": "24576:4SIfBSKSSSSSa663uMQH1Qi5CUbOJg32EWnKRQ1Y:4SIfBSKSSSSSa9ZGQi1OZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685175743, "uuid": "588a5537-d105-4845-a247-ead64205a696", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685175743, "uuid": "a04b3c04-9b41-4736-8d4a-4943977ca475", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685175743, "uuid": "18b4a531-a70c-441c-ab19-ea1229299424", "value": "9e210d931dec7fb3c7ce948fdcdb834d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d263dd36-fc40-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685159085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685159085, "uuid": "95e89fc4-75a8-4ae5-bc3a-2c4cc6780724", "comment": "Malware payload", "value": "f0e034605308d3b9170381a860041d38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685159085, "uuid": "55f8a108-ba25-4f1b-8faf-0ad7f3c902f8", "comment": "Malware payload", "value": "c71e044cd33bdd4cddba9e6f3e49094ff995dc01426b40c14a8d3c439cd2196e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685159085, "uuid": "bb9fb4d1-bae2-4672-a9c6-b080b15cdb66", "comment": "Malware payload", "value": "a5eccd2e0b6f69f2b9ebde053fe8220cab135f9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685159085, "uuid": "6efc6591-6fd6-465c-824c-010da00de6dd", "comment": "Malware payload", "value": "f12b22bc77553eac56f5a60751e073c960275f60e3988c54f337d5165427a0bd9b05db3655303b3335891982a57e2e50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685159085, "uuid": "59ef140a-be86-4f2b-91db-9fd1ad1a625d", "value": "T1D2545B217DF2C4B2D572053308F8D6B15A2DFD600E61CA7B63D4372EDEF4D928621AA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685159085, "uuid": "75783473-4ae1-49cb-8ec7-cd4252d543da", "value": "a99648a4d417f4130faca9d4625edb8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685159085, "uuid": "fd78aca6-ea98-4801-8b2f-b7a98ed4d71d", "value": "3072:lZzaqLh5m21b4n86fZHi8c62bdq32BsWtEGwF4JOAg0FuDTT6E9wbvWU7IVMU:lZzvhs2Z4n1E7g34XtVYAOfTd9wAaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685159085, "uuid": "70608328-2e90-4398-9200-eb0ec09be847", "value": 292864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685159085, "uuid": "ab4b8457-692e-4521-a85d-4acf053d203c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685159085, "uuid": "aebc775b-1550-45c8-b484-64ae4e078b14", "value": "f29f50f0b7854518bc9e2ac2a7e11716.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5076bbea-fca8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685203535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685203535, "uuid": "d14cc350-b000-4e96-a18c-b4de765fe179", "comment": "Malware payload (RedLineStealer)", "value": "5127ed17b701e20b71d6481120710771", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685203535, "uuid": "7f63f2e9-e11e-40ee-a0eb-36646faf8274", "comment": "Malware payload (RedLineStealer)", "value": "c72e5cb93b5369baf31e8f4052dd987154ca18b694194bd6441c93b8711723bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685203535, "uuid": "5833d33f-f135-4a76-b065-cf46af31391f", "comment": "Malware payload (RedLineStealer)", "value": "2942f0ea2383c6a03b931d107b2f08a7ee230149", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685203535, "uuid": "c7895f1a-8974-44a3-bb14-6fefb579e18a", "comment": "Malware payload (RedLineStealer)", "value": "e32ca3aca020430aa9557ddac55c5c3dd60498d09c578af04bc80edd4480e5dd90ff874996fc681e2d9f9756f368138b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685203535, "uuid": "48aeeed9-75d1-4000-9ace-0c643921d420", "value": "T1FCF41202E7E85576FDB427B12CF643D31F31BC918CB983291365691F0C72691A876B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685203535, "uuid": "c779cbd9-74ba-4014-b945-b3cdaa400a73", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685203535, "uuid": "48eaff7c-e119-46a8-adb5-535c8f1bdfc5", "value": "12288:pMrBy90IgpJtphFGrTEZnsLD2iIPiDRaAnpuEG8//hvXXWnSOJo+:0y4vABDaGIeuENB5OJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685203535, "uuid": "61c466cb-c492-45b7-8dac-83e1bbde7339", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685203535, "uuid": "a53402ce-684c-406e-89d8-fe8aebbb8954", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685203535, "uuid": "14572d1c-3ff0-4a63-8671-2bc46b3056d6", "value": "5127ed17b701e20b71d6481120710771.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262e512a-fc5a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1685169963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169963, "uuid": "9fe31837-6a6c-4d00-a517-15025e374950", "comment": "Malware payload (ArkeiStealer)", "value": "3c6331cea1ff7288ff615648ee250b33", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169963, "uuid": "0b589351-68b9-40c7-97d3-cfa2245e92de", "comment": "Malware payload (ArkeiStealer)", "value": "c786c65835185eebe21e9f742dc3af4df14af8b79081d8137b703bbce6b1c790", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169963, "uuid": "0cb6bd27-374a-4f75-aac4-e1f9db67151e", "comment": "Malware payload (ArkeiStealer)", "value": "d2e6bf6badfd57d831d8ded08d33b6649a884f86", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169963, "uuid": "f0c06940-c7fb-49cb-9878-aa2ac6852213", "comment": "Malware payload (ArkeiStealer)", "value": "d3c380cd3e185e0a49bb9a27f8f8b323db5813efa0748c41f076a3987a9a960a3c58327b81aea45afd34d65fe1427258", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169963, "uuid": "9a83ccd5-00b0-453a-9309-06b191fefeee", "value": "T14E948D5392E07D90E9664B339E2EC6E8771EF3544E593B652218AFDF04F02B2D163B81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169963, "uuid": "5acb43a5-2a22-4ac2-ad1b-ad54d27eb3e8", "value": "bd191f6a78cc98a8bbe61db18ad8e9a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169963, "uuid": "435c5dcb-6b67-4f1e-aa98-4510d5262ffe", "value": "6144:HZVRx+NUTvqKkZE0BCJNaRGkDXX1vSVgzyyksSTyTvWIUqrx:H9wNVy0BCWUk5v+yOUvWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169963, "uuid": "f0346054-1773-4040-ad26-34fe986a0d74", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169963, "uuid": "2f56a200-0dcd-4fea-8515-7586c8b50aa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169963, "uuid": "50b5f121-3ab4-4afb-ad98-13bb04624a1e", "value": "3c6331cea1ff7288ff615648ee250b33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18281a91-fc89-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685190126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190126, "uuid": "b90179f3-25f7-4ea3-9454-23df193d695d", "comment": "Malware payload", "value": "1a5ec945995319b084481595e5615f31", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190126, "uuid": "75921eb2-01ea-4fb2-b77f-3ec32316c498", "comment": "Malware payload", "value": "c830f9bdfcd6ffa2c615b6774a631d4c1cdb2dc77337e9aeff730a400ba98639", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190126, "uuid": "71172547-a3c3-4164-a242-0fffe7221cdb", "comment": "Malware payload", "value": "3df02169ddda5b38f89ba28a0c01e020d77ff7c0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685190126, "uuid": "ea138cfb-5ae6-49c5-b033-38f4f065c208", "comment": "Malware payload", "value": "403804eaeda1f65c3ef9d270d1edf3de8d7f6931adcc7f9531fc968a724e6fda38c1421dac22374cc5a3bd98ee12fe5e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685190126, "uuid": "5d35d9c7-455e-468c-b609-def721166dc6", "value": "T1F0D05ECF205590540505DAEBB6A24C18828AD5C9AA9B5E296CC50AB7949DE4C3091FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685190126, "uuid": "fb21e469-b971-4c33-9ce9-41bd5377ef03", "value": "6:OZPrthvSaRS3GlUfrg9FNk7EkKpUfrgEzjNk7Ekv:yPLvVe+pNkSmzjNkD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685190126, "uuid": "4d8434a2-a5c1-4427-83e0-f1a4c31b4a77", "value": 257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685190126, "uuid": "2161bee4-cdc2-41a7-94d7-45ddea962cdd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685190126, "uuid": "5b1cc6de-b777-4c61-b8d5-d688b19b1565", "value": "d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693234c1-fc96-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Empyrean)", "timestamp": 1685195845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685195845, "uuid": "4a7d86c1-33df-4cc6-ad7c-cbce51910254", "comment": "Malware payload (Empyrean)", "value": "97a5ad8694bb1f3a60fdd2c2c76a1f2e", "object_relation": "md5", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685195845, "uuid": "26e060b0-4273-440b-a994-e96aa68b7de9", "comment": "Malware payload (Empyrean)", "value": "c9b324bc6601f267cbe474764ecf6b1e9b6b739b31f8e5c3ab1acb930aa1d145", "object_relation": "sha256", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685195845, "uuid": "049002a4-bc17-49e2-8596-1b364b230b45", "comment": "Malware payload (Empyrean)", "value": "fce884bf6edd583f5f350553ccc6251b32835355", "object_relation": "sha1", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685195845, "uuid": "f06f493f-f781-44ef-95b5-673dfc2f001e", "comment": "Malware payload (Empyrean)", "value": "3dd0f8b734f1795979f9f1d345616305a074710f862c0445f8187f5b46e60bf0df12cbc7d95d170b9c93fbb2a63a1c68", "object_relation": "sha3-384", "Tag": [ { "name": "Empyrean", "colour": "#C6F573", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685195845, "uuid": "2e43ff1e-5032-4cd6-aeff-60a7da93faab", "value": "T1131733E4525405A6D8F6653E6C0FC86A1127FD4323A5E88F43F0A6388F63B552D7BFA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685195845, "uuid": "1dd77b3c-e7e4-49c4-b4be-76cb306f730c", "value": "1e92fd54d65284238a0e3b74b2715062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685195845, "uuid": "3ca6d1ee-e037-42fd-890b-3cb3855120a8", "value": "393216:SqPnLFXlrjQpDOETgsvfG5gjImvE7jdhqLi:XPLFXNjQoECmI/lO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685195845, "uuid": "ed772030-dcf6-4bd3-9ba7-7a28f7f7741d", "value": 18549615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685195845, "uuid": "79e5689e-92b1-45b1-8f53-9a5e59442849", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685195845, "uuid": "e55f97e3-2e87-4883-b205-c97c5318ac35", "value": "Nitro Generator.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9708b238-fc74-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685181319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685181319, "uuid": "63c76167-90a1-40da-8aaa-d73e95338865", "comment": "Malware payload (RedLineStealer)", "value": "7155972ffbe0db1d50e26845fa235e2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685181319, "uuid": "167c8e05-35da-4d90-9d61-6995974f1b84", "comment": "Malware payload (RedLineStealer)", "value": "ca01c09b077ecfce3c3434a363b6957bf8018001dde00f5b50fbe20715284ffc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685181319, "uuid": "4d051e9c-7b51-42be-aeff-956de8f6dd34", "comment": "Malware payload (RedLineStealer)", "value": "6af0b1dbfbd33d1238ae5f693fb208f56f16a956", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685181319, "uuid": "9ce4ca52-fccf-4dd7-8ad9-ac6a7b87896f", "comment": "Malware payload (RedLineStealer)", "value": "45534d99f1c3345ab2e438d04145ae0ef572097cefcdd303da79646988ba3158843c7349bb84c14989a7626427cb3873", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685181319, "uuid": "ffd00393-1605-4f98-a79d-06709061b582", "value": "T146F42362ABD48073E9701BB028F716C3073ABC975D74836F2241A99F1DF3A81D972366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685181319, "uuid": "13cb8db3-2c3f-442a-b91b-34d45151e2c3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685181319, "uuid": "219a49c3-f8ef-4819-b015-6a111479115e", "value": "12288:1MrRy90eWHGS6ARNZm8Q8pGjJz4PNjeqNglrfKm8T9M3+VULk3NTQSiVZ:8yuFLo8QwGVz4PNi1lrCm81wk3KSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685181319, "uuid": "228dece4-f8b5-4a09-a1e2-ef7fc7dd2860", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685181319, "uuid": "91db997a-a18b-4d57-b294-844a0a8c41f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685181319, "uuid": "e2d681fa-9dd7-4f5d-9f1d-74437ce4b8fc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1068ebb2-fcc2-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685214594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214594, "uuid": "4bb0f0a8-3f68-427f-868a-a6320527e645", "comment": "Malware payload", "value": "fb22704548991a2c4a6333fe9b9c04f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214594, "uuid": "32c78bc8-5f50-4739-9528-3f709f5cdbc6", "comment": "Malware payload", "value": "ca9bafa9f28ee2cce634db95b91eadc99bb8f93a52ac145a1db770e8486dd891", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214594, "uuid": "ead0569a-5f32-4636-a3f1-e8546be47fb0", "comment": "Malware payload", "value": "c4331cd0fc495e31e9f5180c5a993c40851aa2da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214594, "uuid": "6be54d34-1d9a-48b4-ad3a-ef41aa83b02f", "comment": "Malware payload", "value": "dde56e40dc195b1e3e1b247a5f71d48011d1763eaf9bd773ff6105e0b36337f8445b8e07ba0060edc7d32080baa32a4a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214594, "uuid": "bec0eec6-b766-438c-a679-009437917b2d", "value": "T1C5A34A31BA362E27C1D6A13B11F74725B2F153CA25A8C62E7EB10E8EFF245402157AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214594, "uuid": "5b3acb53-6a47-4883-bc8a-5c01f721b13e", "value": "1536:kZYY/zPfwkBRTjf4o4Y3UzTDk8amQMP9yjKPRlM5IYtYxqAwbZn2L:b+r1UyQDfamQyjPRl8I3dwbZn2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685214594, "uuid": "c86c91db-2d48-48b5-922c-3f812215418e", "value": 99856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685214594, "uuid": "92ef95f8-7fea-4356-89a6-bf5d0d2ee235", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214594, "uuid": "a4547404-0e3e-49db-86ef-b5558af61d9a", "value": "fb22704548991a2c4a6333fe9b9c04f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37beb611-fc34-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685153672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153672, "uuid": "f2ba610e-6073-422f-99ef-eb5f73c513a5", "comment": "Malware payload (Smoke Loader)", "value": "be441fb89f8fb2e714845db8968a8450", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153672, "uuid": "0d3f706d-134e-44c3-8e6a-cb73dfa8ada3", "comment": "Malware payload (Smoke Loader)", "value": "cb7b2ae51a3cde01e9b5adb92aa9262ceb6fb9b499061b921550805dc1670419", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153672, "uuid": "2d8d0395-61a4-4e94-83c6-4a1410b666ca", "comment": "Malware payload (Smoke Loader)", "value": "9ca59eec41c922241d75d70ec4639cbe75871ab1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153672, "uuid": "8ccec050-ab66-421a-9aeb-b5b81987c915", "comment": "Malware payload (Smoke Loader)", "value": "8225987cff46bd052d1730d1c94c8c8db3a83ea84768e2eba51a08a36fd067848b9a78f80a0619f39d24b891ca1ca94c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153672, "uuid": "a598e0f7-1498-4b03-9d5d-21293096e11a", "value": "T1E4543A1392E17D90E9264B739E2ECAE8771DF6548F09776522186EEF08F01B2D573382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153672, "uuid": "bf508552-780a-476c-9c35-d20a4b8369b9", "value": "bd191f6a78cc98a8bbe61db18ad8e9a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153672, "uuid": "b1f0b1b0-fb24-4db6-b667-ebc6c6cd580a", "value": "3072:5QQIwraBlqt2Gi7/6v63y1EvBSLKVX9hBvwRYTo57a8vMxKX5AL9qNT:OQIwr5tXM+636EvBKKVNh91PPxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685153672, "uuid": "55e604c8-aade-40e1-b4f9-0e161819d263", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685153672, "uuid": "8e19524b-9828-4681-b10e-d0f31a36e6cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153672, "uuid": "06a8f5e4-21f9-4066-9d55-69b336f6fb04", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e675565c-fc83-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685187895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685187895, "uuid": "de4dc1f0-d6a0-450b-a6d0-e90912c262f2", "comment": "Malware payload (RedLineStealer)", "value": "8503317c6520b102ea9a9e14ab2f970e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685187895, "uuid": "ca7cdcf3-228f-4fb9-93bf-57354a1e4732", "comment": "Malware payload (RedLineStealer)", "value": "cc63b9e590eb2c55ab3697ac6fb377f6c54ffbbce9a6113722e543c443f99b56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685187895, "uuid": "3445db67-53ea-4ed9-aec3-e6f3e0905555", "comment": "Malware payload (RedLineStealer)", "value": "9c27fda4eef483695be81f85008e05ed0ba2b3bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685187895, "uuid": "f66da515-aee2-4c3b-8b12-575375d7d75e", "comment": "Malware payload (RedLineStealer)", "value": "66fd7c1faae3f3a23693b4cdcb0a3f8c483f348e028b9156e3b04ee424e563f97ad9113c8a5e0a343a79a2e69c4473e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685187895, "uuid": "944124f4-2a30-45df-8e31-3e98b3494072", "value": "T1F6746C1392E17D54E92A4B339E2EC6E8771EF6549E0977662228AFDF04F01B2D173381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685187895, "uuid": "8b14dbdf-6ef0-488e-8909-6f76f5f2bd9c", "value": "697c6731df2df92c82c75859d21c5f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685187895, "uuid": "88559d1f-06cc-437a-a5de-72bc124af34b", "value": "3072:lxAorBVD2IyDOnCYQ7TpS6h6CJA51xCbz0j+v2AYCzFbTi5oUm5QG9O13:HAorB9yDOtgaqADO6+uPYbTipG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685187895, "uuid": "e52ac3df-a557-4d70-8d7b-ce2ab41acb22", "value": 365056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685187895, "uuid": "4d7ae231-12bc-482c-a907-2cbdade7ab51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685187895, "uuid": "58d93d3b-821f-4109-8795-75f237a359e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747fe35c-fc6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1685177825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177825, "uuid": "008c7f6a-4097-4df5-b2c6-28d5278115e3", "comment": "Malware payload (TeamBot)", "value": "7e41a726ac7ee1ac53883122630cc6fa", "object_relation": "md5", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177825, "uuid": "86b055ec-2d92-4b10-8db6-5bd5beb0d88b", "comment": "Malware payload (TeamBot)", "value": "cd5c8ed82f61855b377e3c59bad6edd1844bc5b46c21715969063a3e5befe2f5", "object_relation": "sha256", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177825, "uuid": "1c855e87-f0ab-473a-8aa2-043c0918825a", "comment": "Malware payload (TeamBot)", "value": "0c0d72b7ec10fb1ce48bb50f5fb3678984be7e58", "object_relation": "sha1", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685177825, "uuid": "339d0694-9eb0-4fa6-a177-48df37085cc8", "comment": "Malware payload (TeamBot)", "value": "f54a6828b7bbd1ec6d8d751870193e8c24149eeaf8089f2ebb92c6c664d68655e33e5b3260cf6517785380bc98235f7b", "object_relation": "sha3-384", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177825, "uuid": "3804e8b4-f76e-4d95-af65-45a6a4e97fd1", "value": "T1AE544B1392E1BD94E9264A339E2EC6E8375DF6544F193B6A22189FEF04F11B2D173381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177825, "uuid": "c90e6d3b-72bd-43ef-8fe0-697612c42ef7", "value": "bd191f6a78cc98a8bbe61db18ad8e9a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177825, "uuid": "44aafd88-66f8-4c20-96bc-2b61b4ef4239", "value": "3072:WWJrcehjYNj/swrIhO/Z5IItOyvtzw6WBSh7DWvdmoNfKX5Aj9OQ5f:FJrcBN4AZyI3vj97aFmoNPj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685177825, "uuid": "591afa87-156f-47f9-b61c-5514086040dc", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685177825, "uuid": "05d47dab-ab8a-4c5c-bade-6519c9366671", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685177825, "uuid": "114e2775-36c7-4b43-bd42-6b1ff9925a7f", "value": "02630999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d1e893-fcb2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685207995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685207995, "uuid": "c363390a-90f2-4950-8a10-d942c1e9e4b7", "comment": "Malware payload (RedLineStealer)", "value": "4faf0c54dba70ec16621b22d449224e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685207995, "uuid": "54ccbdf4-17b4-434a-baa2-5e0debe298e1", "comment": "Malware payload (RedLineStealer)", "value": "cdcc39dc7c05d0372698a81cbaf7c0374352012d59be1dde3dc64f957f5a8edf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685207995, "uuid": "067f48b9-16eb-435f-8465-e3070ea47171", "comment": "Malware payload (RedLineStealer)", "value": "472e31c530fa8f089131894fbf02e49772d15bc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685207995, "uuid": "03c5e5c9-d347-45f2-82df-0bf118bba181", "comment": "Malware payload (RedLineStealer)", "value": "dfbf46725ba512fa60930b3fde5cfa1c61c6b7692718cc064a33586965ae1b01e1a00e2b43e04c25f5d2c51d45af194c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685207995, "uuid": "ff8e34b1-94cc-458e-bc3b-21de5fc0d639", "value": "T120D60193B67800F7E057CA3A86576603F6B138415B329BCB25D046462F33BE2DE3975A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685207995, "uuid": "87350a3e-76bb-409b-a7ec-033ff9dd10e2", "value": "a2626a5f44ecbfc7148b23dc79fbb580", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685207995, "uuid": "3add3a0c-3d12-4f81-a093-b084abe8a8b9", "value": "393216:rJQaPHrQqXs140qMhu8369sV+HLz9SKUeNdDhHiCGp+tF5Y+Y99ryd84VxxROgV:rJQaPHrQqXs140qMhlK9sV+HLz9SKUeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685207995, "uuid": "c5b5c20d-24fb-4705-b03e-763ebbeabe12", "value": 13668608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685207995, "uuid": "5b1e18d3-8dda-40ff-b6b8-d8860c764119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685207995, "uuid": "0a1b4233-d5ce-4157-9379-30b5128e39d8", "value": "Panel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47acaf57-fcb8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685210392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685210392, "uuid": "09a9d8b2-66dd-496d-8ee9-b483d1410939", "comment": "Malware payload (Smoke Loader)", "value": "80263288689bcb49541b304383f200bb", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685210392, "uuid": "3d403ee7-23fc-4884-8bc9-3001347a200b", "comment": "Malware payload (Smoke Loader)", "value": "cf1fb9950ced59966ffb235f4a8247c23075d44a09eb0c354f9183585a4faea3", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685210392, "uuid": "91f0333a-7ba9-4648-b500-667c3fc98c7d", "comment": "Malware payload (Smoke Loader)", "value": "591552ddd98a777c905278056ae42b3f7c1869c9", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685210392, "uuid": "bdffdf4c-65ba-4745-89d8-00ac0b836e2e", "comment": "Malware payload (Smoke Loader)", "value": "3886fde5a260559ef4b6e670a995ce117a03f60f9396dcce2e702bcca1ed8a66b6816b92a7e6a1e6a5ee9e61d9afc0c2", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685210392, "uuid": "cd3ea000-9f86-4645-8e4b-5718bc8b9335", "value": "T14D543B03D6E2FC52ED664A728E2FD6FC761EF5548E19776A22186B1F04702B2C173722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685210392, "uuid": "f58f6c42-cd1f-44ff-90f2-8cf9c3e551a2", "value": "82b2bd7dc938b719df57a6b2df186152", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685210392, "uuid": "eb4e9d39-2e0c-4b82-8f94-2d02d2edabc7", "value": "3072:5ZV2d0h6e7c5BdoifQugY4FAdQXkQPG3kA8uzAnINIbt5QaGvASizY:572d47jSQuP4QQXkQPG3kA8KrNrau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685210392, "uuid": "04b77840-52c4-4ed6-8691-d3e2df7eb4ce", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685210392, "uuid": "1c3ba509-515a-4798-812c-20da3cff311e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685210392, "uuid": "6fdd71a2-8bfb-4de6-86a1-988a4b5c95fe", "value": "04121999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783e16d3-fcb8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685210473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685210473, "uuid": "29d7f76a-1672-4b99-8c70-6ab483898240", "comment": "Malware payload (Smoke Loader)", "value": "8619747c82aca5f02e097ec939317c2e", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685210473, "uuid": "06ed97a0-d03b-47aa-a3d1-567f1e17fdd8", "comment": "Malware payload (Smoke Loader)", "value": "cfff129e77416c81657499a1aa091ff549ee037ef6b4783495a37f7891b87970", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685210473, "uuid": "8819ea69-1326-4905-9593-c68a7695d815", "comment": "Malware payload (Smoke Loader)", "value": "176166d573b26976dcf05352f32b3dc8ddaf8313", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685210473, "uuid": "56fb93e2-9449-4bfa-82fa-92074a603f68", "comment": "Malware payload (Smoke Loader)", "value": "0fcfd2e8293e14386abb3f0bd4c63c28bb4e3623531a359948256a86d103d5e52768e5787c04e8d491bfee3ecc449cd9", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685210473, "uuid": "c2f7516f-fe9e-4758-a8e1-fd86a1ef34e1", "value": "T14F543B1396F2FC54ED664A728E2FC6FC761EF5509E19776A2218AE1F04706B2C173322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685210473, "uuid": "e071df51-5f1a-4fdc-9534-2c0ca9f0e2d7", "value": "82b2bd7dc938b719df57a6b2df186152", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685210473, "uuid": "d6b2639d-0751-47f9-8012-56acc5e2f891", "value": "3072:M4xGZqhdP78PNv5SSZu71AUl6Sj/OKfj3hXKU8bt5QoGvAxfY:VGZQ7CNv5XU71PzOKL3M4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685210473, "uuid": "5c48c44b-9b04-42e7-bc50-a67bfce145f4", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685210473, "uuid": "2fa67fdb-cb2c-48a3-bb55-ac011bb4d8d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685210473, "uuid": "65a9dc6a-0ac4-4c08-9361-8b25686cf800", "value": "08241599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff940cb2-fc32-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685153148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153148, "uuid": "0625f1b0-757f-44c2-86c5-2933a4f4b656", "comment": "Malware payload", "value": "23076e4c46e53435fed85245ba81ead5", "object_relation": "md5", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153148, "uuid": "47c850d5-7d33-408c-a0da-a700631f4bd8", "comment": "Malware payload", "value": "d075b86f23ea2f16db1bbbe5d8b141fde60b1655fc48b46335bb8554235bac32", "object_relation": "sha256", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153148, "uuid": "93c9af09-351a-45ab-ac09-6d0a14dc0bf5", "comment": "Malware payload", "value": "dd87971f8b69f5c0a0ce4ea23ab87147b03b8e9d", "object_relation": "sha1", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153148, "uuid": "ccae3b34-c48d-40d3-a370-a3028ab00406", "comment": "Malware payload", "value": "9cd180212d31aa5d9f0f4f5a76c37ece7c0cbb74c204f34ddf6f949eb149de03de48cee4b1fac4423c56c882faf8d3f4", "object_relation": "sha3-384", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153148, "uuid": "33cebcf0-89ba-468d-b59b-21e2874a7cc3", "value": "T15CB4121BCF274FEE4D180E4D80692D060DDFEA3A2911A9D8EA5F245F812EC5D6164B3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153148, "uuid": "a4edb096-650d-4e72-a8e0-3792377a4022", "value": "12288:XKNJm9i7r3d7CwYhVOc00Gquv6lViYWZZbCcNkqQvXpBS:YJZr9zY7fNAYWHkBvXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685153148, "uuid": "574c081d-2e26-458f-a582-31db0d267562", "value": 525970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685153148, "uuid": "23967a36-a232-419e-aec1-4a046a77ae8d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153148, "uuid": "44c444e2-5fec-4146-808c-e2a3546bc070", "value": "Invoice DocuSign May 25 2023 34261.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40429361-fc2f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685151539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685151539, "uuid": "269beb9a-a1ba-445a-8591-5415281d9f47", "comment": "Malware payload (RedLineStealer)", "value": "81b67629e8ec6b301ca40f22dcf74bdb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685151539, "uuid": "37d8d19d-ad50-4548-8b5c-2fc34d154f74", "comment": "Malware payload (RedLineStealer)", "value": "d1818eed64e65789f2a6452620485e34f6dcb60034bc2640829df9f6346a6c0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685151539, "uuid": "b8d83396-b9b8-4068-9dee-1616d3889ad9", "comment": "Malware payload (RedLineStealer)", "value": "3fe754e329e017c90d507b49123c07b4a15711b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685151539, "uuid": "364e3399-2cc8-43d6-994e-c9db0aeec813", "comment": "Malware payload (RedLineStealer)", "value": "6b1b62eab22f60fdaab6da94461db3150095aab86cc74990377fd071349e39b3f2a58ac4a8031441c369cad63ea28c6e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685151539, "uuid": "9ec67b51-acb2-4094-934e-f020a7fa9e0d", "value": "T1D5A34D2963EC972CE7FD073564B0012047F5E0CA5812D7AF8FC6D4EE2E76B81E9951A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685151539, "uuid": "7be24d4d-d65b-44d8-af8f-049e94a37125", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685151539, "uuid": "a2971f27-a247-44b6-9955-0431871ad9ac", "value": "1536:PG6ijoigNsLFe4l73ZUeRh/VYLrQz11cjHi8HYHKbRTllkPsfGoeNuN006dY7qu9:tCFJlbDIG4cGEDr0CeyzdxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685151539, "uuid": "e028b81e-7bc8-4d38-a358-8560728cee19", "value": 101888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685151539, "uuid": "a01ed982-6f44-4531-a19f-903590c27b00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685151539, "uuid": "ef356db7-a37e-4d34-baf3-4d70f64ac1bd", "value": "81b67629e8ec6b301ca40f22dcf74bdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4fa2fd-fc92-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685194054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194054, "uuid": "11bd88db-e8d3-471c-bd37-ade7b5ac3118", "comment": "Malware payload (Mirai)", "value": "dfe827e6587ba2648afd9f94fb6c7404", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194054, "uuid": "0ebc6afe-86b7-48e8-b4a1-aff534b02c12", "comment": "Malware payload (Mirai)", "value": "d3939c24c05dffd22230c42aeaffb0ab3d2eb8b97418a3f2872083277e6fcc93", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194054, "uuid": "b0e28812-19e0-40ea-a04c-9b61a7417a72", "comment": "Malware payload (Mirai)", "value": "7a11b8753f9b981ea914edf08f72342259277ef9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194054, "uuid": "82408c84-2f1a-4370-89bf-2aa1f6fa104c", "comment": "Malware payload (Mirai)", "value": "46a9954633218aa8beaaa9e90cd673feff2700adacc5f28a434844415567c88510b25c69cb6ab7da1d8e594caf7f741d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194054, "uuid": "1f011acb-6d8f-4ee7-8aee-5b92830ce1ba", "value": "T11D634A51BC819613C9D5237BFA1E018D372617A8D2EF321B8D25AF2037CA96B0E77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194054, "uuid": "6ba2eb8b-3953-4ccd-9565-84e6b70d1ad1", "value": "1536:k0efyB2+2rCD0cNslT3wcJT/tTXUCWvqz/PE02s2NxBvmv:k0e6X2riP4TudvaP5231e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685194054, "uuid": "e328812e-02c9-484d-966b-27f193152d7a", "value": 70968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685194054, "uuid": "350fa2a2-ba83-433a-aad1-677aecbb6bbc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194054, "uuid": "353fd255-9914-45a2-a964-ab9f3bb41aa9", "value": "03867799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8a5a74-fc5a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685169918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169918, "uuid": "76c1d4fd-2141-4551-8c15-12fdf233b843", "comment": "Malware payload (Amadey)", "value": "dc081314b3438b0482da72f0b6ab43a8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169918, "uuid": "1ed0167e-8513-419e-98aa-dd04447e2ea2", "comment": "Malware payload (Amadey)", "value": "d3a81b1af05626e183d431ebb79bc27695ab9704179b9d764006dd74e0acae89", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169918, "uuid": "2b596c7f-4156-4659-9f18-1f0cc8cd845b", "comment": "Malware payload (Amadey)", "value": "fd7352b4e43b5d772d313b6a1219c24076168086", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169918, "uuid": "40aedbb9-d40f-48e6-a2e2-7a17434c6d36", "comment": "Malware payload (Amadey)", "value": "bbb71a64fe9031ee14d469fbd62aaf18cb774d08beda2efbeb8ef5dda61b01d7236268bcb868fc15348c1325d667ea80", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169918, "uuid": "17effb36-408c-481a-94de-d2898b92619e", "value": "T10EF41292BBE91463DCB1377098F617834B32BCA19974433B27058C492CB3AD5A97672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169918, "uuid": "3c9d7803-0124-4147-b795-d1ddaf0d534e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169918, "uuid": "a94931a9-68f7-456a-8333-49bf2087e95c", "value": "24576:Tyd35b8H9PirgpnJ+lZbfqJvnU/sik3cSqHs:mdJb8H5icClZ7q1VVTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169918, "uuid": "8939e950-c171-4fc1-b761-7078ddb36baf", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169918, "uuid": "b9a0f6bb-eba7-4de7-8e31-cec71a6ddd86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169918, "uuid": "ef14b4c8-84d2-485a-a076-d66d94f80ee0", "value": "dc081314b3438b0482da72f0b6ab43a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f530f54d-fcc4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685215837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685215837, "uuid": "d3012a8e-2ce9-4ecb-8caf-0ccdfd8f5837", "comment": "Malware payload (RedLineStealer)", "value": "49401e7cb98ce80d7c8a8526b44afe72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685215837, "uuid": "cb4a96c8-5dba-4a28-a228-d0a01e3ada4b", "comment": "Malware payload (RedLineStealer)", "value": "d8225862cc00bac5f729b8e9daf3bcdb208b5eea4c05d40647dc46c6d47cf325", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685215837, "uuid": "11bc902e-1958-4605-b813-720160d11055", "comment": "Malware payload (RedLineStealer)", "value": "a10cb9164866a8ba86e5886d19eb094c86fb6476", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685215837, "uuid": "d64b9f8a-623e-4db6-8b49-16b38bee858f", "comment": "Malware payload (RedLineStealer)", "value": "9c4704f1280f8c0d9cefa720f5e108b90a62051d8c40ac990216c2ff856813ebf3aa8d6d2ef02d6442598c80df8e16f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685215837, "uuid": "67fc7530-12e6-46ac-a4a2-ac90d984e80f", "value": "T170F41215ABEC9572D8B61B305CF202931B35BDB19978872B2765BC8D5DF3B80A47032B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685215837, "uuid": "a0806c0f-c883-4b46-bd9d-a70fbce4cea3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685215837, "uuid": "737ba952-9eab-4885-bebd-449f802b4bb3", "value": "12288:sMrVy90hY7x62wUAe57H6WB2SpO1Oo912Fb47dLiBDT84cfhDc1KKGp:pyj6xg5Tl691087dLG84cpiKLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685215837, "uuid": "f180123e-a9d7-4002-8d6f-23ff94b71e69", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685215837, "uuid": "ea5366b6-11da-4206-ad4b-588ffad1df8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685215837, "uuid": "3b8dfcab-12a4-4bb8-accb-e504989fc8fa", "value": "49401e7cb98ce80d7c8a8526b44afe72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0239b166-fc5a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LgoogLoader)", "timestamp": 1685169903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169903, "uuid": "bf3c92bc-3da8-4435-91b2-862506829700", "comment": "Malware payload (LgoogLoader)", "value": "79d2468bdd8dbdb75619d753c0007b14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169903, "uuid": "bd4cf6e9-e32c-4e4c-88b7-475cbdf1dde5", "comment": "Malware payload (LgoogLoader)", "value": "d99c584d37823946982b6f05ccb595ec966864b6b457242d8ed05dfebe052db4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169903, "uuid": "aac64cfa-0ccd-4568-8421-251e28528c98", "comment": "Malware payload (LgoogLoader)", "value": "cc5a4c2b8a33f7af81e4426dcd2b327cd6f304b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169903, "uuid": "f6b4fcb6-a3e5-4d32-9358-e1230c6709e1", "comment": "Malware payload (LgoogLoader)", "value": "5c1f903a61c40d0f5bc1b359395b417ae6ef7d6913b2b10248ad8c42099c8bc7d61e24ccb698abd569fed75cc5ec3f44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169903, "uuid": "5efd897f-a673-4a0f-913f-1cc60664013d", "value": "T1E3B4CDC0B6161A0FC4BB7AF7EE22C8864AA79DC9C439481E31007531177FBDA5D639A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169903, "uuid": "939deb09-621a-41e6-973c-375c0ecb666a", "value": "12288:tfPuoH1BBbCoRqtDolula0EhwKuEXl4DU:luaDNCo0No0ldEhNuEXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169903, "uuid": "583e3f83-e43d-4f1f-8685-31a256e7b466", "value": 494952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169903, "uuid": "0986cdd5-e6dc-46f8-a8ae-1be2af78068e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169903, "uuid": "1958d0b8-a9f2-4e30-8593-8b4bf3e7e56e", "value": "79d2468bdd8dbdb75619d753c0007b14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7153d8d2-fc95-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685195429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685195429, "uuid": "95e9c711-f273-41a4-b47b-84e3a7903aac", "comment": "Malware payload (Amadey)", "value": "dcd31f74ddd989c3df5b6e69ff1ca95d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685195429, "uuid": "0fabc258-2d4e-4fdb-bab7-c413cfede191", "comment": "Malware payload (Amadey)", "value": "dabdaf0eecf2a5f597363d3373718861f6e4fb1f77aad8944d695243e8e50405", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685195429, "uuid": "b31efe84-626c-4fc6-b48c-e66d50de0665", "comment": "Malware payload (Amadey)", "value": "085db77f2594052b221063733c00572e91de404b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685195429, "uuid": "c8983a08-af99-4e9a-b8b5-c1bf2007d446", "comment": "Malware payload (Amadey)", "value": "1045df1b6ccd8070cd0da86dd135ed0386e3e6948019f0836e87062c6bbace50bc47a3d75ed13885a02d792266f067fe", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685195429, "uuid": "9db1c670-e1cb-4783-bfb0-15da37ed7c2c", "value": "T109F42207AAD58972DCF827716AF603C30A3EBDE28D78431B6B19A55B0DB25C46072377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685195429, "uuid": "2b49c70f-aa83-4309-947f-5c4e0c216c8d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685195429, "uuid": "9b51087e-8ca6-471a-b433-555f7ce2677a", "value": "12288:NMrFy90Pyp4561bD2JUpZWbQUWsX/bAUIWWmIVfmDYX6GQZjkCFs1:Iycaa0i+WZzAUIeo+DYqDkCFs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685195429, "uuid": "94a9ee06-1ec3-4382-88e0-f7aeeffc233f", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685195429, "uuid": "74de3214-d60c-4184-9c07-a6d0ec9449ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685195429, "uuid": "73f6982e-13d3-4e83-b2b5-705665b22e5a", "value": "dcd31f74ddd989c3df5b6e69ff1ca95d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388f706f-fc69-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685176436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176436, "uuid": "7bac72a8-4287-4d75-9265-64a5e1634fe9", "comment": "Malware payload", "value": "20339443a8789c448d23bb7d7d227373", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176436, "uuid": "9b65adc3-4d9e-4bbd-94b6-788a76762452", "comment": "Malware payload", "value": "db9bfac3e8c8667293f5685032eb088e4c2078c308ef59464241e5b89c28143f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176436, "uuid": "a590c893-9e29-40bd-adbf-aa6e4b95864b", "comment": "Malware payload", "value": "0998e456d72d1e0a323761b88f0b6f27eeed3119", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176436, "uuid": "d1d08725-c5e5-49e1-b8cb-622eb2481839", "comment": "Malware payload", "value": "78b904a2677c870736b923c61b148f7f8f722408d2e57b242ba4645e9d4cd4207e4c33be74854a1af445b9ca2f85b44d", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176436, "uuid": "79800c5e-ca8c-4532-a963-8a3f8420adde", "value": "T1B9E0A000098743A66A0348A5831AEB25EA56CB4B97CC18278BC8078AC408EA6727C2D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176436, "uuid": "ab56d94e-7b6a-4ace-9bdd-452d73f1b5f6", "value": "6:h+3FOfamkKIfamM8P28QmJNweg/Angk8W4942PX3VVGv8W4A:Pfa4uP28QsaF/AOWSRHVjWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685176436, "uuid": "811f237f-68e4-4079-9dd1-7736524434ce", "value": 435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685176436, "uuid": "c9389dd6-13d3-4a83-8e82-5b7f4f824421", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176436, "uuid": "a68039a0-ac40-42bb-8a8b-30dea3a90df2", "value": "2(1).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3b0687-fc8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685191665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191665, "uuid": "3f96552a-961c-4634-92e2-ca54f275ca9c", "comment": "Malware payload", "value": "0a5d6ecc8c840fd6b70fb24b35448dbf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191665, "uuid": "0e0427a1-8c66-4d9c-98fd-5f43944006a7", "comment": "Malware payload", "value": "dbb386eeaa583f17d17406c6956fc9eae88e71d78ed0e9eae38130c3f5580f19", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191665, "uuid": "6e6cdf64-a8de-412d-8026-2d44a681df0a", "comment": "Malware payload", "value": "a80a3d95174c0453c9891c000404e07b34e809f4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685191665, "uuid": "d1912017-f7d7-43ed-8ed8-4d77736fe93c", "comment": "Malware payload", "value": "eef5cdd787649b8c4c351f34b4eaee73ea50f5adadcf582ad988053b1f3e7c49bdd22e68c17dcea728e5df98ac562256", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191665, "uuid": "45c0e230-5f64-4132-9936-840f61c999dc", "value": "T1B6417BCF00A99481C904CBDE7B571E695409A2DD1EAFAF8B7DDA0776D8C820C3060BDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191665, "uuid": "5b463405-ed2f-48b0-9641-a789d485de0f", "value": "48:mkSkhk8k3rkwkek5k3kKk5k0kfrkIk2khkVkokPkqkpkOkYkjkZ:dhyfALVqUZq3IDNy+js56lzIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685191665, "uuid": "44ef3945-0bde-4ac9-8796-d4226690b48b", "value": 1959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685191665, "uuid": "085ca9ed-4d2e-4a0c-b598-32403b4f82c5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685191665, "uuid": "82fb09f0-2160-4d3d-8e99-a04e6cc9c224", "value": "go", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e04a4c95-fc73-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685181013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685181013, "uuid": "946dd834-160f-4f43-9657-505e0735fdd1", "comment": "Malware payload (RedLineStealer)", "value": "f55dd75fc219d8e2c1d0a6cb795aeca8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685181013, "uuid": "3490a1d2-7f41-413a-90d5-dea2337a3e99", "comment": "Malware payload (RedLineStealer)", "value": "dc84958754912713935f904b16771826b922b041669504a1fb8c1f1c63ce9165", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685181013, "uuid": "95f2c997-71b1-4542-aee5-7c4d713c391f", "comment": "Malware payload (RedLineStealer)", "value": "070fba3cd57dfb177a4d37efcd69325a82ce2b57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685181013, "uuid": "d7adabce-76d2-48d7-8592-8125ce8e196a", "comment": "Malware payload (RedLineStealer)", "value": "24e5192a4682cd56ce1b56e12ecbf90bd9b52581f3beae9697d1f99295a5c67c0f778f052f4ee0414c691a9aa32f596e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685181013, "uuid": "a9fd63b4-75b1-4afb-a94a-e805e34e5975", "value": "T1EC847C0392E17D94E9664B339E2FC6E8B71DF6548E1937662218BFEB04F01B2D163781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685181013, "uuid": "6409b2a8-2c66-4734-8e0f-a28a195c2191", "value": "697c6731df2df92c82c75859d21c5f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685181013, "uuid": "0b478d14-d8e6-4ae9-8b36-922008dde209", "value": "3072:+sKiqvDR7fmyAhuJ2mteUxuw1HtmSoDz233ZVvdXAqFDkSgpmjn2am3/vWRUm5QM:vxqvdp84NttODz2HHdwqdngISrvJrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685181013, "uuid": "1d77571c-4f4b-4985-a903-16f53268698c", "value": 393216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685181013, "uuid": "ea0e2cac-3678-415c-93ae-c28ef4ffff11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685181013, "uuid": "02ea95f3-370f-4d45-95fd-92e6aaf2bb38", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e7706d-fc67-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685175565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685175565, "uuid": "59be968a-5d1c-4cfd-80b1-54f6f6edabbf", "comment": "Malware payload", "value": "02d6a1a6aa31fa14c1d895b29fff67d2", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "reubhh-fun", "colour": "#FCA852", "exportable": true, "hide_tag": false }, { "name": "sertte56gzxes-cn", "colour": "#D865A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685175565, "uuid": "9b4e5d3f-6bbe-42b6-964f-f441bee41f18", "comment": "Malware payload", "value": "de551b0f1cb2e3563b01ef72942bff8b4e58740d121c3e390d56d472e7868c51", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "reubhh-fun", "colour": "#FCA852", "exportable": true, "hide_tag": false }, { "name": "sertte56gzxes-cn", "colour": "#D865A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685175565, "uuid": "b62524d4-e852-4d5e-a7bf-b58132a6585f", "comment": "Malware payload", "value": "378c10548e568fe29971289975e40d71e6fc1525", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "reubhh-fun", "colour": "#FCA852", "exportable": true, "hide_tag": false }, { "name": "sertte56gzxes-cn", "colour": "#D865A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685175565, "uuid": "348916ab-f06d-4c24-a2ed-451660dcfd11", "comment": "Malware payload", "value": "3e585134a1e92c9e8923310f52294db024611a7ff51f0b63127777e662f1c410cf271a7a1aa1880d086dc01c111132d3", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "reubhh-fun", "colour": "#FCA852", "exportable": true, "hide_tag": false }, { "name": "sertte56gzxes-cn", "colour": "#D865A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685175565, "uuid": "17fee1c9-8d10-47f3-b819-5b10905e5f55", "value": "T1B71100101247BDAC1963F2C275B442902FD74880D05979208B980D0EDFB697A82DF970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685175565, "uuid": "4456c846-af09-497f-b7cc-4e1803b25e31", "value": "24:GI2hH0WbNR8piBlOigEB11fXXfD/uBeDA0MPn:GI2l/bNypGlOzEB11fHfDUe3Mf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685175565, "uuid": "0def9f6f-8e51-44e3-81c1-dd4140ee4f75", "value": 904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685175565, "uuid": "7f0d92e2-723d-47aa-9d86-42298ff76590", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685175565, "uuid": "20b74112-a600-4eda-9d91-67d1b411ee0e", "value": "client32.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1fc322-fc92-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685194324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194324, "uuid": "b8628354-1986-4953-831c-0932fe0c0fd9", "comment": "Malware payload (Mirai)", "value": "f6948af7699d6a955a437ea9bc74058b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194324, "uuid": "3af56845-e546-4bd7-a5ca-f7d191be2b32", "comment": "Malware payload (Mirai)", "value": "de6796a57ecc077f4cd4f4a150b9a531558fcb13df5ce3a3d53d78e9f49a56b2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194324, "uuid": "3bbe00f3-abfc-4af6-9187-b69fc26b33e3", "comment": "Malware payload (Mirai)", "value": "8e9bd0f5eee821e7803edabbe354277fba19bbb9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194324, "uuid": "8a4b6e2f-9a71-4934-bb9a-b0033dd5ae1e", "comment": "Malware payload (Mirai)", "value": "87222138b5ac77ab605d980d272b4b348ebdabb5b2ddcb877bbc54d0015da06a73329dbefec808c89f647005644afdea", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194324, "uuid": "24a9be90-a789-4a53-aa71-f06080954cac", "value": "T17F83970A6E219FBCFBAC863447B38F21975823D627E1D685D15CE6012E7034E641FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194324, "uuid": "79c8fcbd-ab79-4f99-a106-de498c63fecf", "value": "1536:kuME36xlfx7YWOe+9tKZsDFXUusHvT1laedNMe:Df3olpOtKcFXUusHvT1lRMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685194324, "uuid": "85997260-221a-405a-b22e-2bad352b27d2", "value": 85584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685194324, "uuid": "425ed8e9-f4ff-4cbc-834f-e42f19486096", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194324, "uuid": "726030a9-0523-4699-b06b-5a8246c9baa5", "value": "07496699.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a465384-fc95-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685195257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685195257, "uuid": "f23ecdf6-198d-41e9-9ac7-3e5b780eacc1", "comment": "Malware payload", "value": "08419affda8d3d7d65ff3897e726a819", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685195257, "uuid": "df6ae515-e962-400b-9283-6b6212d7d3af", "comment": "Malware payload", "value": "de6a560027e629ce8cfa000fd84a7d0daa1fffb37c9365bd6737f1a92f57dad3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685195257, "uuid": "1e6bfb6a-39da-4cf4-b55b-933dad25fc8a", "comment": "Malware payload", "value": "5223e8b4cbe7075dd6a3d81b6f617ab7ee47d00a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685195257, "uuid": "571ae5b7-b308-425d-ae95-58077c2d11dd", "comment": "Malware payload", "value": "abde0743ccac8dd7136f1bf58b8c708cc9741d005af9ac68802dd37508793514e8af18bc8e64ca8448ac7d7deaaf6514", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685195257, "uuid": "3d30c14a-3448-40a7-b03f-eee5f4d9200e", "value": "T142C51211B781CD92C98D3A7769F9BA40E334F0D31F12421673658FF87E4A357AC886A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685195257, "uuid": "31ccfe0a-4bf0-4292-b7c5-0e732be29500", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685195257, "uuid": "bbc7f9ca-717f-4b37-86eb-955664a39323", "value": "49152:TC2GwK7QTl7G98P8S6bYW5u4AwWAGADe4IugQDBaWpYls8/X+JSQuYHuOjwaWfDu:TmwFG9Ch6bY83AwbGAPDgQtaLX+JSQuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685195257, "uuid": "ef757b7a-87a4-436c-8e00-23aa9bd5cfd3", "value": 2680320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685195257, "uuid": "c1c093c2-529f-49b8-b7c2-86411dd2f85d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685195257, "uuid": "0095f215-99bc-46f6-8b54-5e7fdd38a271", "value": "Azure_Cracked.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad17fd6-fc9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685199633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685199633, "uuid": "df28bf58-efdc-4cbd-b438-3587fb4db56e", "comment": "Malware payload (RedLineStealer)", "value": "abecf408ad8dd1cc83592e368101893c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685199633, "uuid": "341cff28-802f-4c82-bf36-cecc7497431d", "comment": "Malware payload (RedLineStealer)", "value": "e0041e02b1ef4293537eab4a6b0517e33d1ff6995c137b775a117bcda693b910", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685199633, "uuid": "0f5d8916-4c31-48d2-bcf0-413059969f64", "comment": "Malware payload (RedLineStealer)", "value": "697c6697be7db0a6f385fbcedd51dcd24441f1a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685199633, "uuid": "07a17c05-828f-47a6-ac1b-75da1b077136", "comment": "Malware payload (RedLineStealer)", "value": "707fc76da72a39d50475651e2a8d8e53f006071e46107ad76c9f1fc89b70c6fd442b68758c44e09067339078e822ead8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685199633, "uuid": "26b68fe6-9a08-49bf-8e40-e859678ebdec", "value": "T11525235277C88075D8B65BB01CF702D31F3D7C922A7882672789A85609B27C4AE7973F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685199633, "uuid": "e67c1b91-8ddb-4b74-992c-08d3cf75b3b6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685199633, "uuid": "e2cf72fd-1b8f-4f6c-a516-fad33a47bfa7", "value": "24576:yyE948AW28vL7mTeRn9LBKSlxGV4lngC71zPNqw:ZE94x8cgnnxEKgChr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685199633, "uuid": "db0fbcf8-c12e-4707-81e8-6d0446374f14", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685199633, "uuid": "3ac766ea-eb31-4183-84ef-aae9206146f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685199633, "uuid": "6462cd05-8b01-4baf-a6d9-44c47ca7cdc9", "value": "abecf408ad8dd1cc83592e368101893c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb4dea3-fc5a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685169920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169920, "uuid": "ab05e978-f6c7-4848-886e-3d9fe5920d72", "comment": "Malware payload (Amadey)", "value": "f4532d8c17db046e44d47f9ff61cb963", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169920, "uuid": "58fdee64-0c2f-491a-a953-33e107973d32", "comment": "Malware payload (Amadey)", "value": "e01ae26f82aba510a4f8a1e37b1e20794c2e63931ce60d2f2cdbc7f9b89a6870", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169920, "uuid": "36a9ac56-c2c2-4700-b5d3-5386373ab294", "comment": "Malware payload (Amadey)", "value": "48a042dd0e42b7661caacda8d4b50192ba130bc7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169920, "uuid": "ede978eb-13a9-4a42-921a-2b11b3c6689d", "comment": "Malware payload (Amadey)", "value": "cd1dc116f0a77e95342c3c04e4af737bab0646407399dccd954328dfbf928e7072762052f2c2cea932817bcd18504f4e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169920, "uuid": "8bd0d61c-2a7d-4a93-b067-855bb93d9d2b", "value": "T117F42313A6D84973E4327BB1A6F207831B357DE2DD7892BA6305658B0CB36897870737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169920, "uuid": "62b5b3d3-d2c9-4a42-ba82-021d59339f25", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169920, "uuid": "ef57b499-e034-494b-8010-1a5999a54d0d", "value": "24576:wyQ2jsceM0A6OTv5iUoOgceyY8NLk3vSMj:3f02z5ivOgbN22aM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169920, "uuid": "dded6bd6-ed7a-40c9-8c14-7a7cafdaabc0", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169920, "uuid": "283430c4-bc20-4cab-9020-d531984bf49c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169920, "uuid": "78202d8a-84af-4040-82f1-baf16357f005", "value": "f4532d8c17db046e44d47f9ff61cb963.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b31d7a6-fc59-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685169623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169623, "uuid": "5a0053d7-9927-4b57-82fe-1460067bfaa7", "comment": "Malware payload (Amadey)", "value": "cc2bdef9355a9ab2a9dd17b5c617fca5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169623, "uuid": "6b515ef1-ef0f-4601-9402-ffabc86154aa", "comment": "Malware payload (Amadey)", "value": "e061446c3756c9e3f3ee9077010a6ff65dbf3014ee6f62f3e5d84cc6df23d48d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169623, "uuid": "8d5919cc-a814-40e7-86ad-270bfa2b04fd", "comment": "Malware payload (Amadey)", "value": "13b9c3111979a6ca2f5164dd7f5519fc0ef747e9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169623, "uuid": "2bb28621-a157-45e8-a17c-c0925f85f4e6", "comment": "Malware payload (Amadey)", "value": "2910ddc5320cde9d784d440858e1b37dcbb3e2672b0c7fef299e717b8081981f95f49487430a91b430109a8785ed4be6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169623, "uuid": "02bc3a52-1563-4b0a-b4e1-696dd315c99c", "value": "T105F4125277D98433EC7153B068F70783173A7D66AD78832A274A959E1CF3786B87032A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169623, "uuid": "7389a676-430c-41c0-b44c-d05f2e592566", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169623, "uuid": "57b6b37c-8efc-4b3d-8f6d-5f1d68643b10", "value": "12288:JMrgy90Lt3bXF3krzR0kSTmq4uGUKPKp/+m8T9i3+jULk3NTNSYWu:Zyg5tD3GhY+m8fqk3nSY3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169623, "uuid": "c078e622-b445-4dce-8a98-cd774f24f1df", "value": 790016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169623, "uuid": "e8fc189d-5571-4e5c-a59e-8f8136c3fae6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169623, "uuid": "1f3903a2-ca67-4c9d-b07a-3939f475f3a7", "value": "cc2bdef9355a9ab2a9dd17b5c617fca5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b56436f-fc69-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685176522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176522, "uuid": "7baab970-2185-4dc6-898d-de0a9ced4f16", "comment": "Malware payload (Amadey)", "value": "4a8efd277dfa702683154de147639ffa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176522, "uuid": "10c2dbf1-1d5d-46e0-ad89-5e400fba477f", "comment": "Malware payload (Amadey)", "value": "e077d4d6c6a46d4ddbe97bcfe2a293c6b334f01ef8c98cd12a382b2f2709908c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176522, "uuid": "52647362-8db9-4032-aac7-49bbe9c678ff", "comment": "Malware payload (Amadey)", "value": "ac7c237a7f35f1e6f81e1ddd22ba8380940d8cf1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176522, "uuid": "88d9ac86-cf7d-44bf-9754-b027cee01524", "comment": "Malware payload (Amadey)", "value": "4c6ac65a9224ef71fce03ea6d402fec4f6e1e58c0b979411496b7d9a3c54f433c4a52dafd24294eafc22ab3931214b09", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176522, "uuid": "9db938e7-962a-4579-b334-c169641f29d6", "value": "T1A9F422536BE80072EDB21B705DF206D31B3D7CE2496D46AB275225DE1CB3685ADB033A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176522, "uuid": "6e997f67-be9e-4f4c-85f9-21d87144358a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176522, "uuid": "a3d61603-2776-4e36-8ee8-2849eb10759b", "value": "12288:1MrIy90DpYh0z6byWyHfJ8tlYX+bYoFmX8doC3HNY8l9q3+M0Lk3NT7SzDL:tyKSh/oHR8taX+H89SHNY8JBk3dSD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685176522, "uuid": "6e3c5bf5-7b9b-4280-a7d5-2ec08a4b68a6", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685176522, "uuid": "50b3bff3-f974-45f3-9818-c0631d30c689", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176522, "uuid": "ff9a438d-42c9-4a42-850f-8d350e07df1f", "value": "4a8efd277dfa702683154de147639ffa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1022ef4-fc57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685169015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169015, "uuid": "d04d0591-a954-4ff1-80f7-1139b41408a4", "comment": "Malware payload (Amadey)", "value": "5ee1100a8f9e7dbaa82152dee3f31fbc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169015, "uuid": "bbf93547-9de3-4fc2-9398-71419c929146", "comment": "Malware payload (Amadey)", "value": "e0a19c76b235689a5b583e757f7cfcc4a9b2d962934f4b10d75e8a8e0db41a97", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169015, "uuid": "e44f5c5a-a4f2-4aaf-bb00-8497648ea7e3", "comment": "Malware payload (Amadey)", "value": "db98acdad90a5acc00457d8fb0b2dbf09366ee2b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169015, "uuid": "464bcd2d-f4e5-4f9d-8dc8-d836c0277fa4", "comment": "Malware payload (Amadey)", "value": "68c479b3dd8d5828dc823e0e30f43a96a9170106a0d38702fd6a6b0db6819b7a1af92d2096998d50f199522fc058025d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169015, "uuid": "96ef3a37-5c31-431c-90b2-8f90407bbdd0", "value": "T165F42301BBE88533D9F677B084FB06C70A3F7DE56974826B2746559A0CB3549E8B1323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169015, "uuid": "9ceadb29-443f-4eae-a44c-28d0a092295b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169015, "uuid": "2c68014c-7926-4854-b4c7-16e0d84e8d41", "value": "12288:yMr5y90Ffv1kH0sMXjVh4fDlWi/pLQy7iXApx3XK8f9U3+eJLk3NTjSi:by0fveH0NVh4ZLZDOAXK8R0k3NSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169015, "uuid": "5a44c297-4d1c-41f8-80ec-346e6eff228d", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169015, "uuid": "a4acd062-9d6d-4430-9cff-a4c8aad86fcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169015, "uuid": "1be180d2-b10d-4665-a100-afd13a28a0ae", "value": "5ee1100a8f9e7dbaa82152dee3f31fbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218bc75f-fc35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1685154064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154064, "uuid": "9a4b2c72-844c-45d9-8131-3908409f1d51", "comment": "Malware payload (Stop)", "value": "c4b07a607dd72f3b1a90888d7a2a1117", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154064, "uuid": "83e13627-148b-4a42-94ad-06d43f7f31f5", "comment": "Malware payload (Stop)", "value": "e0b19fdb0801b1860118fbdfee976cc6a426fc79c1625c1480ee405a63b98b63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154064, "uuid": "237be392-19cc-4a1f-9a16-edbc86806748", "comment": "Malware payload (Stop)", "value": "71b20db3e2453dbf2443b0d626deafed846ce47c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154064, "uuid": "196cec8b-35e1-4220-8ffe-4901a9756caf", "comment": "Malware payload (Stop)", "value": "85b2becfd282a252c3ae6b52f47a545763323759b5dc76a13f5950efae90ee18d445dcc45c8369f01e98d04ad7d818ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154064, "uuid": "0556206d-cfca-4551-97b3-f1e85d708de4", "value": "T1D505E00392D17C94E9628B739E1FC6E8772DF6548E097B651228AFEB14F0272D273781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154064, "uuid": "b877852a-746b-42b3-bd0e-b1e648191362", "value": "5ea1866af0e097b7b73a6d1cadb8810b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154064, "uuid": "28c3776a-74bb-4a97-bde1-7c398cf0f99c", "value": "12288:N7iPz8DzLCl37l2wK2ogFwMVOQRq23PKile9fGkMcwQb/2iJ3kEZZ0dUC:RiPiWZw2YmxDle9fZ5lZ31ZZ0uC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685154064, "uuid": "cd89d491-5720-406b-83a9-7782c58d0493", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685154064, "uuid": "9511d7c1-459d-428a-921d-5350c7294294", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154064, "uuid": "c50164bc-ff67-4a80-9d08-ea2285718cf7", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09be1cb9-fcb8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1685210288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685210288, "uuid": "4edb18dc-87ed-4a0e-922f-a42715d3908e", "comment": "Malware payload (TeamBot)", "value": "7069c1fc5b3a3dfde91e09dca6c175f5", "object_relation": "md5", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685210288, "uuid": "63b552eb-ab80-4228-8bee-405cded842f6", "comment": "Malware payload (TeamBot)", "value": "e4cd79a7adcc7c1f587a938d418d4e224e3f2cbc5979a35107cb1c1fdeb707fb", "object_relation": "sha256", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685210288, "uuid": "c3aabb60-56c9-49e8-9066-b23e63957f75", "comment": "Malware payload (TeamBot)", "value": "5f372b582e571b45ff960d1cb677211e5e801ad1", "object_relation": "sha1", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685210288, "uuid": "5ef9c847-36fc-45d9-bad0-906bbc040988", "comment": "Malware payload (TeamBot)", "value": "02b3f9762913f85309ab7f5fbc318593c8be24e2095cf0daaebc7b7635c93b166cdb58e8720987874075848ee19a895a", "object_relation": "sha3-384", "Tag": [ { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685210288, "uuid": "1f36c268-1621-4e58-91c2-4938f4a023fa", "value": "T1BE05E00396F2FC50DD664A728E2FC6EC761EF150AE197B7A2119AE1F44B02B2D173712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685210288, "uuid": "dd78fad6-3910-43d0-9e0b-ab8bd3f11261", "value": "82b2bd7dc938b719df57a6b2df186152", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685210288, "uuid": "691273e0-09d4-423a-9510-3e3239be19d6", "value": "24576:RWC/ItMKpQbTOZk7Q5R+k2xQiOBCNxzHPuIMLFK:ACwS8sOUQD+k2SifJeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685210288, "uuid": "b49c5d41-184f-4061-be8e-ec150184ebef", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685210288, "uuid": "2bfa65d6-25a6-4a75-98b3-d2f9e7c0dbb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685210288, "uuid": "00f2ca27-454f-4a01-978a-349751fad2da", "value": "01169399.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb0fd67f-fc33-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1685153570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153570, "uuid": "2af4def4-b99c-49db-9635-ebf70beeb364", "comment": "Malware payload (CoinMiner)", "value": "5422229fb73b556e34c950a237521e12", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153570, "uuid": "5c1fde58-2c4a-447d-b15f-9d9824293df0", "comment": "Malware payload (CoinMiner)", "value": "e772862c5c554d912f0ed4972268c4390bc663401f1864a85953b65237087ad5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153570, "uuid": "344f7382-9841-4bd2-a832-f8a8fdba41fc", "comment": "Malware payload (CoinMiner)", "value": "db1dd1f3674627b28606d73e392aec464eb6dc46", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153570, "uuid": "a92e6c66-a362-4c77-972c-939215c8f16a", "comment": "Malware payload (CoinMiner)", "value": "2d7e4ef2fdd892b5f431da372dd34d1417fa890f1a26e08880fb155546098373562aecbc3b45c7221842e5ee378c4a4f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153570, "uuid": "6bd75a11-7eb6-496d-ba39-abdc82cad458", "value": "T140A69DF319D1668CC8D3C0BEC657BDBE828F70F9CA11A5AB942DF121AD57C087552B88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153570, "uuid": "b4ba1f2d-dfce-4192-8e3b-85cbb188b0e3", "value": "35a81d16af9f2ba6d515f11152d0364b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153570, "uuid": "dc5d16e1-0ea5-4210-8d28-af891629e379", "value": "196608:Z3ehppCu5upX7JuKUklqDSPRW6DhMuMu2gaavbOfpwku:Reh0X7Jddl7P469M5a6SX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685153570, "uuid": "b69fcf70-31fb-4e9c-adff-842c2e1e9da0", "value": 9999232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685153570, "uuid": "951d8ed8-d01f-4aef-b7e2-e9d7c18c1695", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153570, "uuid": "bab192bf-dd2f-4ef1-af32-df93dfe7a0bc", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d08e720e-fca4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685202032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685202032, "uuid": "90d1720a-0b93-412d-a6c7-96b5e93251d2", "comment": "Malware payload (Amadey)", "value": "26fc30419404e5816337bd3bc9b25734", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685202032, "uuid": "1b821aa8-c5bf-4d60-aa88-ecefa41eb3fd", "comment": "Malware payload (Amadey)", "value": "e9ad1945a370e43d2c70049e52caf3c710dbf4ed051ec0ffd91bb79f8e152aa5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685202032, "uuid": "59725fe1-1e82-4d66-967a-23ad71194928", "comment": "Malware payload (Amadey)", "value": "46ba95002d740fc3e9ebe4150c564b95f2347f0e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685202032, "uuid": "64e9344b-6a38-42c9-8003-56351f33ccb5", "comment": "Malware payload (Amadey)", "value": "bed99a48a9c8f2f0ef1fb6911589824d2adead5f480989b83bd532c70eb1c0637349fc950ae2f912727d77374111a1b3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685202032, "uuid": "071c46bb-0f3b-4cef-a48f-c1cbd7875e53", "value": "T12CF42207FBD94431E9B127701CF761D30A3ABCA119B8932F3355AA5E09732D9A8B1367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685202032, "uuid": "593ab5ff-2821-4ad4-8f63-aa59ecb43b12", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685202032, "uuid": "595548a0-8667-4044-90ea-b3ad208bbe89", "value": "12288:BMr0y90VdKqLs50OEDb2VTKjqxLjkuJX1HNxOFncyVRSNHi5Hr63bF7UCYeX:NyodjOEX2hZljVJltxOJHjF+btUCYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685202032, "uuid": "cea89584-b82e-49fe-a3bf-2cad5eea9896", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685202032, "uuid": "4933a302-863f-49e8-bb00-cf4991a126dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685202032, "uuid": "02d715c2-c120-4d42-87b0-acfc9faf544a", "value": "26fc30419404e5816337bd3bc9b25734.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6237f244-fc36-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685154602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154602, "uuid": "eefb07bc-d864-47cc-96f1-3503c059b82d", "comment": "Malware payload (RedLineStealer)", "value": "600a2e0c1c1cbbdfb249324a2edbb1b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154602, "uuid": "d61f871c-b194-42c7-87da-fea772323c7c", "comment": "Malware payload (RedLineStealer)", "value": "ebc23b193a6acaa5cc0fb6cc422a804b15b2d53ccd24032e006e93b015a7d196", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154602, "uuid": "5e612f75-5263-45d9-be0c-e631b6e14705", "comment": "Malware payload (RedLineStealer)", "value": "508d252e5a72f905aff371207de4fefa994a282f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154602, "uuid": "641748ab-2f34-42e3-ac70-7982cb083e95", "comment": "Malware payload (RedLineStealer)", "value": "686875a2a53b2c8abcce6606d4e134110f0bd4cfea6005b2a053916992f0eb04bb893bd810d99914e25868b53ddf2d13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154602, "uuid": "e0bfc59f-00bf-48d7-b3d4-b3ac285a96f2", "value": "T113F42323FAD59432D9721B711CF546931B3ABCA36CB8871A134218D61DF3299EA32377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154602, "uuid": "c7c8b20b-b223-4110-bb34-78fc5e511712", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154602, "uuid": "0c4c26b4-c69a-4a4d-b33d-714542156a98", "value": "12288:LMrRy90MLLm7/t4LefGJHo5mFL5FZsBVxhJTfY8l933+X0Lk3NTzSAPI:Gy9GmefGJHosbsB7hJrY8G2k31SAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685154602, "uuid": "772d6989-2f1a-4d39-a71d-bae3b8a4f6d8", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685154602, "uuid": "663bf5f5-d614-4608-a6c2-708279b62b21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154602, "uuid": "6ac14659-9863-46ab-8f89-7d3cd7213132", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8201c54b-fcac-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685205336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685205336, "uuid": "7a3cfbd4-0d6d-421e-b797-153aa5fb7467", "comment": "Malware payload (RedLineStealer)", "value": "c4f648fa6e0a2761cf705182d9c11bb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685205336, "uuid": "43d71840-1788-4234-943e-4cd652f5b70a", "comment": "Malware payload (RedLineStealer)", "value": "ec666c76c27338ebacabe84b9576a8f07cdeac95d06911cd7da0dc700ff5da2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685205336, "uuid": "7a3383df-3850-4605-9de1-2d3ca785333e", "comment": "Malware payload (RedLineStealer)", "value": "24c75a161e4a416f84ce61e6b1f25e11b8398aee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685205336, "uuid": "c6ec164a-61f8-4f1a-86ed-818b0513b5da", "comment": "Malware payload (RedLineStealer)", "value": "6292af91fdf8135d6d6d6d7f053db6459aa5bf9adb9b7d295d5c12ac62ae12ad4cd7aeb1364fc7798795626360829785", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685205336, "uuid": "f2858a0c-1b4d-4983-aa51-5cb0f70e52e9", "value": "T1D7F41216B6E88532E9F1277019FB02D316327DA15D78976F6B95AC8E08F2784583133F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685205336, "uuid": "00159066-4068-4d05-9eb0-94c3c7516a77", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685205336, "uuid": "d4f74034-43d5-4f42-aea4-0899f24b0afd", "value": "12288:yMrPy90izPAOC+HsQot4eGIXI4qWt5s5zskxUq17wdNU9D6MkCQw7jCl5OCtjqb:dyBzsQoMcI4Rt5s/uqOdO9D6oQwvg5O1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685205336, "uuid": "4e542437-bcc2-4c91-afc0-e7b4a88f3cd3", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685205336, "uuid": "70147df6-d06c-4716-8b81-4b8e94012ea8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685205336, "uuid": "4b06f7b8-7cc3-4ed0-93a2-90a1c950efb9", "value": "c4f648fa6e0a2761cf705182d9c11bb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f14326a-fc6d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Glupteba)", "timestamp": 1685178192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178192, "uuid": "720cec66-91a2-4638-b751-ddddb8479789", "comment": "Malware payload (Glupteba)", "value": "0a500ea23a2c1869c2671a5da7b6dca7", "object_relation": "md5", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178192, "uuid": "c6421de9-373c-4447-bfae-2544a8656c2f", "comment": "Malware payload (Glupteba)", "value": "ec96d250ef6627e015b9bff2d6b7f843a58191114e15ac77b53e27bc23708d81", "object_relation": "sha256", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178192, "uuid": "1b139cda-9462-41f0-bde9-aba15cb80134", "comment": "Malware payload (Glupteba)", "value": "6161dcf0bd9f1e45d3371c74636f39047c5b324b", "object_relation": "sha1", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178192, "uuid": "59b13b94-ca13-4a25-92fa-f4b0b23fd822", "comment": "Malware payload (Glupteba)", "value": "3bf671bdcd04ce6b9e7c29e2f96496eb49b492f5498715643f35bf1962d9d23d56da8fc006cef10a490f4322d5116d78", "object_relation": "sha3-384", "Tag": [ { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178192, "uuid": "29d57b02-80e5-4b15-8fbf-c3b8819ab921", "value": "T1DD16234382D07D95D56A8B33AE1ED6E8BB0EB6984E5D773732192EEB14F0063C173291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178192, "uuid": "2d075a7a-90b2-4408-85c0-933321021aad", "value": "697c6731df2df92c82c75859d21c5f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178192, "uuid": "2e0f0a7c-4a6c-4bc6-942c-3a5e11b05e1d", "value": "98304:/wwnuY/s3I4HHAgK5AvrW46hqyBPHtRMqZ37b:/Rnuw6Hc2rJeqyBPHtbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685178192, "uuid": "cf05af21-8675-42de-a77b-b5dc8ac9cb06", "value": 4386688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685178192, "uuid": "68a30717-f0b9-4224-8d98-6e8e38049931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178192, "uuid": "07503312-05b3-4387-bd28-efcb4c132dab", "value": "08274199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "147ae236-fcc2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685214601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214601, "uuid": "81358e85-3be2-4608-8135-75646c19a255", "comment": "Malware payload (Mirai)", "value": "36e286e3d048a5b6f86f03c2146fe718", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214601, "uuid": "5f8a74e6-edd9-4fd1-94ce-94d693b7d825", "comment": "Malware payload (Mirai)", "value": "ecad0221984f7544e3e5edd6d423cb02018e279e3fe8d31656b62b864e9d9238", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214601, "uuid": "b1e58c15-d137-4bd4-a88f-155cbbf71d72", "comment": "Malware payload (Mirai)", "value": "18b83f7daca164f66dc619ffc7f3f13d2b9d9b3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214601, "uuid": "ff7c2e3f-642b-4984-bf3b-3775f7db27d2", "comment": "Malware payload (Mirai)", "value": "116998f71add039cca1f72949fd14360a98e570b215f563d6a0f91fc37d15ddf3955e73bca059b765e8fd32550175596", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214601, "uuid": "99638900-30ad-48be-8518-afaea9c7e304", "value": "T1A12302C581320B0DC5B8933F1577C1EDFE7EF18720464D9D2D9902BDBB56493E19A982", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214601, "uuid": "784c7742-0dc4-41c3-82f6-0616fcbeaeb0", "value": "768:1zKu//wcMf7k6NoB+OIAb3aWU7GXU+RFPChHKYoQQeuJmdl9Dg3y0wdRqt:pKu/zMTk6GB+rYmGXHk7oQQe02Dgi7RA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685214601, "uuid": "fb013676-7fb0-43ef-94e6-8154d13c065f", "value": 45596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685214601, "uuid": "883c73ff-e1fb-4ff6-a763-58a0f823955c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214601, "uuid": "29989ba6-a381-48a4-b6b3-2ba9e4e766e6", "value": "36e286e3d048a5b6f86f03c2146fe718", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1833ef26-fc5a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685169940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169940, "uuid": "d1345e7c-cfb3-4fc5-9999-ad007600213b", "comment": "Malware payload", "value": "048697326b4001cdc905fee7b5428242", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169940, "uuid": "b1cf1285-8c9c-4c40-843e-90a2e5149f9f", "comment": "Malware payload", "value": "ed693d91bf15dd9a38ed00bcef4921247d994db66dbd9ca6635a3f031e127dff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169940, "uuid": "132fa15c-02c0-45f7-8f81-bb14dac6870a", "comment": "Malware payload", "value": "9486466633a11e56ec3a24169d771e966ebf0197", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169940, "uuid": "5b215573-8837-45d1-9c1e-228edf874a06", "comment": "Malware payload", "value": "f21098815be03f66aa54833117dd9dad1e9a09f91b52c9f1bce87411b802962d9e207570a7b7fd0f77895330cfd3fb53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169940, "uuid": "b354335a-ede7-4ccb-b6e2-c62827979a41", "value": "T1F28533E0D84A454BC6D9FDF91811B80AEC7205E9AD014EC3A7B84B3FA253579B39EC64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169940, "uuid": "be19d1f4-50ec-460a-af4c-6d914c16d59d", "value": "49152:H2/8KnFhNsBZNNUGVhNwOpHQz+by3yVcL8l:GFhu3bVhNZpH/WoJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169940, "uuid": "6de3285c-cf7e-4fdc-b1b5-0e613b8289bb", "value": 1778135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169940, "uuid": "f37fc58a-6f7e-46b4-a341-06ecdedf01a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169940, "uuid": "eea39d24-c0ba-45bf-a075-410337515026", "value": "048697326b4001cdc905fee7b5428242.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec58748-fc57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685169011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169011, "uuid": "ec67a7f9-6c67-40dd-acc1-11f82654e68b", "comment": "Malware payload (RedLineStealer)", "value": "33f8c55c88da8a69355a79e97d16173a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169011, "uuid": "d39cb9ec-d38a-4bda-8429-22a3596eec12", "comment": "Malware payload (RedLineStealer)", "value": "ed9b564969390a04e84f7a29bfaf414ba7a97d4a54dfbffce04b635bfaa4e735", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169011, "uuid": "8ac88b5b-ab4c-46c9-833b-f0c13424c5ce", "comment": "Malware payload (RedLineStealer)", "value": "4541ebbfdad81bf191fcfed3b2bf6094343556f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169011, "uuid": "5faf3e8c-e2fc-4fef-8e63-278c68c4508d", "comment": "Malware payload (RedLineStealer)", "value": "0e36573355700086068e8c3c430807655dbe3eec016f5a0ad975544fbc20126ad387fb5e3e52f6f7261ab1d1c33796a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169011, "uuid": "b303fa78-e1b7-4c9f-bae3-03953ef45aab", "value": "T123F42252F7E49433E9B217B018F712D30B3ABD929C79912B7781699A5CF2284E870377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169011, "uuid": "8ffe83a3-316f-4a32-83fc-561e3b4dadfc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169011, "uuid": "b39cfb31-2409-42b0-945a-b4002b2bc80e", "value": "24576:YyT84ns4wNEBJ38gu5yaD07fY3DGY8Vbk3VS6e:fT84P2graYrEDxamM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169011, "uuid": "a5914e0d-a58d-4162-9b52-71749ffb6948", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169011, "uuid": "c9c5cdbc-3a44-43dc-9453-0c16c52e0d22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169011, "uuid": "f1a595f3-98d7-4d16-8d19-60016dc4578b", "value": "33f8c55c88da8a69355a79e97d16173a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f830354b-fc91-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1685193938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685193938, "uuid": "44f90937-73a0-447b-b257-b5496d89dd6d", "comment": "Malware payload (Smoke Loader)", "value": "87641eb4d8783686b34d52333ebd4604", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685193938, "uuid": "8a7fd048-745a-4044-8e36-c4ff8a0c225c", "comment": "Malware payload (Smoke Loader)", "value": "ee4501d351654db6a21ac5f654ba016223c5724de884ae85b06185a89dd31658", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685193938, "uuid": "97a4e9d8-f165-4237-b2a7-5ecb1462c3b8", "comment": "Malware payload (Smoke Loader)", "value": "b927166244e8437e5f5ab8a987efa39d4ec2df91", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685193938, "uuid": "05688c66-c23b-4734-8c50-285f192c634e", "comment": "Malware payload (Smoke Loader)", "value": "95656c3fd7c8e11f3fd41616b49a56d4a9ecd2725d843891160c547e18a84eda2ca0d0e39cfff3653cc068fd6a8fddf6", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685193938, "uuid": "dda35d1f-767a-4379-adb4-85824e107153", "value": "T1A6543A1392F17D94E9264A739E1EC6E8771DF7588F09376A221A9AEF04F01B2C173781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685193938, "uuid": "810aa37e-15a5-40eb-aa5e-3262fec09181", "value": "697c6731df2df92c82c75859d21c5f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685193938, "uuid": "04dec2f3-34b3-4023-8507-9c2fd843ad5f", "value": "3072:ypgzIIhj1DK7/VoTPrPvh/bEr5TjD4mKDPUm5QP9Ni:OgzIKDK7/Cr3xbU5X7K8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685193938, "uuid": "43e7c6b9-ebbc-40ae-b035-ec989b9cf199", "value": 298496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685193938, "uuid": "c7f54af3-cde4-404c-b1b6-156fc502dad3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685193938, "uuid": "b7db2fb5-e38c-4def-b38f-4bf3a821f984", "value": "01294199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3146d90c-fc36-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685154520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154520, "uuid": "5b495a8d-5c7d-456f-8131-6a3992862cbc", "comment": "Malware payload (RedLineStealer)", "value": "e39df0311c14c327979d64ca130f069c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154520, "uuid": "7ab3cc3d-0d2a-4fee-8135-653c5b2cbbbc", "comment": "Malware payload (RedLineStealer)", "value": "ee7638312abd0dbbb6eed3c66196fa429fb6536bc401121a3e09e79854e85114", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154520, "uuid": "e6809348-b890-4ac1-b407-db47a31cb52a", "comment": "Malware payload (RedLineStealer)", "value": "71aaf0812b50e8fb482bea911899bf5d064f38ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685154520, "uuid": "59f5bd8a-7ce7-4ad3-8de6-d7061cd85e78", "comment": "Malware payload (RedLineStealer)", "value": "493ebbec8471cc310cedef2d083842be9a2fe30194edb72dc9328a8a2115f1dc8d4246ddb454734ff885990ab4d66c8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154520, "uuid": "c3d3dc49-c5cb-476f-8811-ac212ee3d88a", "value": "T100F41256A7C4C173E9B65BB018F346C30B39BCE29CB892A72301595E1C733D6A57632B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154520, "uuid": "f53a5812-4d36-4037-8e2f-84b8e9dd2048", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154520, "uuid": "175af58c-c9d2-4b0c-8cab-3dc057f574a8", "value": "24576:Dy7YJrLgTROXUEG2egukJs+MeYCd+m8ONk3dSuM:WsJrLqROkngukJsIYytAUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685154520, "uuid": "6764691f-fd25-4021-93db-46012d539a93", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685154520, "uuid": "bf1debb6-97e1-47ab-bd4d-ff3acd95d383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685154520, "uuid": "ab5acbee-724d-4730-b095-01262eadfcf6", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f59ee4-fc6d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1685178116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178116, "uuid": "c0bf9110-974c-43a1-a101-f3166ad96857", "comment": "Malware payload (Stop)", "value": "d55b1a9e3506e4082797f6dd43c9805f", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178116, "uuid": "ce1b62f9-c972-499f-a0ac-8c9512804198", "comment": "Malware payload (Stop)", "value": "ef0400469910cc9285bf258af7f59f93c3bc73a129685c51019be5cbefd5e9cd", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178116, "uuid": "1aeb246e-d458-4def-8869-3a74b1eef42e", "comment": "Malware payload (Stop)", "value": "b9c2c536fc8b498b82e7454f8dfce93817708f9a", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178116, "uuid": "d64b6d21-5bac-4e29-8d04-bb91fdde1375", "comment": "Malware payload (Stop)", "value": "2c7cd6312dad44d5f098b85115e328da0efb41a944a1c5b3d1fffae4462e5d5eb7a430863f5a0913c964fc73670a415f", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178116, "uuid": "bac37556-acaf-44fd-9070-79b92ff611fd", "value": "T18B05E05392E17D94F9264A339E2EC6E8731EB6644E493B6722085FEB04F01B2D1737B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178116, "uuid": "43875840-5984-466c-af1a-e4eae8f95f95", "value": "bd191f6a78cc98a8bbe61db18ad8e9a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178116, "uuid": "480dc757-ac0b-43d7-9bf3-8b3e49cd27fd", "value": "12288:QDKOvp4hNvpyraXOVuskkOhc0J/6tKg2Ne7B8:1Ovp4hRzquskxW0k+8V8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685178116, "uuid": "28ff6afb-2040-4a06-9ead-c40e595e2287", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685178116, "uuid": "e6b47384-7a47-4f3f-b808-f9524c59e518", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178116, "uuid": "2622fb43-6061-469a-a296-ed504ff428f8", "value": "08023599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a50f2e9-fc33-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685153273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153273, "uuid": "d25c0a79-2877-4fc7-afe5-166b452f873f", "comment": "Malware payload", "value": "f75e7dcdd30bb326e01f01df143f6425", "object_relation": "md5", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153273, "uuid": "6dc86e61-44ee-48e4-83c6-24ff8d19fb30", "comment": "Malware payload", "value": "efbb83a531b88d0820d36410356cc4c8deef25deaa8da351a963dd51eadf8048", "object_relation": "sha256", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153273, "uuid": "0ba27a19-cfcd-487e-8bcf-6276d38700ea", "comment": "Malware payload", "value": "0e7a7c7abb5df0b93935e7e1bf6c620040c49b20", "object_relation": "sha1", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685153273, "uuid": "6ef1879a-a691-4ba1-8b03-568fd2f369fb", "comment": "Malware payload", "value": "bd27ac3fbfcb47db6772b2e352a1bfff5c358daae2eb6faf6b15316b9758a4ea162dc5dc9833538ad5b544cf4d427594", "object_relation": "sha3-384", "Tag": [ { "name": "159-65-42-223", "colour": "#AF2E10", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153273, "uuid": "a596d80c-1b5e-44b8-9e4f-1a67e2275447", "value": "T160B41256CF681FAE6D5807884C945E8F4CCEAD222832D5F4D3EF701F862DD950639E2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153273, "uuid": "1b0e04d6-21b6-478b-a363-9e9cac254090", "value": "12288:mla6QGjDAqEgMGmyvZIojQZ4gtAm2m1M7O2DZ5NXBci4LDmL:mlllDJBZgtAxO2l5NR7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685153273, "uuid": "7c57bd39-c6c0-4ed4-8bf9-b6f536ada7a9", "value": 528295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685153273, "uuid": "d050bb7d-dcbb-4c09-b17c-ef28518765fe", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685153273, "uuid": "750fcbfc-1d05-41ef-9736-39ea6a0498bf", "value": "May10-Invoice-DocuSign-91218.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb5ee92-fc59-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685169897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169897, "uuid": "5f394878-786d-4fb4-8d17-dca520cae70a", "comment": "Malware payload", "value": "07f60efb71550868adefaec2b573807a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169897, "uuid": "73deed87-e4de-435e-8bab-8a950befbd25", "comment": "Malware payload", "value": "f11112612aa61b6a1b2fde664b1a1eb62f126dd8ad0749ad89bb0751640cd31e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169897, "uuid": "990dd57e-6e5c-4464-90a9-f16aa576e33d", "comment": "Malware payload", "value": "9b5fb2bac75495b21be8d376f15d11dc0e3e25db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169897, "uuid": "4ae34a0d-0535-4880-848b-166c481bfc3b", "comment": "Malware payload", "value": "dad668b6129e67bacc1109bb6df19cc71deced59807c87727b36268c1e3ca02a79270765525e86eff8cd01ea558f6e9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169897, "uuid": "e17a7755-df2a-4ea4-b0e1-a8903b7bf103", "value": "T16FF41203B9DC8033D5B12B7058F703D30F35BDA19D74922B1656AEAA2CB3690E876776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169897, "uuid": "307d754c-3161-4e7e-962c-a4d3ee1686cf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169897, "uuid": "040caf29-c6e3-493d-9af3-5643f94c8dad", "value": "12288:BMr0y90wyg77S+gie6x/bb/mu5KwTsvFWo+ye8/Sn0kBMonMLtIW++EK52AWSC:Vyi+gYeu5lTsvVLH/S0kmoML1+aoSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169897, "uuid": "0e6d98fb-f91d-4df3-899e-e1341e126b6b", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169897, "uuid": "6068947a-95b2-415f-aabd-df9108a5607e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169897, "uuid": "11ef7bed-c7d8-4f77-96d7-4dba57725be9", "value": "07f60efb71550868adefaec2b573807a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a24471cb-fc58-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685169312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169312, "uuid": "cf0c7c7e-94a2-4453-8e81-bbe97f1aca9b", "comment": "Malware payload (RedLineStealer)", "value": "611109a3ab21ad534a1eea7d12f08aa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169312, "uuid": "f33a7ce3-8558-4094-879f-852bf98bbbc9", "comment": "Malware payload (RedLineStealer)", "value": "f50e9fb6f761ece803b76c35878dc19e8dde3b6b90ddf0f949b44853dd0de21a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169312, "uuid": "33b53ca3-a905-4015-a615-9108edd74ea5", "comment": "Malware payload (RedLineStealer)", "value": "35e659192aa124663addc6ef3dc542503f346ded", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169312, "uuid": "812f0e3b-b2f2-493d-967f-f0f1ebd52c6a", "comment": "Malware payload (RedLineStealer)", "value": "702ac1f7f31190f8c47da8236ccaa9d8b8537a45be071fef47ec6f6c7176db6194a28baffca4cffccb20376c90445914", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169312, "uuid": "ce948ae4-ccca-4156-9d6a-df94690d6978", "value": "T1B0F41203A7F44532E8B217B058F34787173ABC621C7DD66B3711B99A29B228579B6333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169312, "uuid": "6bca1751-cd37-4eda-8d39-707e0a6a5a0e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169312, "uuid": "44c672c5-d780-437c-875e-67c796d4cdb1", "value": "24576:IypcNcauLJ4aWugRaG4XnnK/toTC8Wlk3YSLT:PaWLJ4igGaVLJovL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169312, "uuid": "66a4a570-8f27-4289-a1cc-c48d3e71a955", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169312, "uuid": "ef9a7dda-30a5-4931-9a9c-056f568172ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169312, "uuid": "c40c5c7a-bc21-4198-9618-37ecd01cd7fe", "value": "611109a3ab21ad534a1eea7d12f08aa1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5784c97-fc92-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685194228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194228, "uuid": "14f12051-1133-435a-9f85-62070d2a995b", "comment": "Malware payload (RedLineStealer)", "value": "d83496e69631c569c558e6ea6f6243c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194228, "uuid": "e9b72798-0f89-48c2-a673-749d2013be4b", "comment": "Malware payload (RedLineStealer)", "value": "f5b2ced8fd451a3048af7421e48b3827099c142dbf580e5a43890152a613f8b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194228, "uuid": "2701fb1f-e6a6-49f0-ad0e-c61bc633f4e4", "comment": "Malware payload (RedLineStealer)", "value": "3aba82f11db80f0f9b430d2bdf35fa931425f05f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194228, "uuid": "4d8670de-110b-445d-8fc9-f78b7b012795", "comment": "Malware payload (RedLineStealer)", "value": "de58e301e7fdae755599eae38bfdad2d698e47462428cd01f3e7728ae7eba3c3e973c7be454c52ab0e6ac2f5f4befbeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194228, "uuid": "aa405334-988b-4760-b779-84cb0a0c9078", "value": "T170F41252E6E84832ECF2177058F643C32A36BCA14E38476B3799EC591DF258495733AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194228, "uuid": "b7fb9def-06a6-47b2-aad9-142fe12cb55d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194228, "uuid": "0ac5c831-5364-49e1-a18a-2f983e87e8c8", "value": "12288:4MrAy90hV2a+MS5DTmBeZ3iDKPwh5v78GS5rXck0fZDS7yC:oyqV6DD6UZSDK25v7PS5IksU7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685194228, "uuid": "6ed7c436-bdd9-4d9f-aa9e-d9d741ccdf05", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685194228, "uuid": "a6075d43-a796-4d77-a945-fcaf2011a7ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194228, "uuid": "5248425b-2d2c-4f57-8caf-3c76dcf184ed", "value": "d83496e69631c569c558e6ea6f6243c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86742a4-fc59-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685169859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169859, "uuid": "b504649d-0b70-4a78-b681-298e3d48063f", "comment": "Malware payload", "value": "948368e5f4140103102f816491b32d9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169859, "uuid": "bd4358d7-f178-4af5-a869-5a5ee92714f4", "comment": "Malware payload", "value": "f626ecc8d522ab26a0f98d374f89d155b61f467fed1c1d6b79168df72e2a33d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169859, "uuid": "5c3e2d6d-91fc-4605-a692-a8931db42679", "comment": "Malware payload", "value": "9b80e8c7fc1cdcc8e40164e85cb09c6f4e01f813", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685169859, "uuid": "c67e4515-989e-4ed7-8b2f-918d7acb8cc0", "comment": "Malware payload", "value": "7bff0763110965a1183f389b9d3573a5ef17372ec028b5fdf08cf021262ce41108fa1db56fcddbb0a33eb2ddd954522e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169859, "uuid": "7d08ec5f-574c-4054-80cf-1bcd6e629065", "value": "T13A2633027BC181F2E2A11D369779B7212AB4BC211F71DB9FB790B90E9D304D0D625BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169859, "uuid": "b29accbc-76cf-4cd1-8a4d-0ff426f5aae2", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169859, "uuid": "a4ce790c-f9df-4fe3-8b79-b17ca53f631e", "value": "98304:tYiNyDk2BudMpEw74TDqGeRiuBw4i+qPVy9ULYr:iiNyA2Mdnw7CqGeRiuA+CWnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685169859, "uuid": "a7d1dccd-aa6e-498d-b178-a28f81f6798e", "value": 4726450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685169859, "uuid": "37f760ea-8e4b-4a92-b897-9f654ddce568", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685169859, "uuid": "87569a39-34aa-46d9-989f-b4679aa4e420", "value": "948368e5f4140103102f816491b32d9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817a7337-fc72-11ed-b3cf-42010a9c0076", "comment": "Malware payload (LaplasClipper)", "timestamp": 1685180424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685180424, "uuid": "861e47cb-3a6d-41ac-98fe-a3f6182417f6", "comment": "Malware payload (LaplasClipper)", "value": "9619dc496ef114971a0a4fdd55355754", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685180424, "uuid": "b8ef0433-99b5-4e00-95e7-c96de28bf517", "comment": "Malware payload (LaplasClipper)", "value": "f764bb6c3fa76c26bdb604577f2f09436a46f6ebaee7b2afdf026a2c971c71bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685180424, "uuid": "0083bbaf-216b-4dc6-86ee-a6559ac7508d", "comment": "Malware payload (LaplasClipper)", "value": "008c9c7818710372a0f0fff60adf590fce155bb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685180424, "uuid": "3cadfbb4-2489-4b2f-9f88-ca28f042be98", "comment": "Malware payload (LaplasClipper)", "value": "1faf86864300358e29e7d1fb4aca507b938d8db5929e0fb11b63b5170c506209cf5972eb5692b04fe7933f3e5c81479d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685180424, "uuid": "19a5b5d9-4303-457a-8201-946a34dccd07", "value": "T12A27239361E5B2E4D0D34A0061C742CB51D064A9D9FDDB2D3DC6AC036E74EAB098EBB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685180424, "uuid": "32f25c91-e95b-4f9a-b708-615f73a56ac0", "value": "9da18038e0ba9a33fbbaf76636ea1aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685180424, "uuid": "9cf24473-6f63-4025-92ca-e9e30e094dd5", "value": "393216:+gPle4D2Wz4XLJmcwgbd/roAH7BOy57UOMmthPCfnrWszeYf:+gP04pzwJm9geAbsyeJWmrUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685180424, "uuid": "75845419-b381-4fb0-b4ed-3e30efac528e", "value": 20686024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685180424, "uuid": "d1f2883b-4fdf-4309-bde6-b731b2e5a51c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685180424, "uuid": "5c8d5a41-1095-4874-ad46-c84aec614ba2", "value": "9619dc496ef114971a0a4fdd55355754.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc73b5e-fcb9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1685211043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685211043, "uuid": "53caaae6-18ca-4738-a247-5249c49367b0", "comment": "Malware payload (njrat)", "value": "c83b98ba022a4d435ad6e2ed44955c62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685211043, "uuid": "26c378b9-649b-4850-8f47-9bd6622626ae", "comment": "Malware payload (njrat)", "value": "f8065a00c1123fb4b55878894b60cacc5fe854e6d74013a992600c28401f59cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685211043, "uuid": "d6d2190b-fa03-402c-8b0d-6b81b6a656c7", "comment": "Malware payload (njrat)", "value": "0400f4427c0c0d8976eb9c6c03b035d9d6cf00ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685211043, "uuid": "7c1e8d43-4b5a-47be-ae74-7a9cf1385275", "comment": "Malware payload (njrat)", "value": "072569b4f992ac50b2deab17dcd99667f374cc79e899738761f1c88edd190e09dff536d69380584de0b907a1471c52d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685211043, "uuid": "bc423168-09de-4cb2-9a2b-627c24a2ffcf", "value": "T149F2294D7BE181A8C4FE167B05B2D4130777E04B5E23DD0D8EE6A4EA37236D18B54AE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685211043, "uuid": "c2471425-8ef6-4396-b045-54f082f0f93c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685211043, "uuid": "604c4569-e0bf-4759-8d23-f65a6c3674ec", "value": "384:1SO/0IiejvCVLO309QmykrtG+dA+VfwvOSiKrAF+rMRTyN/0L+EcoinblneHQM31:7mdGdkrgYRwWS9rM+rMRa8Nujat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685211043, "uuid": "8a71cce1-9c5a-492e-bbeb-3779754614f8", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685211043, "uuid": "5ca32e25-600c-4915-a6ae-87e10d4ccd89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685211043, "uuid": "77684dd3-4490-4c0b-b5da-a319919e4dbe", "value": "c83b98ba022a4d435ad6e2ed44955c62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb51226-fc57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1685168716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685168716, "uuid": "3056470d-a275-4575-a98b-f34e1746cc8e", "comment": "Malware payload (Amadey)", "value": "27452c6db8b52714e0de68761a410472", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685168716, "uuid": "9baad2be-3ef3-4cc3-816b-dac6b8f38cdb", "comment": "Malware payload (Amadey)", "value": "f83146ead43df885223226b988e8007bdae3b5725b72bf08ad8c263efbbef705", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685168716, "uuid": "f6b14e1a-3fe6-4b10-b329-c62c3d765cb9", "comment": "Malware payload (Amadey)", "value": "943186b2402ee0baece32973b8130fb1a911416e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685168716, "uuid": "26d5320e-c1b1-417a-be3a-ed5381578ed5", "comment": "Malware payload (Amadey)", "value": "19bb6a71f98bb6aadf001dca50a0e896b054725473ca14c2dfda55b0cdfe5a71a67b9a2dc7afdda94dcacd47a13dbe06", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685168716, "uuid": "3523ee0f-6427-4b00-b16a-37a5506f4f3c", "value": "T15535232277E44573E4B417B01CF647D36A31BC85EC78922F638758AB04B36D1AA7872B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685168716, "uuid": "e277f78c-2bdf-4b64-9fdb-d1009a419a73", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685168716, "uuid": "f874989b-c0d4-4558-ba4e-d06fcf4b2972", "value": "24576:XyqgPcDA32k0F7fVjsUXiWo6kk3ESIGwZx0yCKx+VWHGe22CZ88:iqVu2k0NVjNX/R37MCyCKsWm/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685168716, "uuid": "91f18439-be5d-47ac-b946-a16da7f0eecc", "value": 1068032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685168716, "uuid": "ba744ab8-94e5-4831-a79a-1eb115d83110", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685168716, "uuid": "d3b22027-3ae1-4275-b6e5-3ad2f32eccbb", "value": "27452c6db8b52714e0de68761a410472.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c61b76b-fc69-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685176523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176523, "uuid": "40a9d890-fcdd-4917-9d19-db76e1635fa8", "comment": "Malware payload (RedLineStealer)", "value": "977756e7deb335f9bd6d8eb175e521f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176523, "uuid": "979e766a-88b8-454e-af8e-607fff86a4d6", "comment": "Malware payload (RedLineStealer)", "value": "f9e67be91562cc8df79ac7c27c9f6effe6f28a04fa91a430cec898a758976bd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176523, "uuid": "2a6a69ad-8a6f-48b9-a532-f4d4c93a03c8", "comment": "Malware payload (RedLineStealer)", "value": "068b38c4a9a2c470ba4ca908b7ac6a9367d0f544", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685176523, "uuid": "976f2cc6-cb14-4d05-a793-b18471f19cc3", "comment": "Malware payload (RedLineStealer)", "value": "93af3c32e85be05c4e3167f8c4d1fd346d82e1a6126d12cd644b9aef1eb6bf54898be6e48d02655a26fc6ab9544cf8f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176523, "uuid": "6991260e-a754-4971-8867-79afdbcba523", "value": "T1DDF422136BD84973EDB057B01DF302972B35BD6389788267274A694F2DE3748A93433A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176523, "uuid": "fa175f40-b46e-449c-b3cc-fa228de9a3e6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176523, "uuid": "c5b06c40-e699-4847-b7a0-0ea340c8e5e2", "value": "12288:6Mrhy90ISNqMDpHJ1d11vKMHFLqb48PZ0yN8swFnaY8l9z3+z0Lk3NTSSoNfBcVq:TyXelxnJlLP8B7N5gaY86Kk3ES+mVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685176523, "uuid": "cc2a449d-c495-4b68-b071-6ef343ebe9e5", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685176523, "uuid": "d8bf371e-a881-4121-b991-8fd27529195d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685176523, "uuid": "cc7110c9-7f4a-4e89-9d20-feb2902a3a3e", "value": "977756e7deb335f9bd6d8eb175e521f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e0151d-fcc1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1685214278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214278, "uuid": "88232344-a8bd-405d-bca0-abb5b6cb1bae", "comment": "Malware payload (Mirai)", "value": "07bf2d3ec63ed20ac72eec104f67e634", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214278, "uuid": "a4c98d4d-cd5c-4c2a-8718-f8ac4b58609b", "comment": "Malware payload (Mirai)", "value": "f9f969a431b4334e480cc7659c865418df5220bd694dc0617e1af65678bd7834", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214278, "uuid": "9bdc68da-9cad-45d4-92be-dcbc6e9039d0", "comment": "Malware payload (Mirai)", "value": "d67f66eca3761f4c31fff48f12a1f08e71721e82", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685214278, "uuid": "560afbda-6c0e-460b-b3ef-998770db179e", "comment": "Malware payload (Mirai)", "value": "6e97cf195e9538b5a71772ede6dfee436e9b62dc71bb2ef377572b50d3746a1aba1ea54f9ef4a270fffe1693985d0794", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214278, "uuid": "4709d8e6-b24a-4ac0-97fb-a89c1802c6bc", "value": "T1F0B32A13F5D149FDC09AC07047AFB93BDD25F8EE0238B65B1B84AE212D69E311A1DE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214278, "uuid": "db85022f-da53-448e-b6f1-0d8d1c6c635e", "value": "1536:1kPCnEHZXFZzKzuzS830VpGbCSN5neRJqM1LD4ru+Q:hEJFZWzuJ3eKCSOLB90ub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685214278, "uuid": "a437a981-a068-4205-bcc3-1030a1f62658", "value": 114432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685214278, "uuid": "fff4ee58-ada3-4e8d-9683-eb1f044b1f13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685214278, "uuid": "3a2dbba8-4e2a-40bd-9c76-71eba9d6eaae", "value": "07bf2d3ec63ed20ac72eec104f67e634", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f7e12e8-fc65-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1685174891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685174891, "uuid": "64275ffb-c9a6-421d-a7db-d4ec3959c8bd", "comment": "Malware payload", "value": "968cc131465c7d251ccbc6806b157283", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xoomep1-com", "colour": "#8B5AEF", "exportable": true, "hide_tag": false }, { "name": "xoomep2-com", "colour": "#7479B8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685174891, "uuid": "b0512727-1a6c-410b-a317-cf2a0e04e34f", "comment": "Malware payload", "value": "faf9b23508c4445bf9017cacb3b4f08f39d0cd0cd48cc17156320abb6083d9c7", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xoomep1-com", "colour": "#8B5AEF", "exportable": true, "hide_tag": false }, { "name": "xoomep2-com", "colour": "#7479B8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685174891, "uuid": "b419e92c-fac4-4539-b998-17fbd940c21b", "comment": "Malware payload", "value": "93da97c4eb5460ba60d6273818e3c5ea5d74b7b6", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xoomep1-com", "colour": "#8B5AEF", "exportable": true, "hide_tag": false }, { "name": "xoomep2-com", "colour": "#7479B8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685174891, "uuid": "a9cbb260-aaeb-46fa-b450-6080fab77c7c", "comment": "Malware payload", "value": "5b19f185723cc78fead63b6c3c129fce46772711442a30a21caecf344dedcac6e7b6bf4b1e9f3b870af41e11d6ad6468", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xoomep1-com", "colour": "#8B5AEF", "exportable": true, "hide_tag": false }, { "name": "xoomep2-com", "colour": "#7479B8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685174891, "uuid": "fed71a00-3021-48e4-a24b-37532170d124", "value": "T142B533A2CA704363E83B937D60BE95019F6CB1EAA3D5CB7D54540307728AC656F6CF82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685174891, "uuid": "5204ac77-3f98-42fb-8a5e-3c788e6fd2b3", "value": "49152:KlLUXP5qRroZT5YNdzlIbnNsOF9LFLbCNFlVG5PWZ5FvcBi:KlLUf5qRroGKsODLFLCFbIP+Ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685174891, "uuid": "64f37c73-2279-4aec-9303-ab59ce98f180", "value": 2278306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685174891, "uuid": "0081deb4-571f-4b69-b877-1708885cc8f5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685174891, "uuid": "5d21e107-5784-4d4f-9032-99d84f93b246", "value": "ngg_cl.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eddc6aa-fc6d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1685178219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178219, "uuid": "b68550fc-62a9-41fe-a0c2-721010fd0b54", "comment": "Malware payload (ArkeiStealer)", "value": "b2dc382e863e8e2dcc999c4777f98ac0", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178219, "uuid": "ac5ec7a2-f086-4dbd-a80d-9c5c6937af1d", "comment": "Malware payload (ArkeiStealer)", "value": "fbbf2c1d05028da86e946dadf417a6992d5eef4eb4c4f030f11d9d32e81670bd", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178219, "uuid": "1a5abc8a-3ed9-4eb0-b412-8fe11ba1eddc", "comment": "Malware payload (ArkeiStealer)", "value": "aaa5e0f346601c00de5194828618f8d5b6db6b82", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685178219, "uuid": "35b67f5b-5730-4fa1-a1a4-00616ebafdb8", "comment": "Malware payload (ArkeiStealer)", "value": "c8179209463758374fa5a5ceb7fdc48bb5835f777fcf12ef474b5b946eadac7f8d5c6c57a8298b6861b5c478dfc6bef8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178219, "uuid": "04e78613-4cf2-40c7-bb8f-534bc2c50095", "value": "T1CC947C4392E57DD4E9664B739E2EC6E8771EF6548E097B6632189EDB04F00B2C273381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178219, "uuid": "bafa771e-036a-4e09-b584-e1deb3634c6f", "value": "bd191f6a78cc98a8bbe61db18ad8e9a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178219, "uuid": "3db99229-7f03-4c53-89bf-428ef82ee14b", "value": "6144:KQdRSSpncdTMonBJPDk/hAIEZZAlhAwtCWF:KQrSSRsLBJPDrZ0AU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685178219, "uuid": "af6fa772-a028-4d6e-b6ef-320e7f067289", "value": 413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685178219, "uuid": "b27c56b2-34bd-499f-a9bf-78154a1a9b04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685178219, "uuid": "12d0e302-4ab3-457c-9131-3028c946f568", "value": "08851299.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41c37128-fcc4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685215536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685215536, "uuid": "18887c6c-3a44-430c-a786-e920c9d79cc4", "comment": "Malware payload (RedLineStealer)", "value": "e103ebb166a18cb0740ff7ff11a3907e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685215536, "uuid": "3a81ba21-95ce-49c6-9ab8-71ed34320ba3", "comment": "Malware payload (RedLineStealer)", "value": "fbd5d8cc4edf1713af52314e595cd8f889026d1bb7ebe4502ec1e2ebd81011da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685215536, "uuid": "e471d55a-a0c5-4c95-8115-9c6e3a588640", "comment": "Malware payload (RedLineStealer)", "value": "b22fa034e546ab6bae5739a0da1ddf40bd548b59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685215536, "uuid": "40340be5-a8bb-40f4-a544-29a7fcc5b7a5", "comment": "Malware payload (RedLineStealer)", "value": "8ad28df382ffcb019d5736b5253522f4499faa4400d90915a26f303b3194f1197d870c40580d2a67e4b67bd8471adacc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685215536, "uuid": "c8587a44-d05b-4eee-99af-2fb1142a552d", "value": "T1EAF41217B7E99033C8B0673098F607C31A39BCE289788757674AA90F1DB25D1A47672F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685215536, "uuid": "e313b16d-d50a-47d5-a625-f902f60e7443", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685215536, "uuid": "a3a714c5-9b75-4ef5-8bc3-f34cec202c67", "value": "12288:2Mr3y90PHL6MgSwl6RML8RovAsDoK+ovTfbAjF7HWetdt5vdaasxVy5/UZVJRbLz:RyJMgSQ8OvAwoKJfb+HDvYas/x1Rbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685215536, "uuid": "560cdf59-0f3d-4cd3-9d34-6a483315ad2a", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685215536, "uuid": "d6204d18-6ead-44b8-8199-6d7a9b076a58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685215536, "uuid": "cc091189-aeed-4027-9fcd-507e43f139d9", "value": "e103ebb166a18cb0740ff7ff11a3907e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275bc51b-fc96-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1685195735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685195735, "uuid": "b17abd4b-b01c-4548-92da-6ea16ca13b26", "comment": "Malware payload (RedLineStealer)", "value": "a8f2fbb5226d40eeed40a073efadd63b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685195735, "uuid": "9e92c33d-8f2b-4ffd-a949-90054a36b325", "comment": "Malware payload (RedLineStealer)", "value": "fd44f66f42194777ced73b1048674d470c3fb77c25038b5c8287815cf142530d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685195735, "uuid": "b8b87b26-b287-43f1-9068-a753dc2f2a4a", "comment": "Malware payload (RedLineStealer)", "value": "788b8e9efc4c510e6a627e4230bd8db7c09d42db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685195735, "uuid": "eea7bc6e-cd61-415d-a05a-2a6525e2e0b1", "comment": "Malware payload (RedLineStealer)", "value": "50f7238d011457294ab9ecbaf3a7fb0479e620292cbb31dbfa1626b419b1300fa1e6dc2ae104c064204458ad36a85032", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685195735, "uuid": "86751b84-e04d-446a-a83f-0b9dd4d29f39", "value": "T116C633D193F28169E07887B195BB4A8AC928BCF371B8D59F6746521D1A31EC2C3B1F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685195735, "uuid": "ade391a3-8fea-416c-8e1f-e0230976d5ff", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685195735, "uuid": "8fe91a26-c308-4ae4-85c5-40f0777d3aae", "value": "393216:aSY0ueFyGKYmfQ+MGAy+lGDi+DE++CQCq3erRLd82an:hY4Tm4+61cn+CTUwLG2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685195735, "uuid": "dbb07e76-1137-44d2-bbbf-b2f1e04d1df4", "value": 12592128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685195735, "uuid": "62f9dafa-adc7-49bb-aa6f-b3198c17f538", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685195735, "uuid": "c4ef41a4-dcf3-4857-8b3c-8de5ede3bc18", "value": "a8f2fbb5226d40eeed40a073efadd63b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2e511b-fc92-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1685194319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194319, "uuid": "53bbddc5-97a5-40a1-afdf-78c771359089", "comment": "Malware payload (Stop)", "value": "15bc205c2caf7196ee2267087c3b2bb8", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194319, "uuid": "9067e481-e9ef-4f1f-a13b-54d58cb48282", "comment": "Malware payload (Stop)", "value": "fdee1b99a95c5dfb4a256cdb7e43ce3f21a5d2c2977ce252aaffa77a9e017ddf", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194319, "uuid": "1865bce0-3ed1-456e-9d34-9387f7910270", "comment": "Malware payload (Stop)", "value": "0e1ee7e4ccafd5a62d6b2b3a9369709eab0e1f0b", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1685194319, "uuid": "ecb14860-170c-4d8f-a27d-438a25fb43a6", "comment": "Malware payload (Stop)", "value": "ffdc628cca73c23265c2f2cfca94f18e59399435cfb9dd75c723f203fca987a42a2329be584cafbf0b0e29e06c6c5799", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194319, "uuid": "f7625e4f-c3dc-47c1-a3ea-4ad0f7d29a6e", "value": "T1FB05E01392E17D94E9264A339E2EC6E8371EF7588E197B6622185BDF04F0473E273781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194319, "uuid": "94c090d1-bbdb-4f08-bfb5-8eacad8f67a7", "value": "697c6731df2df92c82c75859d21c5f77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194319, "uuid": "f1d6288e-8008-463b-8e92-1e5388a260c7", "value": "12288:6aBz+gzWrFGCkY9J22msYEy85LJxg1YSlniLs4CEhtYdGJ+CejE:/z+gzW7Z22byv1YSsA4CpdGJ+I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1685194319, "uuid": "80c8b525-a931-4a84-a6ae-3e574f627547", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1685194319, "uuid": "c04caa46-6c7c-41a1-bb9b-3ff6cd8cee4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1685194319, "uuid": "0d02aa89-9da5-4a87-abec-64a1bbf4bfa3", "value": "07494499.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }