{ "Event": { "published": true, "date": "2021-10-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-10-03", "timestamp": 1633305782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "71e9bd67-674e-4709-bae2-13db7e69e7df", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c52f89-247a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633287002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287002, "uuid": "12f5ede1-5802-4905-97c5-606db5ecea05", "comment": "Malware payload (Mirai)", "value": "2a9607798b29d35ee314bc0981249376", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287002, "uuid": "5bc2b604-ef69-4856-b77e-dc8cd139699b", "comment": "Malware payload (Mirai)", "value": "011f372292cdaf099de3c73a6adae8becf4f87601cfd7ba8a1b422a7ea527aab", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287002, "uuid": "6b6fa3ec-ffc8-4d8d-bf00-5397574d67df", "comment": "Malware payload (Mirai)", "value": "3a313fc59780b8552464d8ece406d6d0f51ff6ed", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287002, "uuid": "f919e38a-3931-4d45-b720-3552c566bd7b", "comment": "Malware payload (Mirai)", "value": "9a503df14180bc07c4c66d91a9d254f71a180ce0cc28040e71ad044e923f7f9083f1f76af0700ea28b53cc0ac631c35b", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633287002, "uuid": "03d637f1-ae0c-4437-8aa3-addeec43f99e", "value": "T1C0A35B82D642C2F3C4430AF1029F965A0532FB3A8E3B9EAAF75D7CF49B129D53115B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633287002, "uuid": "7e45de6b-f7a0-49f8-9b62-eaafdc11d7ec", "value": "3072:i3yqjPQP39VjGWX98c32V7kGyNVg5huf87FXnf0OzTyoQQub:ixQP39VjGWXJ9NVg5hyeFXnf0OzTyoQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633287002, "uuid": "24ce74ec-ac69-45f0-8efb-e2415175fa4c", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633287002, "uuid": "09b5a3f9-1e15-4ba6-8724-aa9a191fbd8f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633287002, "uuid": "599586aa-05bd-4fa8-be3c-8c0e346e5a6e", "value": "assailant.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717cb111-2445-11ec-843c-42010a9c0014", "comment": "Malware payload (QuasarRAT)", "timestamp": 1633264121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264121, "uuid": "7b6bf842-3395-41d9-9ab5-4f4f6bf0e1a7", "comment": "Malware payload (QuasarRAT)", "value": "cb7597b3fbada55fba7e39a7dcfc76f6", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264121, "uuid": "3dcb01aa-9507-499d-8675-6435a788a291", "comment": "Malware payload (QuasarRAT)", "value": "01526b381acd09438b74ca04eacf96cdc8f8fdafb36e85be9a099223db630f72", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264121, "uuid": "226c30bd-5b58-41c6-ae44-556949ae9922", "comment": "Malware payload (QuasarRAT)", "value": "b6b2113065c65771f8bd45a5c356f902fdf3fda9", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264121, "uuid": "b6fbaa7d-1d52-4b58-b340-ae989a184372", "comment": "Malware payload (QuasarRAT)", "value": "5adbabf49abbece4d3e06f30b1bce9959419b7afb8457e5c68f6260dcbc1679e5dc59d185b221c88c18732abf49d93dd", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264121, "uuid": "bcda0a0a-bb8a-4ea6-9403-6246acef0f4e", "value": "T15D41396D1C0CE9E82A994D8348B3C84D8ED56DC6B930EDA59ACDDC89B13431D0E40C2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264121, "uuid": "e427653e-017c-46f9-9663-4c896a4b24be", "value": "48:P3SSSSpZt4kSSSSuLSSSSSS5HAUrSSSSIFSSSF9G3SSSSwF0SSSSTl1SSSSiSSS6:fSSSSzHSSSSuLSSSSSS55rSSSSIFSSSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633264121, "uuid": "a189a776-6944-4580-aeec-421839896398", "value": 1991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633264121, "uuid": "2b0c5cd3-9915-4674-9fbe-5059c4a8dff7", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264121, "uuid": "8a5a9690-81df-4771-b422-319250c7bec1", "value": "36458565.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc34375-249c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633301404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301404, "uuid": "2bb3b1ee-6fe4-41b5-8fe4-82d0125bd185", "comment": "Malware payload (Mirai)", "value": "3edb847b88262b52e11ea32d84a3738b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301404, "uuid": "fc9273ec-b289-4034-84aa-2d2af0c3616a", "comment": "Malware payload (Mirai)", "value": "0175f232db82f4c536e8d43df64fe76c253162737ad0b1eb802ca789cd5834a0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301404, "uuid": "66e84d7c-54b2-4496-961e-c2f9f3d5137e", "comment": "Malware payload (Mirai)", "value": "8e01a2ce67573d8a160ff55c5ff1efe9e55931ca", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301404, "uuid": "023f0920-0498-49e9-9798-15a0ea6b3560", "comment": "Malware payload (Mirai)", "value": "09e19d517df257fad5ece1d6d74abac9950752ead2bbe393aad348bfdbc9e26069c14f3489e46550c745893e36cd0a57", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301404, "uuid": "4e48c245-f18e-4745-9733-0847e73c1b3d", "value": "T17CD34B86EA408E13C0D61B76FAEF41493322D755E3DB73068D189FB43F86A9E4E23645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301404, "uuid": "49bf937e-b0b4-428c-ab87-259535db607e", "value": "3072:wybUEGniGQYtOR7aCgk9mrsplDKZUmQBKXAVanJX+F8Jyve4hL5AJI4+3jJNx13n:jbUEGniGQYtOR7aPk9mrsplDKZUmQBKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633301404, "uuid": "ee3ba96a-ec55-4c2f-a049-450a76411006", "value": 142435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633301404, "uuid": "fbf20bc0-23f2-4702-a906-5f6f8d307354", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301404, "uuid": "56ff7500-04f4-4fb6-b5a8-55f797ce8222", "value": "lessie.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275d89b1-241f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633247676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247676, "uuid": "0e468f58-17e2-4837-8989-344567645341", "comment": "Malware payload (Formbook)", "value": "2c3831988e378295760ba378f37a0379", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247676, "uuid": "2c4c6cb5-ca31-4c5e-9704-0e3948db7fbc", "comment": "Malware payload (Formbook)", "value": "02a9e7458836d89cc02de2333176fcfdc9e462535e73e5b032f13e604b831b72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247676, "uuid": "2af5a77e-df30-4025-a5be-a6333c998553", "comment": "Malware payload (Formbook)", "value": "90f885870218b37c29b85d5a82c2e54e5e3ba1a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247676, "uuid": "15a0ed11-fe4b-424d-8f19-23b54c0143d3", "comment": "Malware payload (Formbook)", "value": "cc292d5eec5f72e457adb26d0ccf7fc57f2628829df57bfd055c3bc4ae8c0d84da87eeac653c5ed260ce1415b1a55ae6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247676, "uuid": "789bafc0-0236-415f-b7c0-10c345d057ed", "value": "T188C4DF97E2072D0AFDE9CAFF49E9AAA35A675C020903C42F54E4369D282F77E1141377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247676, "uuid": "1cf7c766-018a-4841-b36c-bfecfea3dfb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247676, "uuid": "0dc67a05-7aab-4e88-93db-d48731ecac25", "value": "6144:r4W3FXMTDv0oBYEq1NqJZZd2RhSTIfh4+CFQPhQ3VpHrGbIb7cEDiaDCO/lGq:r4WVcTD1mA7KR8Wh46uLHrG4eaD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633247676, "uuid": "ec4a0b5d-5dda-4840-9c0f-40994a03f644", "value": 576000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633247676, "uuid": "3d80622c-3003-4454-b6e5-541773f8b38f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247676, "uuid": "d9aa24c8-d9df-447e-b1bd-f0458ed47507", "value": "2c3831988e378295760ba378f37a0379", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad9de626-2481-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633289992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633289992, "uuid": "27b13650-c460-49d4-a1b2-b62e2482b9c9", "comment": "Malware payload", "value": "daabb579fc48612e8c836cb82d3aa2b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633289992, "uuid": "56030f66-80e5-44df-95ef-8b63b53bc929", "comment": "Malware payload", "value": "0333182e0308aa055e926b1a7aafed8be4de7a8a4ed800aafbb24f8d9ae23547", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633289992, "uuid": "30907dc3-02be-4202-b5d0-4a1740400a90", "comment": "Malware payload", "value": "b9e298c443db8c1e5a17eca60e5c4d2ef7bdd519", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633289992, "uuid": "23462062-d8dc-440a-8bc6-10f2968a40c2", "comment": "Malware payload", "value": "05b1038c8d3e427b37f05518ceb427897795014223b9b2897e9dba1e2ae23e92a8f1e1c4f294eee79f67e7958006b36a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633289992, "uuid": "01d00fee-ff3f-4165-a028-379926d117a2", "value": "T161C4F10D35A0D7F1E6B656B16722C7F80A7EBC5C482A528F3B88275D7E383D19729306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633289992, "uuid": "1af84804-f486-4a3b-8487-877466871d40", "value": "d33805713bf84c5172011e6ee58dcc60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633289992, "uuid": "5b904ca7-e321-4de1-b1b2-065fafc362e0", "value": "12288:zLeNjTmiUjvIHfjRt0khCt7E7GWtFAZvE9GxcaUpsizxp6L:z6nmiUjvIFVCSHAZvBcaK36L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633289992, "uuid": "442d9017-0ee1-4a08-a9b7-1fdd721d561a", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633289992, "uuid": "cd571ae4-b1fb-4793-8420-9bfe084383a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633289992, "uuid": "8f023e54-3f3d-40a9-93eb-5c92fd2ef0cd", "value": "daabb579fc48612e8c836cb82d3aa2b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b18e1ff-2438-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633258581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258581, "uuid": "5260e6d1-4c7e-4b7f-ad59-56ccb430aa13", "comment": "Malware payload (Mirai)", "value": "4b1b2b17561287ca3a029ab02fc05cd6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258581, "uuid": "ad36e1e1-3c71-4c5f-abd2-9e212449d3bf", "comment": "Malware payload (Mirai)", "value": "03547d7184b0a2fe1ddfeb0f32cfa47102feae2e9d3b2dfac8f5921a361a5d0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258581, "uuid": "e314bf53-50ed-4f30-872b-b85ba37d8454", "comment": "Malware payload (Mirai)", "value": "c9cc2ffe72be1071ca320257b8bdd787695125d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258581, "uuid": "96a02b9a-e93b-4f6e-ac03-17891608cbfb", "comment": "Malware payload (Mirai)", "value": "6f86038d8be6a97db823dffd6e274df3c5d2065ab3590a7b01218b91c07a4a1c70964a2672516835694d0f2b271cc922", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258581, "uuid": "25692b4c-68c3-43e6-bdde-d0884b1baca3", "value": "T177633A99B401AE7CF9CBFBBE80615E09F520A24154530B2777ABFD93BD321A0DD42D4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258581, "uuid": "f2694569-9ad5-445a-9064-125adefecf18", "value": "1536:zeQg8WRkRQqApwlM7Zrb3TZUnFtlpB/p+ix0JDl+B8/:zeQrWRkRheZMl/hEDom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633258581, "uuid": "c1a3d6d1-d4d0-4604-992b-552a00a2225c", "value": 66872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633258581, "uuid": "7366e636-b9c5-4f3f-acb5-d7aa2a24d084", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258581, "uuid": "030fd3af-00b1-4dc9-a4a7-132b1760bf79", "value": "4b1b2b17561287ca3a029ab02fc05cd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a5df80-2438-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633258563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258563, "uuid": "3aa354a5-6962-4216-a210-4bfd11005fc2", "comment": "Malware payload (Mirai)", "value": "32a366b2cff1e5e3d3408bad2a6863b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258563, "uuid": "c1246b46-0226-4611-b959-c54c8df75c2d", "comment": "Malware payload (Mirai)", "value": "04146d7c6b8037fa54f17a26c46c52cc45732a04142846003c47959071527f36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258563, "uuid": "3ff01b07-5a56-4b2d-b849-c17d2876041c", "comment": "Malware payload (Mirai)", "value": "f7e3c9efbccd29dd82495d329a9647317944e622", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258563, "uuid": "3c49f2fd-b897-410b-bfe3-5ecebbf303d7", "comment": "Malware payload (Mirai)", "value": "cf89b7f0e003908c1580750a368bb76437a26f79532bc33a3af95515eca848d6240c754918a0501c4b155ef1937c1f44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258563, "uuid": "00d38aa8-216f-4a78-9da8-df0718284ea8", "value": "T10533F100CE22A8F1CF443977D32845427A496D76E59F3CA542B18FB80FCB54BA731B89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258563, "uuid": "ca3775b4-665d-4985-bcc0-4516a7d73535", "value": "1536:V4b09Oiabhq25X6Sy8YiriMzM7L5WOMK1gUr:iw6fyVEkLfxiUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633258563, "uuid": "afa3ff6e-2be8-41f5-a7d0-3ba0a33b1a13", "value": 53692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633258563, "uuid": "6b42b018-c767-4572-a9fc-4826d03c4318", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258563, "uuid": "ef2c8660-57d3-46a1-b3fa-035a254eaf54", "value": "32a366b2cff1e5e3d3408bad2a6863b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c2ce56-247a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633287002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287002, "uuid": "fe62c255-a9a3-48bc-859d-4994866da934", "comment": "Malware payload (Mirai)", "value": "984b65b7c641b42be672f8dd10269fe8", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287002, "uuid": "2876bec0-804b-4d05-8a68-61b8bd4aacc2", "comment": "Malware payload (Mirai)", "value": "0494820807423bc1f4edd4e8b6682df2449b21c232f468bb892accc216803894", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287002, "uuid": "10a63a2f-e163-43fe-b9e4-060eb6088be2", "comment": "Malware payload (Mirai)", "value": "bfef69112dc0dbc717125f5eb6e75f8db094a032", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287002, "uuid": "2b3a11ab-9e97-4f37-a610-38679165df0e", "comment": "Malware payload (Mirai)", "value": "367c4cc18bbb668f97bf35b4513f6eec9a961392a19e59504ab97428ffeb7e4491808a7f4e617eaf4296cb6362b11d62", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633287002, "uuid": "1fa25dd0-5388-4e3a-b79e-e12007596f61", "value": "T15FA34A82A780D5B3D19306F6129B8B150133FB3F4A6B9EA6F35D3CF48B509C57221B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633287002, "uuid": "9169fb18-c113-4a92-949e-a7909a15dc1b", "value": "3072:BY4WodUWUh917j8mc2dZiPUDAZURyPfN5htfuvxinf0OzTyoQQub:xdRu917j8mc2G5Z5PF5hNwxinf0OzTyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633287002, "uuid": "eab73518-5230-4a77-a776-d448ea2cf682", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633287002, "uuid": "632b8174-9dbc-457a-bdf6-2046ccaeea4a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633287002, "uuid": "479c964d-e967-41d7-9a7b-be5a8af2a4d7", "value": "assailant.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870a485c-2422-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633249125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633249125, "uuid": "94420f62-e53a-4be0-8556-0581864ea39d", "comment": "Malware payload (Formbook)", "value": "fa8622d626b79da91b5cbb891ccf8c40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633249125, "uuid": "da875537-00b1-4306-a940-4a2df3d25e4f", "comment": "Malware payload (Formbook)", "value": "04bbe124df4181232c007b8ed75964eb1823428f7163b636b18597bfc6f80bfc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633249125, "uuid": "0e4b6f26-8d13-47f1-8303-4dfa5a95febf", "comment": "Malware payload (Formbook)", "value": "1337dd3f002f842ac45fe781c80bfbd3cd968b67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633249125, "uuid": "c736e781-d38a-4352-a6ed-52cb90102de7", "comment": "Malware payload (Formbook)", "value": "1ad8f7fcdaf94f792f3d6b942b87ea02c7c967f033a55ed5fd05440fcc155fdc459edcb95d6d65f40acaf60e6f6c90dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633249125, "uuid": "1d3d664e-7c95-4abc-9ef5-6a3e7cd238d4", "value": "T1EFE48C14F11CD2B9FD1922B1257DF8C826B82EA9147DF90BBAD7B1E264F4E3154B01A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633249125, "uuid": "7b639b1b-a6df-437d-905a-0f3e251e6dc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633249125, "uuid": "0d011788-8776-467f-9d7c-ec52fa1dc4f6", "value": "12288:smHUlE/gtgBaqzY4ReMT1eiaoIObQ+X8+UiDLbRHah:sWUlE/CgBVEUeViaoIObQ+X8+UiDLbRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633249125, "uuid": "9e2662a3-8da1-49ff-b3e9-e85a48da735f", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633249125, "uuid": "0c150e2a-2ebf-4efb-b447-53d4726c7501", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633249125, "uuid": "23c6058f-d1c2-4b1a-8561-e240614411c9", "value": "fa8622d626b79da91b5cbb891ccf8c40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b0e0ee5-2431-11ec-843c-42010a9c0014", "comment": "Malware payload (DCRat)", "timestamp": 1633255467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633255467, "uuid": "3eee3d38-b31a-4b8d-a37f-b1ec37892bdd", "comment": "Malware payload (DCRat)", "value": "38522b0105af7667a2a82580159cf380", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633255467, "uuid": "620bb906-b1b7-410a-aa91-95a25a579fda", "comment": "Malware payload (DCRat)", "value": "04bc8fb0c217312979a1217434a83d5db80400108ace1beb802cb564d5424a81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633255467, "uuid": "9d4accf3-f63f-4a42-8b02-ab22a0eceb46", "comment": "Malware payload (DCRat)", "value": "7cc8f678b1faf74b562b96a34e3e6118995f1bc2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633255467, "uuid": "03047c9e-1142-4b72-87b6-6fa987535af1", "comment": "Malware payload (DCRat)", "value": "8283f4bff9073455f61693d154a973eea51bce2087af6c99d2007f6256c89e72fb891e23d3c739b670c0143c0c827bcd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633255467, "uuid": "98feda45-9abf-4768-a519-610af919d91b", "value": "T1EC555A027A48CD22D26A1A3BC5EF405457BCBD017A62DF1B7EAE339D65113A36E0D1CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633255467, "uuid": "5e5f0079-1f47-498a-ad85-019bc226485e", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633255467, "uuid": "9655f071-c71b-4217-b90e-ec7198c75389", "value": "24576:U2G/nvxW3Ww0tzHfbsyks8JuyenWQs9U8+4h:UbA30z/YyznAuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633255467, "uuid": "233eb6d0-161f-403b-b9e7-24291153185a", "value": 1365610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633255467, "uuid": "94384ac2-9a83-45ed-a444-78cb12a78bfe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633255467, "uuid": "4f404c71-d8a1-4844-8b21-10a3c5bf95cf", "value": "38522b0105af7667a2a82580159cf380", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8dd1d1-2476-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633285346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633285346, "uuid": "1dcccb99-7ab2-4835-969f-38099481d699", "comment": "Malware payload (Mirai)", "value": "3a4ef023509ab78e8e0a27d988ee9d0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633285346, "uuid": "c72b1bd8-f824-484b-800b-fde53feb1cfe", "comment": "Malware payload (Mirai)", "value": "067accd300c49721e69caa132e850af9d2f0959cafb0d35dadc8d7d84c96a0ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633285346, "uuid": "8139a968-b614-4c36-aec3-560a7ec27a9f", "comment": "Malware payload (Mirai)", "value": "a0de8d5deb01c5d0dffad2cce6271cafe4a468f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633285346, "uuid": "937ae8d8-f3f0-4345-9a27-08a9a1adecfc", "comment": "Malware payload (Mirai)", "value": "d1b5f5046d1dd052b11b5a11587d2d6d9bc5eafc5bb5865bc7f95d978f8e3aca065b1a5e1d8b78f3d8f6761b9f674462", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633285346, "uuid": "329eb436-3fa7-4fb4-b30b-3c3bff393340", "value": "T1F0921985FD49C905CAC4563AFA8E828C7B265398E1CE33439B1A7F925747C2B0E3F954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633285346, "uuid": "6aa38d08-97e6-43cc-a598-43a3997e313c", "value": "384:fgUiHbuIHTDhV5JD8cd8yU3u6/vQ2nwl01EQDv+SFx4e:fgUGbuWhVPD8uxIHQ2n49Iv+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633285346, "uuid": "e6b41395-bdb3-4d1c-8b92-9d8cc331d089", "value": 21040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633285346, "uuid": "369465cb-794f-4665-ad5c-075cc7c3d768", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633285346, "uuid": "3e521a1a-7c7b-4b06-86d1-8d62a8b9d216", "value": "3a4ef023509ab78e8e0a27d988ee9d0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8756286f-2473-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633283915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283915, "uuid": "d7b14b2a-3a4d-4283-8c14-b29c02ee7c15", "comment": "Malware payload (AgentTesla)", "value": "add7b6b60e746c36a66f5ec233873372", "object_relation": "md5", "Tag": [ { "name": "192.168.178.114", "colour": "#4DA259", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Orcus", "colour": "#FD0BBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283915, "uuid": "51aacbce-4d58-4b60-8c15-39850a38b5e3", "comment": "Malware payload (AgentTesla)", "value": "069686119adc13e1785cb7a425611d1ec13f33ae75962a7e50e00414209d1809", "object_relation": "sha256", "Tag": [ { "name": "192.168.178.114", "colour": "#4DA259", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Orcus", "colour": "#FD0BBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283915, "uuid": "35423b65-9e13-4bfa-bac9-6aff7f270e3a", "comment": "Malware payload (AgentTesla)", "value": "a35bffc49871bb3a48bdd35b4a4d04d208f23487", "object_relation": "sha1", "Tag": [ { "name": "192.168.178.114", "colour": "#4DA259", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Orcus", "colour": "#FD0BBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283915, "uuid": "17dae062-5821-4279-8733-5a095b1753b2", "comment": "Malware payload (AgentTesla)", "value": "10279810f076cb2160f2e65c4df23f9f8bf991f33263601cf47ac8f48d10ffb6e649f876086c6d42db5150477e099721", "object_relation": "sha3-384", "Tag": [ { "name": "192.168.178.114", "colour": "#4DA259", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Orcus", "colour": "#FD0BBC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283915, "uuid": "f0bc0512-a58a-4392-a68b-33f6b5777952", "value": "T109E512107BACBE03D0BE3B79A6331AC8077AED065552FB4E055061AD1EAB305FD6835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283915, "uuid": "2df21c3f-325f-4966-ad8a-6c724448c36e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283915, "uuid": "07db3515-e714-48f3-944e-4bf85f9c52b5", "value": "49152:cgOiWZKM25XvOMLR3HhDxuMJQ0RBaWLAypQxb3o9JnCmGgKnYIX7KlFkvxH:0itLvO6lkMTBDcypSb3o9JCmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633283915, "uuid": "3c2ed762-72d6-4b47-bfb7-562d491df359", "value": 3188736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633283915, "uuid": "81807a37-230a-4280-be8f-f3423542ef14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283915, "uuid": "1a5a78a1-263e-4085-b4ad-fec17ab2700f", "value": "BackDoor.Orcus_n2.sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b0a9da-2481-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1633290007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633290007, "uuid": "356759b5-3b60-4c95-b187-83df12984ac2", "comment": "Malware payload (CobaltStrike)", "value": "c354ad2705debb7a270777acf1574597", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633290007, "uuid": "5045c213-5f9b-4397-8d3d-d939bbde4d38", "comment": "Malware payload (CobaltStrike)", "value": "080c2647fb26ac8576014a21591465eba5b0ee03475f70e95bc3a4caa8d3642e", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633290007, "uuid": "0964f959-453f-43d9-be7d-06eaebd27e31", "comment": "Malware payload (CobaltStrike)", "value": "d8ed310e8179b0ed759843429e4dedab78ef4f3e", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633290007, "uuid": "ed4ca43f-ffd0-477d-bb1a-a7f2ee592b63", "comment": "Malware payload (CobaltStrike)", "value": "c7619c2aaf9be317e59eb8a512c2ad640adfd37c73c8356b52af0ccd58c98f5fb1bc020efd2f161b4c4876c2f289cc1a", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633290007, "uuid": "228543bf-ac66-4245-aa37-bbe4ca9161c6", "value": "T1C354AEC47A22B1A5F5821871F058D19A415FB665D6DC7B246A42E0B8F3383F2F5B2CB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633290007, "uuid": "d910d098-2cb5-45c1-9063-8142f04da37e", "value": "17b461a082950fc6332228572138b80c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633290007, "uuid": "bf1c8e0e-6bc3-4014-8b92-7bb8a268e76d", "value": "6144:aC9f3P6j+F2CwCwVXvGB+WifjQutFchhd9uhz6BEw:Tfiuj/kWiMut4h39BE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633290007, "uuid": "1cde0b9a-0f85-493a-8fd1-0a70d16164e7", "value": 288256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633290007, "uuid": "1d0dd510-d26d-498e-9357-9c9012325a6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633290007, "uuid": "25159771-120f-4b0f-9ded-92f590604e94", "value": "c354ad2705debb7a270777acf1574597", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad29c7a-2449-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633266016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633266016, "uuid": "bd1a840b-866c-4218-9a65-1b20ec50258f", "comment": "Malware payload (Mirai)", "value": "1537740f4b83fd616a434ae6072c8b89", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633266016, "uuid": "42dc1055-3171-4dbb-9470-4bc77f5d4083", "comment": "Malware payload (Mirai)", "value": "0adbffb6cd3a81b9368bb15c7480c2b242c04814dce1efa2c944922fdc2341cf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633266016, "uuid": "c8746636-8603-4bb2-b4d2-16df036d224f", "comment": "Malware payload (Mirai)", "value": "f6821fb1fb90409045962bb9581ca03249e8fe0a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633266016, "uuid": "214a7dae-8110-4985-92de-ae614551865c", "comment": "Malware payload (Mirai)", "value": "62de66224af90135dc204fce7e9e3270c3fb2c917c269281a3f73814da472823a5b01384fb468d18f13c5b67629eaab7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633266016, "uuid": "80f7271c-7848-40a0-8e74-08a226c29e72", "value": "T1CEC33C46EB808A13C4D51775BADF424A3323E755E3DB330689189FB43F86BAE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633266016, "uuid": "8283a590-5713-4cc1-9c01-692b1b2da5f7", "value": "3072:+KhtPUfCBPv49iuFcpQe8ZVu6y+WLwM/9TGyz:+KgfqPvSiuFcpQTVW+WkM/9Vz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633266016, "uuid": "94037f8f-7d7e-4435-9bbe-725943b5d37f", "value": 125754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633266016, "uuid": "9734bcc2-d7a4-437c-af46-98bd17c37ebf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633266016, "uuid": "300066b2-c072-46c3-bf94-7f8c9d5876c4", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dcd9715-2445-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633264169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264169, "uuid": "fe4a036f-66cf-4f26-9109-0778c7981ee3", "comment": "Malware payload (RedLineStealer)", "value": "a36c888f47eceb950d47caa689236157", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264169, "uuid": "d76ec180-5a3a-4621-82f0-c77979a5f669", "comment": "Malware payload (RedLineStealer)", "value": "0e9d1d4f8b96efb87286d412f960000dd9e7dfae4cfc659c9241b28f29f48dde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264169, "uuid": "7ea7319d-48d2-410f-921c-2889460f1e7c", "comment": "Malware payload (RedLineStealer)", "value": "11edaf853d941f7921ba4a6bfbaf719df3ac627f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264169, "uuid": "c830d868-b551-4b34-8f1a-fb181d71d51d", "comment": "Malware payload (RedLineStealer)", "value": "0fee14536bf3082376abae74711c73be94eafa924ae077ca7d6571687c5b004ede510734fc15ea74dcd1e6ed5bfb47bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264169, "uuid": "cfa8c932-4d75-40f5-85af-ccf8c59a74a3", "value": "T1EE84D0057690CFB2D6B201B6AB16C7E0497DBC6D5C66524F2B98FB2EBE3C391D611302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264169, "uuid": "900e98aa-aa5c-4055-8da3-b476acf1be8d", "value": "e1dc734f9d3fd8ffe237c21274508ba5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264169, "uuid": "d3dd8222-c99b-45dc-b066-7a1b38bc3224", "value": "12288:ddKx7c0ydSRjSspH99d2JDskL6+zxF6L:dAtRydMSspBYJL6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633264169, "uuid": "ac8d7ebd-32ea-4db7-ad4f-f48bbdfec406", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633264169, "uuid": "beee2840-fecb-4d40-8c76-0a5725bec117", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264169, "uuid": "71e21297-3b40-4e04-ac25-2e3d3b24ef39", "value": "a36c888f47eceb950d47caa689236157.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a22f6ab4-23ec-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633225978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633225978, "uuid": "5ccd0003-c363-46b9-bf12-6bdd2674a391", "comment": "Malware payload (Mirai)", "value": "b0f5233f99bc90633aa60e4aed5aa89e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633225978, "uuid": "8702a4ed-cea4-42b7-91ea-7600640f632b", "comment": "Malware payload (Mirai)", "value": "0ea7a4cc8b2124fdd09d0b023a6192f8a6b6ad94183293d4954f6c951240aa9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633225978, "uuid": "27d6f5b7-74ee-4eea-abe0-65ce49c759e6", "comment": "Malware payload (Mirai)", "value": "246705567df09fab35343869f9fd9d9e4f99f923", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633225978, "uuid": "132b445c-a709-41f4-95e5-2ac920362184", "comment": "Malware payload (Mirai)", "value": "b3f733891c6e8e854d33cd84d2df19e9c093392d6274f4ad0556c46af8e38f25b27e0dd72b6f3d307e6377d03d3af2d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633225978, "uuid": "f13eb48e-64df-44eb-b08a-5091982eca7e", "value": "T179C2D0921133E9B5CDA84D38CDEC46C12B1E0FF9C06EB96707D80A5989D35C12BB4ADB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633225978, "uuid": "1d407f27-a4c3-4117-81b1-974ef988be7a", "value": "384:OHOu8JvPhNFQLR8w88tc8tJUg5bex7IYA1pmB6auqu/zMZ2zVpEh7qmdGUEpiaOw:g7yhN6LR8Dgc87ex7o/cQg0o9q3UELOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633225978, "uuid": "f3bb9f1f-4e79-46fe-8288-c547226db66b", "value": 25984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633225978, "uuid": "30c8f132-7dba-4c79-88c1-cd028d771535", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633225978, "uuid": "8172482b-0672-4c8d-9855-4988610f806e", "value": "SecuriteInfo.com.Malware.ELF-Script.Save.5cd1e3ca.6983.31330", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ece2157-2467-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633278612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278612, "uuid": "2312ab64-b9d1-4a80-9346-527834aa09a4", "comment": "Malware payload (RedLineStealer)", "value": "793261a9a21202c4d00108bc67fe3798", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278612, "uuid": "11522940-d819-42a3-9f94-2a3950529021", "comment": "Malware payload (RedLineStealer)", "value": "11c889984da5ffc82571bd6fb77cce4ccd72bc4e07fd6d79b7e0e39a14c3877a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278612, "uuid": "12cacfee-ae5a-46da-8108-5e3b0449b9d4", "comment": "Malware payload (RedLineStealer)", "value": "7523f9775110fb39fc8fca1d05a32335ee334f20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278612, "uuid": "6ae77200-611f-4af3-8552-a47f8b86eb8d", "comment": "Malware payload (RedLineStealer)", "value": "fc9b4b5633296b3e69ca2c2ce9aff30d088294f2072b86d7b6c925fa2eaff84f07a70f930b945b9b13a9f2b8c128e84b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278612, "uuid": "651a2c79-3923-4fd4-8161-00dac314590e", "value": "T11084CF093690CFF2D6B605B1AB16E7F54A6DB86C5C35424F2B94372EBF3D391AA21301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278612, "uuid": "3b22326e-3688-4a02-8e91-3f7dfced92f6", "value": "e1dc734f9d3fd8ffe237c21274508ba5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278612, "uuid": "6710800e-7c30-44fd-b303-4dc1a2c97058", "value": "12288:w/gKsuT3oiPw0CMu6lmOI/efFiL6+zxF6L:wHDTr4s9lfQJL6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633278612, "uuid": "97ea72cd-985d-4712-baa8-c9620a606ca9", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633278612, "uuid": "89bfd587-ff8d-4672-9e76-4ac2d50add02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278612, "uuid": "7aa240b8-e552-4e99-86de-1911a2418c33", "value": "793261a9a21202c4d00108bc67fe3798.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7adfe7a7-2438-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633258553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258553, "uuid": "b113ab0d-c376-4fc2-a623-7599760998db", "comment": "Malware payload (Mirai)", "value": "06ae2605aca4064394827d3f5607da40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258553, "uuid": "32f7caeb-ee1d-4899-9e00-3266eb278cd9", "comment": "Malware payload (Mirai)", "value": "12e82cf0e4818261f70d8e5a331fa164fbdbde933e942a28c93630be5d3bbf85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258553, "uuid": "677f1e5a-dcd0-4aea-ba75-15d5202c54c3", "comment": "Malware payload (Mirai)", "value": "89cfee82a8e13ab557f5ecd3dbc013dd86d44766", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258553, "uuid": "b98c30f0-b5fe-4fdf-9758-0d27e5da1b45", "comment": "Malware payload (Mirai)", "value": "1356e24e4a941a27cb26e51aed4f7088e03995446c23543d859323b319ae612c50b8e74db9a8ebc21919e090d5a8abfe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258553, "uuid": "b6c48f44-e845-4023-bb2e-e28953b46b4e", "value": "T1B0D2F1B9A7D8D81BC44091FF96EEAB1270B20464675FC3D1864DC9D3929B75721E0D8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258553, "uuid": "5ada3d7b-d7fa-4a9c-a70a-ad479ce88c45", "value": "768:NQjIZhYhM5ga+lBG0erv03abJW2YLMmkHeDW+OpW/3gh5C0/Ub:u0ZGfa+lPjqF5MqnEio0/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633258553, "uuid": "9e428ddd-d188-41eb-bdad-455e808ae28d", "value": 30008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633258553, "uuid": "1f61d9ce-7b0c-4121-97ab-26395fde1716", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258553, "uuid": "871a99a8-2620-432e-98ec-cdcfdfc75552", "value": "06ae2605aca4064394827d3f5607da40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a81dbb-23f8-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633230948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633230948, "uuid": "7761e961-90ac-452e-9208-5ccfc87df81e", "comment": "Malware payload (RaccoonStealer)", "value": "fe8aa7e0bb26744c58dd5090e75d2d58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633230948, "uuid": "e3bdb631-bb55-4e15-86a4-b3b4624d937c", "comment": "Malware payload (RaccoonStealer)", "value": "13d64ea9d98adb90dcbd7fec75d8932ff4dc6b11ef206472bb8919310c8c6924", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633230948, "uuid": "befdcfc8-ba74-40c8-bf6a-b439d43d790e", "comment": "Malware payload (RaccoonStealer)", "value": "5063e8586ecc768a2ae242602a3ac61b10ca7789", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633230948, "uuid": "3b436d25-dba5-44fa-a33e-c2b99f06a6c5", "comment": "Malware payload (RaccoonStealer)", "value": "4ff132bb01dc0d90f3135153ba57b7ba604703ed251a183f5dce698c1bf3da53f10409a0d2b613e71af8e3844d98fe84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633230948, "uuid": "58281fc8-17e8-4c9f-9012-a229c698fb14", "value": "T1A6D4F11931A2EFF2D6B545F0AB25C7F1493DB9181D26328E77983B1E3E3E3919611382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633230948, "uuid": "3c0dab1e-9a18-4721-b8c5-e2a960d94cfc", "value": "f37786a16a90f8f3f38c22c48ff5cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633230948, "uuid": "c76f1acc-28eb-4af4-94fe-a73627c42846", "value": "12288:9ZMyulH2oV5ZAcTILI5kN7aHpXxOeH9oMh6xFwnpL6Bzxd6L:X0lHpc0+eH9P8AGL6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633230948, "uuid": "b8cad73f-d989-40e5-a5b5-d5b137dfe3fb", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633230948, "uuid": "34fb43c6-02e9-43bd-9b01-48ee7d883dc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633230948, "uuid": "94630eb1-f9ae-4bf2-b2be-c2eb1dfc2c0e", "value": "fe8aa7e0bb26744c58dd5090e75d2d58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed04cc2-2473-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633283793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283793, "uuid": "b2b23dbf-3a1b-445a-b780-6d5cd90e3ada", "comment": "Malware payload (RedLineStealer)", "value": "43b810f918e357669be42030a1feb727", "object_relation": "md5", "Tag": [ { "name": "192.168.178.114", "colour": "#4DA259", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Orcus", "colour": "#FD0BBC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283793, "uuid": "aa26dd2f-53ff-4171-a932-7c8ab1ada867", "comment": "Malware payload (RedLineStealer)", "value": "14659857df1753f720ac797a43a9c3f3e241c3df762de7f50bbbae00feb818c9", "object_relation": "sha256", "Tag": [ { "name": "192.168.178.114", "colour": "#4DA259", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Orcus", "colour": "#FD0BBC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283793, "uuid": "5ea5ef78-b281-424d-98c5-d241bd50ef68", "comment": "Malware payload (RedLineStealer)", "value": "3de36410a99cf3bd8e0c56fdeafa32bbf7625af1", "object_relation": "sha1", "Tag": [ { "name": "192.168.178.114", "colour": "#4DA259", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Orcus", "colour": "#FD0BBC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283793, "uuid": "8f4124f7-fe19-4304-b34d-125baecdb406", "comment": "Malware payload (RedLineStealer)", "value": "da83bb2d00dc2cc3368d06a1973436144c8497a533bf8554f293291e54243665cb62fb3fa0eee16bf4c78dedfd82f9f5", "object_relation": "sha3-384", "Tag": [ { "name": "192.168.178.114", "colour": "#4DA259", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Orcus", "colour": "#FD0BBC", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283793, "uuid": "75e3591a-5891-47dd-b18b-fab0092b817e", "value": "T1C1962B5E8698319C94E2E3BAC21DA899A3BDB3373F272D71414E05403DEED4FE1E6446", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283793, "uuid": "268a1b3e-8377-49fe-afe4-c80ddcc508db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283793, "uuid": "15d8f3ed-68a5-4232-ad14-f14133fd8f2b", "value": "49152:ae8egAiHGSevx/fuwZMsZKcpC1V7iVB5t3i++0mteGA9ZUV9M1WZ7LQ8q/nSmT0E:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633283793, "uuid": "db498295-948d-4eda-8b8d-2aad50ec7382", "value": 8892416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633283793, "uuid": "4a3ab1d0-4e82-4a53-8126-1560059e5571", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283793, "uuid": "5ffaa961-9f69-4fae-826b-dd479114542c", "value": "BackDoor.Orcus_n1.sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9bf6966-23f4-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633229453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229453, "uuid": "1689db66-03e6-47b6-ad11-8012352e7ea5", "comment": "Malware payload (RaccoonStealer)", "value": "1fe6a9fcae66dab34a4cb409df180e1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229453, "uuid": "2d47b893-2936-4559-852a-586ea0be3b0a", "comment": "Malware payload (RaccoonStealer)", "value": "152ba18e7ef1293147b17d5f96eaa3d18ea4469b69e091a71dac85775bbd1bce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229453, "uuid": "2a2ab9fb-b142-4f9e-937a-c20bba0c3b2b", "comment": "Malware payload (RaccoonStealer)", "value": "87900ad3b36577e09ad5faca6eb6a4522023d7b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229453, "uuid": "d8ecc9af-c292-453a-83e6-5f8c35491a8c", "comment": "Malware payload (RaccoonStealer)", "value": "82100b576877d1a56275889b500fc0ad6fb8680b6d9c70803722752c267033afab0a3783b967cda57e7d174c0f026eb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229453, "uuid": "1d5174f0-1754-47f6-94b3-0bd1f8ce6021", "value": "T147B4E130A7A0C031F5BB52F549B5C378B929BE71AB3450CF93E41AEA56386E49C30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229453, "uuid": "c36c3f8f-8a98-4d5e-a629-e30c217c713f", "value": "949cb2a875d86b476d185d15a2fa1cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229453, "uuid": "869f83d7-e297-4623-8fb0-9fe8a3bc135a", "value": "12288:WY5Pf/7zmXDO9oaCUf2YuUI340fZztIVNhzm8z/03bpP:njqzB7UfXI3v/IYQCb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633229453, "uuid": "2b62b99d-7948-4406-8e8f-ca4763c42522", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633229453, "uuid": "d490e2b2-a171-43da-b2f2-5575253c344b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229453, "uuid": "8ec0e986-e7ee-48fd-b4c0-261673d7853a", "value": "1fe6a9fcae66dab34a4cb409df180e1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da1a29c4-241b-11ec-843c-42010a9c0014", "comment": "Malware payload (Gh0stCringe)", "timestamp": 1633246258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246258, "uuid": "c1a0363f-e984-46e3-9adf-b117bcb02364", "comment": "Malware payload (Gh0stCringe)", "value": "3a5b7d5f6a117df62b659581127ff18c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stCringe", "colour": "#420075", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246258, "uuid": "62c8d7b8-cf67-46f5-b07a-d23e407c9be7", "comment": "Malware payload (Gh0stCringe)", "value": "18158134da1bb476cc580a19d2e61e1cc378452ad527022169040344abcb22a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stCringe", "colour": "#420075", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246258, "uuid": "7cf973b5-ac3c-41e7-b916-f3883ea87b8b", "comment": "Malware payload (Gh0stCringe)", "value": "b777eab56216cf7b183692db3136b9472782e216", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stCringe", "colour": "#420075", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246258, "uuid": "e6d7ec24-d29e-4a2e-b631-3726ae085460", "comment": "Malware payload (Gh0stCringe)", "value": "4e9776e9368b8e6ba83c89f1e4f4add7487e0c0ac4b9124e430dc9abe1077be226ec3573fea41c1623e24751ef381e07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stCringe", "colour": "#420075", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246258, "uuid": "debbc138-19cd-4863-989e-95994088d3ee", "value": "T12C53070DE69EF0E3FB517530260E66328EBDB82C853C951F2E56694D1CF5B80A4AD372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246258, "uuid": "b3ab54e1-c162-437d-8e1c-f6e0ded13aa7", "value": "d9c7208ff3022bb34870c7ddeb406eb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246258, "uuid": "89529b01-ed86-4350-a14d-da40d3d45273", "value": "768:jbz3IhpglwpDEq2m0j6Tf8V4Ie7ZZa3R1fb961vNPrl7sJnCJ0uZN:n4+wpDElm2IAUZZo1fbs1RVsZCJ0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633246258, "uuid": "d9bfa34c-f75d-49cc-839f-6982290314e1", "value": 63488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633246258, "uuid": "123115dc-11f9-4af0-9b12-336026ceced8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246258, "uuid": "27de5bf3-414b-492d-9974-efcbd1f5871c", "value": "3a5b7d5f6a117df62b659581127ff18c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c663b1-24a0-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633303216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633303216, "uuid": "ea429575-f916-44dc-b6e0-c05a68972dfb", "comment": "Malware payload (RedLineStealer)", "value": "8c14f0315734ff02c47cd264396e57a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633303216, "uuid": "9c6a9e60-f155-4312-aebe-51f0aca6e37f", "comment": "Malware payload (RedLineStealer)", "value": "19cc75c62f3ebb4e7444e3d29e4dcd1c6d43dae4c390e8102cce2db9f19fce15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633303216, "uuid": "71c77152-eff4-4a76-8b9d-4472592b7e2f", "comment": "Malware payload (RedLineStealer)", "value": "fc1a066b9ffa79923dceff062ec3954b95c6dd2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633303216, "uuid": "6ba3ab99-8857-4583-9828-a19e65e58cb4", "comment": "Malware payload (RedLineStealer)", "value": "410c9840fc1b0f483f0514f7be906c850213734ffc8d9ddd537f5b1b0bc728b4996a9d5392c03e7726ee2be18de39e62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633303216, "uuid": "c0133b39-457d-4f39-b3a3-2c90f70a7e7e", "value": "T1A9063304524C519AE012F3F8DFB987CC744A23A0D8E53367E6B196DF2CAED493B946E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633303216, "uuid": "900af6c4-f6cf-409d-ad0a-a1de3f38052c", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633303216, "uuid": "5ccbde3d-8ea2-4666-b26a-ecfb98387f5f", "value": "98304:ycKtmqhPy1lqx7YDyFn0uY0ZafTMCZ/MvethKM2YTau:yH8qhPNYDqK0ARlhxZau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633303216, "uuid": "982dd4f7-f4e2-4a7e-81f9-ba86a645f911", "value": 3688447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633303216, "uuid": "96bd9371-6737-4281-a011-2fc26855c70c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633303216, "uuid": "cf57a406-0930-40b6-a51f-972c32683fda", "value": "19CC75C62F3EBB4E7444E3D29E4DCD1C6D43DAE4C390E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd939fac-246c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633281026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633281026, "uuid": "f16d8981-b039-489c-b2d3-f47f4119a879", "comment": "Malware payload (Mirai)", "value": "c9e2149030147f9c1ed8d528fd1559c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633281026, "uuid": "58e98742-917c-4572-8f24-b5e87a49304b", "comment": "Malware payload (Mirai)", "value": "1c80960c1dfb7929d132f30cc9d02b829592653938e8910e8ce76428b3f9261d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633281026, "uuid": "540c0b5c-6043-4f7f-bcbc-ac1b5683f646", "comment": "Malware payload (Mirai)", "value": "b6bb40f96f2ca61e1fb9017a02797c9c80f5cf74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633281026, "uuid": "01440fc4-089a-4fde-a3bb-d43cf98bed3d", "comment": "Malware payload (Mirai)", "value": "94a4a6413be2d4b3420898ffae03a9e881d6051c43306d5880ad3678cf1fb5db775ff4566d13f50ece2de7a185fc8e4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633281026, "uuid": "e81513a2-607b-44b6-94d2-550e80566890", "value": "T10C4302F1270075F1C9FC473269166D0866669936C3EE72139BFE471C02E55527BB8D24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633281026, "uuid": "c01728b6-7625-496a-a0ec-e9cd736c6cfd", "value": "768:SdXkAhT8Ylr01WYtScLiMd27UWxcRnXUJGY4uwwBZ9q3UELiDWBoKztLzJa+ImDY:RA9x4WI2aGU02nXGM1L3tzDImJiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633281026, "uuid": "4fcca4ae-e37e-4091-9be0-b7bf00e05a57", "value": 58160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633281026, "uuid": "a6d4ea3f-fbb2-462a-b988-af30b8c7ea43", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633281026, "uuid": "2b69b706-cd8c-4799-b43a-15d9ccd3745a", "value": "c9e2149030147f9c1ed8d528fd1559c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c321df1-2467-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633278662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278662, "uuid": "d920d9ae-3fab-4b13-9927-1a700677fee3", "comment": "Malware payload (RedLineStealer)", "value": "2610fc741ea6b3925dc01789ba0e6d07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278662, "uuid": "59233b72-3a7f-4d7c-840b-845b6189e312", "comment": "Malware payload (RedLineStealer)", "value": "1d3f5be570caca4c2efbfee7e7e08d81704e0a40fa19b1df5b0c8a1baeaa6b21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278662, "uuid": "f4a1e11f-0c8c-4ff8-81f2-09000f0019d2", "comment": "Malware payload (RedLineStealer)", "value": "1ab8b83c2d9d480cbfaf98630efaa2dd8ed4a693", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278662, "uuid": "50dea0de-06a5-4547-b4fa-126294a4e988", "comment": "Malware payload (RedLineStealer)", "value": "9ac196555b2cea33a250099177c74d4e8ccbedec4625dbc4e75c4150332224eb44ccbceec2469091d87d1ae5a2b62a20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278662, "uuid": "9e8fb889-2bd9-4280-a299-dd8d6b6a6413", "value": "T17D84CE097290CEF2D6B541B2EF16C7E45B2DBC696C35574F3B98362EBE3C3918A12241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278662, "uuid": "d7c70066-2cc1-49d3-b72d-3efb8eb36059", "value": "e1dc734f9d3fd8ffe237c21274508ba5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278662, "uuid": "6897064b-cda2-460e-96d3-8ee8e52a2c0d", "value": "12288:N+qh7cECKO+iFn6/sBMbw+TCL6+zxF6L:NBthCK/iF6kSCJL6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633278662, "uuid": "51fdc87c-12bc-4557-a23f-cfd9777b5470", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633278662, "uuid": "3e4abaf3-cc25-43b6-9f25-c906bfaa6bdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278662, "uuid": "f57cdc96-892c-4db1-ba4b-bcf5b95f64a9", "value": "2610fc741ea6b3925dc01789ba0e6d07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57506156-2465-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633277821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633277821, "uuid": "2182be8a-e0d9-432b-af4b-824d74f3e234", "comment": "Malware payload (AsyncRAT)", "value": "9743bbbd0929dc53164f7e7a27e99d1e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633277821, "uuid": "ca35ee2e-1a9e-4455-a1cc-00cd338eda7c", "comment": "Malware payload (AsyncRAT)", "value": "1db524041dce8e67b46fcee2ec04cc55d8ad853fbf757e3a83b4873a31c6e232", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633277821, "uuid": "2ff30fb6-2653-475a-9886-8952cf2cdbe8", "comment": "Malware payload (AsyncRAT)", "value": "32d84c387c90ce420f8b24fbe2c97538fd740d38", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633277821, "uuid": "c8e92df9-3059-42ce-a184-0ac6527a1552", "comment": "Malware payload (AsyncRAT)", "value": "0a7bdbf393828226b38e4e0b050b35744fa673adebadd0d11d8c42d5a3b90e85d1ad55e7e6362db12715ca4d03b5a259", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633277821, "uuid": "fb6a9a1c-99fa-49b3-86db-c4259c5b566d", "value": "T14DF0DD01C0FEFD778583B179898B9851E13412C617B0EE567075D056C02D7B886CE5C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633277821, "uuid": "ba17071b-a45d-4f8e-bd38-2d11a3cd7ac6", "value": "12:0uRj+G2TNmHIij9ggd3pm9iV5R9Gg2IIxmZ9y5HvTRo6R9GgzJCxu:0ut6TgHFje2EUMg2IIxmZczoeMgzJau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633277821, "uuid": "bb91f6f0-f126-48ec-9a1a-ef2688e8b100", "value": 649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633277821, "uuid": "192c9156-0dff-4df3-aa97-68f665d8136e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633277821, "uuid": "0e19b1eb-473b-4355-88cb-ddc870033fdb", "value": "GXFKM5606.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d8bfb1-241f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633247650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247650, "uuid": "052f9890-a784-4e42-a393-fbf7286e9771", "comment": "Malware payload (Formbook)", "value": "649ef81c0ce0f13b1197ccdb30685547", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247650, "uuid": "31406252-f711-4ba5-bc50-0400ce709ef0", "comment": "Malware payload (Formbook)", "value": "1f651f590aaf7682d6b480e690099b4115d91f5a260c961ecc6030b2c280708a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247650, "uuid": "00f00621-f04f-45fc-ae0b-3514142dcc96", "comment": "Malware payload (Formbook)", "value": "8a34d196fc7e805e5abcd75a9a6410e327b50358", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247650, "uuid": "c6815b34-0cfe-4458-877e-cf8b56faeba0", "comment": "Malware payload (Formbook)", "value": "1efe2440dbf174e8ca4e771ceefd547375bff5fe244dcf2ef26f7727c0a8f479b84d7108ab9750df966c11805acfc882", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247650, "uuid": "a1f16025-928a-44a1-b378-0b4b8d5c65da", "value": "T1E89412651A1F7604EDBC43B3C9A449D0AB3ED862E52ED67E3985307845D33FC26D8A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247650, "uuid": "9925a61e-d71e-4023-b686-fe2c4bebf709", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247650, "uuid": "029d0c98-14f0-4cee-a4c9-3129f21db155", "value": "6144:6xLTt+VwI6i313UZUtXmI6mzFTYthdX1y6doCwwt09IXXlXvijyO/lGq:61TgVwJi3y02I6CUby6doC8QfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633247650, "uuid": "26a70148-d225-4edf-b48c-3a91ce138c7e", "value": 441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633247650, "uuid": "f93d62da-b901-4aaf-9aa5-c5afd553fd20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247650, "uuid": "95faa232-6518-4c0d-a36e-271e9d18c0fd", "value": "649ef81c0ce0f13b1197ccdb30685547", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a11da1-240d-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633240264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633240264, "uuid": "b15f3ed6-07a1-4e89-93d1-0628af66f0db", "comment": "Malware payload (RaccoonStealer)", "value": "a53dae10133832767071048066e448f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633240264, "uuid": "9d954708-e294-4ef1-a9fc-ad4caf547b9a", "comment": "Malware payload (RaccoonStealer)", "value": "1f73eafb1b8706810f795bc406e6145fecd4826d7d72ed12cfa96d1a472c221c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633240264, "uuid": "6c905d79-380c-4a77-8c5b-6cbd90023eef", "comment": "Malware payload (RaccoonStealer)", "value": "a365e0c008dfabf7ac826099abde05f91992b694", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633240264, "uuid": "7f46c5ab-2e70-481e-b7b6-26ba98720abf", "comment": "Malware payload (RaccoonStealer)", "value": "17e1f825e776e749312d203ed2cb2d04689f609cd103f251450ff78211b369c2d91b2b0e07e5e30cf046b4095ce9f302", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633240264, "uuid": "9cb00e3f-3940-40b9-99ae-83085ef78ce3", "value": "T1CA349D10B7E0C034F1B712F649B693B8A92DBDB06B24D5CB63E55AEA46746E4DC30387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633240264, "uuid": "e8818080-ac96-4b6f-be4c-8ed8c90c9fbe", "value": "d31cc935cd1c6935cd48a10ef09a7414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633240264, "uuid": "1652e1fa-0265-41c3-b77e-3ff3855020fe", "value": "6144:xeZxFeYp8Q8HsLs2Sihb12BuU7UCvqr9D2T:xOb/p81Uwup6q92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633240264, "uuid": "0928a9ee-9a39-4fcf-830f-732fa74d7e29", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633240264, "uuid": "118e5276-8948-4b6d-b31a-2234521a31ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633240264, "uuid": "aa225efc-c34d-4b8f-bc07-ee32de297c57", "value": "a53dae10133832767071048066e448f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b10079b-2466-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633278284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278284, "uuid": "dd42da89-cd99-4559-86eb-80a978ee844a", "comment": "Malware payload", "value": "35017215e01c6b1a44e76948c0aa5ba4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278284, "uuid": "ee86531e-df48-4f65-b43f-d160f6650b72", "comment": "Malware payload", "value": "2056fdb66896bbbf491ea0d31c64c5937f05fe1311dab22fd1dfa933038ef65b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278284, "uuid": "fc4755c3-e8bc-4cbf-b038-ef4ebca285d2", "comment": "Malware payload", "value": "5234bba8874bfc71fc540baa73262d4e43a5d68e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278284, "uuid": "57808a54-ca8f-49f0-af1b-f0744d3beb79", "comment": "Malware payload", "value": "f50cd311fe89b3986cc86f831dc3c37bfeb7f2f085f6d83bb661acff934411626bd5eb0311456e03fce16be65a7cef8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278284, "uuid": "5b689982-272e-4577-a665-8e8f2301a370", "value": "T11FF401193181CFF2E6B206F1AB19C3F0496CBD6E4949560F2758376E7E3D3928A22753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278284, "uuid": "657e8dfd-4308-4eb0-bf8d-166f6ce88f48", "value": "e1dc734f9d3fd8ffe237c21274508ba5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278284, "uuid": "1e21717c-cfd3-477f-aaaa-93c15b62463d", "value": "12288:HYAsFS4L88u/IUvJXlGq5WGZZUcN+7Zvf1PyvEKnsy3dVZvDL6+zxF6L:HYPXL88WzlrEG+7Z1mnns4JL6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633278284, "uuid": "5adc08d4-b749-4ddd-9f4c-40f4bb31e21c", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633278284, "uuid": "a5103a3e-600d-4693-b797-4744578fccb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278284, "uuid": "0548cc40-42db-4e8e-9a0d-b6b3d43507a4", "value": "35017215e01c6b1a44e76948c0aa5ba4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b0fb77-23f5-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633229733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229733, "uuid": "86775145-d2c3-4e47-ac88-ed268e2023c5", "comment": "Malware payload (RaccoonStealer)", "value": "b1cc0ec3bbf92885d7a575425b44d36c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229733, "uuid": "32a82bae-0742-4b2f-a56f-eb991dd1b23c", "comment": "Malware payload (RaccoonStealer)", "value": "20d96058a122327cad201a01c2acacaf973388127c2356b4cfd8e72ed4d468b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229733, "uuid": "bc1e3d67-1631-4282-a678-2a771df24dcb", "comment": "Malware payload (RaccoonStealer)", "value": "6436118ab370275a8cfa2a672cadd6b114050eac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229733, "uuid": "696ec988-027c-47b2-b920-5e94c5cc73e9", "comment": "Malware payload (RaccoonStealer)", "value": "40d6b0a30b77e5122f55b08688d778abe54d1547acca25b9430396dab2417d9ce2ba3d675a9636293a92692e8f0944b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229733, "uuid": "dcff48e2-b2c5-43b8-9e9d-4a1f24107cc3", "value": "T186B4E020A7F0C034F5B712B445FA93B8A9297EB19B2890CF93D51BEA56342E4ED30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229733, "uuid": "45102c7f-4469-4973-9661-be1c5518b62c", "value": "949cb2a875d86b476d185d15a2fa1cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229733, "uuid": "5bd29913-8754-4a05-993a-0761a9d9125f", "value": "12288:b0aPKUlMeHPgjv9E7BZGr5DcyS5TcjPgyvQyqafhEhngcHSU:3hTv29EFZGFQyqTYvtfh8ga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633229733, "uuid": "e3ada9bf-293a-49b1-aef3-dfcfc59f845a", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633229733, "uuid": "463643b8-1692-4343-843b-541cb21d0781", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229733, "uuid": "d585f3e1-b66e-41cf-be37-72640ce91184", "value": "b1cc0ec3bbf92885d7a575425b44d36c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e45ed9-2467-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633278545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278545, "uuid": "fe00dc90-e4af-4548-9fad-1c07b9c6649e", "comment": "Malware payload (ArkeiStealer)", "value": "32c8eb8d27f4998b74b9dd16d925eac1", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278545, "uuid": "ee090cb3-bd42-4a61-aaaa-b43660c9de8d", "comment": "Malware payload (ArkeiStealer)", "value": "21c6e4a8fffab45df1e5f7e6b01a5ef7fc116dd8979e4e84c789d3c77ecad1ed", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278545, "uuid": "2e112e24-f78b-45d7-8897-9b4c7894f4bd", "comment": "Malware payload (ArkeiStealer)", "value": "dd16ef220f4ca1f0c9f52de60a0c047d6d017e0e", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278545, "uuid": "1372543e-09cf-40de-bcc6-167187f24d19", "comment": "Malware payload (ArkeiStealer)", "value": "f89ada491cec747f1bf0ad7eaf5d653e460dd6ffd7a26efc16e6507fb6699ccf85ede6cb3ee637cd1bc84b9425f83232", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278545, "uuid": "03c8cb94-a955-4747-9b4c-f9a16527d6e2", "value": "T194F401243583DFF2D6B405B8BB5AC3F44A2DBE6C8D27924E6748375E7E3C2924626341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278545, "uuid": "1ce3a909-bd05-4aca-9794-6b48bf2530b6", "value": "e1dc734f9d3fd8ffe237c21274508ba5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278545, "uuid": "ef2d25eb-0afd-4919-9e9d-0758bfc412a8", "value": "12288:DsX0FSIboWXkU9nWbiIc9qChvywvlYkT8DWM+a3U7F3mL6+zxF6L:DssHb70sWbw6QM8ZmJL6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633278545, "uuid": "437c1127-b990-4e8d-82c4-64cdcb74d137", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633278545, "uuid": "abebfdde-5f3e-4658-9258-12c9ce892f88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278545, "uuid": "90b0bf70-2eca-484a-a253-2e6733c5c430", "value": "32c8eb8d27f4998b74b9dd16d925eac1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53115f93-2431-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1633255480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633255480, "uuid": "663eb027-6e79-4707-be34-c47ac5569087", "comment": "Malware payload (CoinMiner)", "value": "555fbd82fc7c8b2effb507a3ddd401b9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633255480, "uuid": "e6947d45-9e07-445e-b903-4fa8dd5ba0e8", "comment": "Malware payload (CoinMiner)", "value": "21f3ee4c865d930b2c8e194a01d4eb00563752e7e04cd380996a19b969d510a1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633255480, "uuid": "214dd5c8-3882-4c74-bc25-8f0b6dcff676", "comment": "Malware payload (CoinMiner)", "value": "2d874c268a3029f106d4383fc92660d71410f4a1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633255480, "uuid": "c95eb9c5-724e-45c6-89f8-29d92269ca66", "comment": "Malware payload (CoinMiner)", "value": "956bcce748d72b079fd1c945b5b0618f5b5fc7c30a625a6e2e391284238f48c94e649f98e51fd8d390adbfe6ddc99843", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633255480, "uuid": "cfeabdb1-71e6-49e6-9400-6fe1d85c8816", "value": "T1869533C3522EEF14CD3FA979201BA08DB8193CB944A2551B950CEE7EB5DB749C603A3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633255480, "uuid": "0d867d81-0117-4717-820b-849c276dd75d", "value": "49152:yaDfzmHyH/I2zLvJhEWYgU6LMFIexu/nDPu0mv:Nayg2zLvJhEWYgU6gOexiLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633255480, "uuid": "2dcf6b19-45fa-4446-b2f8-f1ed6a94cb55", "value": 1998336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633255480, "uuid": "c3c68b83-f8d6-4a63-8f9e-ca464deccd88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633255480, "uuid": "86c275b4-0161-49e3-9a12-8f145ff8ed83", "value": "555fbd82fc7c8b2effb507a3ddd401b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0788bc0-23f2-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1633228552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633228552, "uuid": "6d5f374d-c407-4b5f-a5c6-dd8b8728fb26", "comment": "Malware payload (BitRAT)", "value": "3c2e2174b73b828f7c62fa09a0130425", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633228552, "uuid": "4417acad-364e-4cb9-bffe-f07b92f60450", "comment": "Malware payload (BitRAT)", "value": "234bb96bcf4b2b06f5627928a2532feab2bae8a270a609889b629c589a919c09", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633228552, "uuid": "3b7525c9-6b23-4611-90e1-c99b3d7da3f2", "comment": "Malware payload (BitRAT)", "value": "533a27b2a731d90938398df2270206c9211371cd", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633228552, "uuid": "52c4cbbf-dfcb-4034-8dab-dca807e6d803", "comment": "Malware payload (BitRAT)", "value": "22743cd9e2992aa592170fe7d4bfe24a906b86363b8f191f7fdc1d4d946922abb1772b923b86b4910da453afadb3ca3a", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633228552, "uuid": "05c66329-5d31-4575-a9e9-b1e137a2ef28", "value": "T112256C6B9EE55D76C066027D0CD6C3A23525EF1B2E3BE4111BFF1C6C5F2A2A1342C692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633228552, "uuid": "6499ba92-86ef-417b-bf5f-ad0786e5afed", "value": "22c62dafdcddec00c41ec119b235881b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633228552, "uuid": "d59c1688-872e-461f-a92b-eae76a193ff8", "value": "12288:fqhq9twNlAA2fg9igx//wTw4bZmPDjIj1WmBgO90Oe6jkOGbGPoznemM4:feF/2fg9igp/wTwuGDjIYSjGyozM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633228552, "uuid": "aca83918-8108-4ef6-a5eb-f87885aae95b", "value": 987648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633228552, "uuid": "7826c8ee-5e92-4170-a9b2-fda0526830c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633228552, "uuid": "b1853dc5-b88d-46be-8038-20f77f76b0d9", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436c3c21-249c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633301410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301410, "uuid": "f32354eb-b240-44bb-9218-165e05c4ac23", "comment": "Malware payload (Mirai)", "value": "7ade38aa0925cf01a70ef6a0ec7b7c14", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301410, "uuid": "13bb48a5-90c9-4149-98f5-4f1ffd5624ef", "comment": "Malware payload (Mirai)", "value": "24512c2a4fcde4f5c5e00287300dbc4bfc43c3cc4e9203bf597c50fdfc326430", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301410, "uuid": "38b68b9e-2e67-461e-897e-8ab96d160443", "comment": "Malware payload (Mirai)", "value": "03a77db5f5b8f6b4ab4f0034f1b61009bebefb53", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301410, "uuid": "9fa6d12f-c402-4083-bb70-2d2aa1be3c3f", "comment": "Malware payload (Mirai)", "value": "7b365e4dc9dc49e403f9ea65695499e4307c3d677476365dcd4dc476709993309d02fea6dc10ce17d0e8826d45c07a77", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301410, "uuid": "859fd0e3-e675-4cc1-95a2-9f6ed366e4f7", "value": "T1796329827C80AA26C7D0177BFA5F108E3315A7D8E1DA73478C142F9576CA81F0D6B78A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301410, "uuid": "3e20a31c-cb88-4908-b4d2-0c336386883d", "value": "1536:at/LYbUxYVUUO03k704oVLMNKHwbKnJeZWovjHJkKIg:at/LY0bKJwpvj3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633301410, "uuid": "a3e063f5-8136-4564-8951-b6cb355f9a4a", "value": 70468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633301410, "uuid": "7b0fc513-4d79-424f-8cc3-d590d55f894f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301410, "uuid": "ae32569b-0f3c-4fe0-b390-355a1eb292fc", "value": "lessie.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b33127-2465-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633277768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633277768, "uuid": "5544c9e3-5800-4ab9-ae93-632a89470b6d", "comment": "Malware payload (SnakeKeylogger)", "value": "6e04ca48106d07758d78e11faa0099b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633277768, "uuid": "77ca19ff-3fcf-42cd-bb7d-0d01df05319b", "comment": "Malware payload (SnakeKeylogger)", "value": "290e4b2cc3c8ea0e2991c852dd3a0ace93441690b1b2386e5f919fc0909bca30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633277768, "uuid": "47207c4c-8876-4874-998a-0abcd2f1eec0", "comment": "Malware payload (SnakeKeylogger)", "value": "3746cf409b972a6ae1fd5c5eca5d3e9ba9e79347", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633277768, "uuid": "cf24aa95-963f-4472-9614-8c60d6cf961d", "comment": "Malware payload (SnakeKeylogger)", "value": "833609757bbd2e029faeb3c14be3039ba6b6294a1e896330a2e33615788e530a380446741254aa03252aa63118fcb39b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633277768, "uuid": "7050bcf1-0042-47c8-8bd7-e209ab978257", "value": "T11E84F1A8231B206FCE5D81F4A4B68AC053F0B1B11A15F3F5AC8D30EA69F67FC4685587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633277768, "uuid": "7b6235da-c399-4881-9638-b36d5faf9122", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633277768, "uuid": "3a5af59a-6585-45c2-93e1-894c06202601", "value": "6144:jp7F5Tzx9M7u99IvYPGy2TlJ57stlBNCTHOK0hUV/RZ/ejpqmZFZLcRBU1VcO/lk:jp5lTIvYJuJwBITlVZGpFRcRRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633277768, "uuid": "dec88529-addf-47b8-af58-0c064235d444", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633277768, "uuid": "4f8cbe0e-93ff-405f-8063-830b880b0d6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633277768, "uuid": "9e005ff7-d467-4d52-aaaa-d474fd010860", "value": "E-Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b9488f-2466-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633278277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278277, "uuid": "177804b6-f94a-4272-8685-886dbae9906c", "comment": "Malware payload (DanaBot)", "value": "331fd56e84657a3edb69e439fe843f54", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278277, "uuid": "1f2e8de1-a8b2-4131-8691-0461ddb98cf7", "comment": "Malware payload (DanaBot)", "value": "2a948b38ca5257d8347b66757eb01d8df2d91c41ae08535706be17f9d9c5f956", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278277, "uuid": "aa0a0686-1b33-4875-8eb0-cfa3510f606f", "comment": "Malware payload (DanaBot)", "value": "33b09d8351033603c61e014fcbabced80b0e192c", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278277, "uuid": "64f6fd65-87a8-4f4c-93db-41ce9fc319a6", "comment": "Malware payload (DanaBot)", "value": "22251127a9fd09491621d7eebf0ce957e75530ed3f821ca294f7a8ed39fc918ffa6e74b1f550b2e9cc6397ee9b049a99", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278277, "uuid": "ea4009ef-d8e7-4757-9eb1-3d3bdb4ec48d", "value": "T15D45121A2182DFB2E77651B0A76AC7FCC52C7C284D26068B6B59367E7E3E3C19315342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278277, "uuid": "e1a0b193-951d-468e-8940-0fbf611111fa", "value": "e1dc734f9d3fd8ffe237c21274508ba5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278277, "uuid": "fd7ba09f-5d0f-4cd7-94eb-d0d2df6d7c3e", "value": "24576:KTbsrwPV11lUpvTsyKtqwZkivNi7y9hKMZZhpguejNUsAnJL6L:KHP11lygywqcvNiGbPhFKUs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633278277, "uuid": "82511e5b-15c5-4f28-bcbc-85ad994fd4af", "value": 1239040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633278277, "uuid": "6171b03e-a7ce-4b09-8993-7f04251b17a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278277, "uuid": "76a2a5df-e3f8-41f7-9b57-29137e7bde6a", "value": "331fd56e84657a3edb69e439fe843f54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a269ef2-2467-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633278631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278631, "uuid": "52c17da0-ddf3-45cb-adbc-6a286b170e15", "comment": "Malware payload (RedLineStealer)", "value": "c3fc79802e0066c4ac109f05deb7ed2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278631, "uuid": "039af7d1-5b16-43d9-b5cc-22581e371eb7", "comment": "Malware payload (RedLineStealer)", "value": "2c61f41bfea24a73e92557137ad17644e4a5fb6097b47667f9c46ac4de1bd09d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278631, "uuid": "8f21a967-ea96-41b3-97a2-0497f9416eb7", "comment": "Malware payload (RedLineStealer)", "value": "ca00e8fcdba699aed87142ba36661f46d42a2d92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278631, "uuid": "7f491086-963f-4f91-b30c-776e72508264", "comment": "Malware payload (RedLineStealer)", "value": "b41bfcca2a340330c116da3ed3d2fd5e1ce0183c9e8c6a9444c9cac8ecff5a463d80bf8f7239bb4913cb629ff0fd1d18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278631, "uuid": "cfddc4ed-68d9-455d-a907-2b580b0fd27d", "value": "T1F2259C86255E925EC3BC5C7899E4B8FFC46C0D00AF97A0AB72C018274D28FB0B5E65DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278631, "uuid": "caffeb43-85e0-46ad-bc35-072d647baf40", "value": "7e6d410cb0ee9d4d9be8ad4e6fd75b64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278631, "uuid": "b43a54af-6f1d-4488-bcee-24f42843b6fb", "value": "24576:Fp0a41sZb77n6Zv40QIi4BMvZqU13/Ya2Qq/OJBCoHMCbThaLkM:AfdgpMcTsGhYkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633278631, "uuid": "17390355-df02-4bbe-a6cd-a31f26f8bac1", "value": 999936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633278631, "uuid": "001c83ff-259f-444c-ac93-f7ad9ed0229d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278631, "uuid": "39d8e9b4-34fe-452c-bef5-a18c03e301d5", "value": "c3fc79802e0066c4ac109f05deb7ed2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94cbb344-241c-11ec-843c-42010a9c0014", "comment": "Malware payload (CryptBot)", "timestamp": 1633246571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246571, "uuid": "f2e329f6-21c0-49b0-af39-f8ac38f3153c", "comment": "Malware payload (CryptBot)", "value": "5a0ea4aab5f283b5c7d234322e04c6ce", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246571, "uuid": "8eeb5e7e-ff38-40c3-bbc7-7165d2c64d16", "comment": "Malware payload (CryptBot)", "value": "2d090e48369efcdbebf9df5aed96857cd442509bb5f59e171f2b1b3cf1a56361", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246571, "uuid": "d38b9c5a-ee17-48a8-bd21-775220e2c9e6", "comment": "Malware payload (CryptBot)", "value": "33509a78863b9bd7385054aa5bc92b8ce4f1ab5f", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246571, "uuid": "1878b9c3-b8cc-442b-9c39-9b4eb51cde98", "comment": "Malware payload (CryptBot)", "value": "b392ffa7571255f5050026f125b5a381f472bd0c2be952c60b9d359700724bd92e7a92cf04d5fecca306b9a3008b5779", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246571, "uuid": "efcc069d-4fd1-4fd6-bddd-13b761d83853", "value": "T1EB74BF20B7E0C030F4B756F589B99379AA297EB1A73441CFA3D02AEA56746D4DC30787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246571, "uuid": "ee74e487-c685-4626-9a41-86c058794e89", "value": "0af56bf70c7b81394871a4713f3cc30b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246571, "uuid": "f51a0eab-4f90-48b3-b7a8-e3aa4d4e9a29", "value": "6144:TQovZhTYZt0q9g4vYGDIIMJPdvQIZselS5OH8D7d0qthV07:ThxhYZt00gB6Ir1dImDS5T7d3zV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633246571, "uuid": "25d16d81-1099-4355-8c7c-13408d52d76b", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633246571, "uuid": "9844d93e-b104-4261-8c48-f434a0d1649c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246571, "uuid": "55ba5f54-78b6-4e6b-993b-cb0e05d1a9fb", "value": "5a0ea4aab5f283b5c7d234322e04c6ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97625d33-246e-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633281794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633281794, "uuid": "9d72633e-fa92-4efa-b140-eba3218b3658", "comment": "Malware payload (Mirai)", "value": "1a0b396bd7476234329b6de31247596a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633281794, "uuid": "bcafdaf8-8a5f-448f-8c8d-2a187a310533", "comment": "Malware payload (Mirai)", "value": "2d1ed53ed412b1637f05770a5ff129004f032069ffd4766a720e8eb14552cf86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633281794, "uuid": "d01ad002-0a17-4222-8c2d-c9a2a0d7f531", "comment": "Malware payload (Mirai)", "value": "35814ce939c53135a5cddb7cbcd0ada2bc093db4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633281794, "uuid": "94349b31-d9d5-4db9-9fb5-30bf00f06a9b", "comment": "Malware payload (Mirai)", "value": "48dd08c305cda3051e086b111268cecf1f95a963c543992ebaca90666bd8cfdcaa80543fc1f8104481bf1a24e941a835", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633281794, "uuid": "83d8fe82-1bae-4c1e-bf74-7b98c5ef2f47", "value": "T11DE2D0304112BAF656B44837F32E9D5F573233F0947D3BA38AA1266483B215B573D3AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633281794, "uuid": "4a8476c9-e0b3-4241-915e-5a4955d6dd66", "value": "384:8X3p8bZffHmIYZFAMkKmwm1WODvZGnPrzxy0v+itvL690dlEjvmhteRZyofQ6dlx:4itF+ZPY0v+XclumveRMh6D0WCs3UozF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633281794, "uuid": "0cbd507a-622e-4592-bcd2-fbfde9b44231", "value": 32556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633281794, "uuid": "cc58fa61-6678-47c3-937d-fbab2f7fce2b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633281794, "uuid": "34d42d49-953c-45ba-9341-f0d90581a112", "value": "1a0b396bd7476234329b6de31247596a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feca846e-241e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633247608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247608, "uuid": "867dc955-b5f8-497b-97a6-6d435b1ef519", "comment": "Malware payload (Formbook)", "value": "26c2ebe63533d05a859e5f990091e487", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247608, "uuid": "98901462-f235-4ab4-bd19-1ca0ffc5c242", "comment": "Malware payload (Formbook)", "value": "3030cdabe4d1c1f0e6c32acf90cac76165ef0dcf64ad6914077743c2a4002c7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247608, "uuid": "8260a7c3-5eb7-4943-824a-d06485d05c66", "comment": "Malware payload (Formbook)", "value": "2ff06573307e907efb4bcd1de1d1777f5d4279ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247608, "uuid": "637e4f96-8472-4d8c-8eb7-bd84049ba5ef", "comment": "Malware payload (Formbook)", "value": "df9cd9717e21879329f2c099392b3eb24bf486d715ed2ae392c0cb956e5463be34d4e5aaf564f1254fe15499f43fe0d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247608, "uuid": "7c534a0b-e3ec-461f-8d41-b3e42b93e194", "value": "T185E46A58E22FEB69FD1923F1263CFCD015F82A69143CE927BD9660E27489F7550B0263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247608, "uuid": "1a8326e4-e612-4d12-82ea-7f8531743f30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247608, "uuid": "63961e9f-09a3-40dc-9963-debe5a696148", "value": "12288:fqj+Qa4m10J4hN6uILnI+WCqRux77dgkbQ+X8+UiDLbRHahw:fa+jSJC0rLnIRytbQ+X8+UiDLbRHahw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633247608, "uuid": "eeb0b26e-a9be-44bd-9d7b-fde7f89c5f25", "value": 661504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633247608, "uuid": "c609c424-fc47-4c25-a5dd-ca70638ad249", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247608, "uuid": "abb4bbf6-4af3-44b4-aedd-1211b9185633", "value": "26c2ebe63533d05a859e5f990091e487", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2975725-2422-11ec-843c-42010a9c0014", "comment": "Malware payload (AZORult)", "timestamp": 1633249252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633249252, "uuid": "58411c11-d6fd-4a77-b8e0-160509c5277e", "comment": "Malware payload (AZORult)", "value": "f6a5ed7c8eb538950f1b30417d8db1c6", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633249252, "uuid": "9c8f87d0-ad6d-4573-9edd-b30c0cd908e6", "comment": "Malware payload (AZORult)", "value": "314afbf4a221c8ce6f8d2674277a3c2fb119c34222b5c3ed83afd79005e352f4", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633249252, "uuid": "8e4f61e2-54e2-4f43-989a-ba821b46682a", "comment": "Malware payload (AZORult)", "value": "e615250dad4a0df447f2f20cccd6ae21df91c1fa", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633249252, "uuid": "e0e9fe3c-d95a-491e-a2b1-6e7172e04def", "comment": "Malware payload (AZORult)", "value": "8f4b8495419ab036fe09bc286d7752d0293b874b4c74823ea8410b1b35bc77d4e754bff1d043ba293d6323406fa485db", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633249252, "uuid": "574250d2-d329-44d8-af9b-48b8c0fe0d60", "value": "T1E16512175F3E0012F4114AB21AA005F86F7DAC173C92AD5FDB45FA4A0DE3A496DE06BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633249252, "uuid": "ad5bf638-3146-4b71-90b1-5d1e7905a1ef", "value": "31fdddb41123508749dd6c9468f73e6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633249252, "uuid": "2e489ed9-9fba-4210-97e7-80c80476c4f3", "value": "24576:L1TT8MAk9G1QSaKhUNoT8M8Cfp1cReyyRzT8MeVkFjp1cReip1cReV:ZTTnf9PpKhaoTn8CfDmePzTnljDmeiDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633249252, "uuid": "69eaa6a2-75e7-4ae8-b47e-4385ca3e94b0", "value": 1474560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633249252, "uuid": "75bf1ffc-7e78-4d84-b198-4e82207cb5ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633249252, "uuid": "2ab18fe1-c49c-4084-8072-3f3abe8744fa", "value": "f6a5ed7c8eb538950f1b30417d8db1c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3711b72-2418-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633245012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245012, "uuid": "bfcc1f94-591e-46d8-850b-b61557f2f1a9", "comment": "Malware payload (RedLineStealer)", "value": "db9cc09be1a1a4505bfb191772833d69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245012, "uuid": "b6e63a92-0680-44d8-9bc1-571b2f2060ab", "comment": "Malware payload (RedLineStealer)", "value": "31bf335883616edf928e0a4a6ba9a4efba77afe243ec81a42c65f25ada8c9784", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245012, "uuid": "c25015eb-81d2-4dd8-8ef7-42146108ff4e", "comment": "Malware payload (RedLineStealer)", "value": "c5ebc5d1c48643dec082b2faae89fa14fd02a255", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245012, "uuid": "7fc5237f-02af-4257-b9d3-a721cdb3ac14", "comment": "Malware payload (RedLineStealer)", "value": "56f5284065f17e27356b015100c2e9be0275735d09660fa804238f2e9b194d60756df0f6587d38a26b455e72e44c5cad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633245012, "uuid": "627e15be-4168-40ac-8380-d99455bdd0ac", "value": "T1A8A4EF28687FC019C5E3EEB52DDCA8BAD99A55E3640C703701B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633245012, "uuid": "01f3523d-4405-4ad6-b802-5387f8ff2214", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633245012, "uuid": "e9ac002f-8fba-462b-bfba-c112b1a18ed2", "value": "12288:e8klT97igBMJM8Ajhq/dK98KGa4YR1HK53f8hit3hDyYhE:eD7jhm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633245012, "uuid": "f6b31071-4c4b-4f82-9221-fbd86a937cfc", "value": 449840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633245012, "uuid": "e8e1ee0f-3705-4d85-9145-3682785d287d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633245012, "uuid": "dcab419f-6d56-4c2a-a990-201bc47630a6", "value": "db9cc09be1a1a4505bfb191772833d69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6567fbeb-2480-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633289441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633289441, "uuid": "0518c740-87bd-4ddc-bb68-555d42b75160", "comment": "Malware payload (Mirai)", "value": "69304752555aa4041702df78b73cb48c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633289441, "uuid": "9e767dcc-3063-41ec-b6d4-c8e8dfcf1986", "comment": "Malware payload (Mirai)", "value": "32ca0c18270e9c8308cc4d47ca0a023a376f4b625fe3b2fae174aeb32559a271", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633289441, "uuid": "616afa46-d51a-40fc-8bda-f88c4e47122c", "comment": "Malware payload (Mirai)", "value": "d596ccabaae87f76a3f415073b69c1aba933f4f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633289441, "uuid": "50127e85-7c0e-43f2-8204-3e85fc273c3b", "comment": "Malware payload (Mirai)", "value": "b2ed9dccd266cebc9efd05dc077988417a4b794886350b4c5dcc245658a697a62733d18271d4f9c3980f93882a4e119c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633289441, "uuid": "e7a698ee-c8d0-4c56-b8a8-b7ce93a8d218", "value": "T105D33A05D8909767C6D227BAF79A428D73236B68A7D733115A28AFF42FC1B9D1D3D020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633289441, "uuid": "f02d7815-4c9a-447c-924c-56fb667ef96b", "value": "3072:gVfyQ+d+pceQGfUbvTapLFhWOiwTteqHA45hLPk3H94G1ZZTMmydQCYMhEFg:/bvTapLFhoUHb5hLPk3Dv4mydQCYMhE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633289441, "uuid": "e101b80b-eb54-485c-a490-b06aaa0d1e76", "value": 142751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633289441, "uuid": "3295d331-ee82-4bba-98de-8c1b0358f106", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633289441, "uuid": "802b4f7e-4f62-4941-ae78-7c569612b0f8", "value": "69304752555aa4041702df78b73cb48c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d96a291e-2445-11ec-843c-42010a9c0014", "comment": "Malware payload (TeamBot)", "timestamp": 1633264296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264296, "uuid": "2bf45892-0386-4224-a432-fa23b33752f9", "comment": "Malware payload (TeamBot)", "value": "7637aec032b0e8ee10fc7476ebfcb62e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264296, "uuid": "8726a768-726a-45cc-adac-42841e5c3cfa", "comment": "Malware payload (TeamBot)", "value": "37b83f30d32cb0516a7f4df726ecc8fbf5b5d5b5c0fd7d65fe1c0cbca93feba2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264296, "uuid": "884a876f-122d-4438-9e8e-bfcc30d09b13", "comment": "Malware payload (TeamBot)", "value": "aea12c234feaa6520228793eb46c249d49e87e07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264296, "uuid": "89f0d503-32b2-4851-a942-b975bd866f75", "comment": "Malware payload (TeamBot)", "value": "6a27034e0a33920226814cf71e78a22f03661d25a2338f5a4bc4d5c9bb04a61786d1db3fd8c068f8e9072e7eaa007c90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264296, "uuid": "48d20a27-5bd5-42b2-87bf-67f3d25a9c7d", "value": "T19E0502057180DFF2F2B755B0577AC7F2497DB82D49261A8F1A9B376E7E3C3819A12202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264296, "uuid": "c4761f24-0a5b-4857-a0ac-b65632cbe69e", "value": "401c37f2bd821b3afe64e4a9a74e43f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264296, "uuid": "95cae290-053b-45f7-adfd-9acb2be7efb3", "value": "12288:0WP4GmjNJnl9a6LdFxCXYaEEDEYSKCKe4nKBrqF25M3ZWZygqbI0kleoyU2cL6+2:WGmTaroaEDbD4nKB2F24ZWvlHtJL6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633264296, "uuid": "f6c276d7-5789-4140-b276-28081425073c", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633264296, "uuid": "6c188ea2-d7cd-46b7-aa7b-7410d2325e26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264296, "uuid": "0b1b07df-169f-401a-b1fc-d36689ad7e4f", "value": "7637aec032b0e8ee10fc7476ebfcb62e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b46035cb-2496-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633299023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633299023, "uuid": "0c527132-9e6e-411d-bcc0-b27b1776922d", "comment": "Malware payload (AsyncRAT)", "value": "9ae2ad86a4719e1d1ef49e46aa3d188c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633299023, "uuid": "b27d4989-a6df-4841-95f4-4c7aac8ed9ba", "comment": "Malware payload (AsyncRAT)", "value": "390d8293a8f0837555820037b7f7a0cb1e6e4b6c61d05d597669bfb7951a0343", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633299023, "uuid": "e19f7bac-691d-494b-ace5-112604e0256b", "comment": "Malware payload (AsyncRAT)", "value": "b10d105beb9894804ae3c5c959bbc52bb14c538e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633299023, "uuid": "b58aba30-2050-4a29-a293-7d91ebe5ab32", "comment": "Malware payload (AsyncRAT)", "value": "6598720e2072947c218203391d49a313000ffd950c5bc0b8ca04ac0ebee979f3eede15613c18d59780a9e74a5e4a74f6", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633299023, "uuid": "12eeb116-830d-4a42-9b93-9fd1934a4482", "value": "T1EE232B1037E8812BF2BE5F78ACF26105467AF2673A03D64A1CC451DB5A13FC686526FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633299023, "uuid": "bc8a0e8b-b2c3-48b6-ba3a-6d2b3c768872", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633299023, "uuid": "db6cd496-3df9-4813-8663-3682d4756c30", "value": "768:fuOz1TFwR+HlWUl6Ofmo2qDwmCAPaaNPIfzjbggX3SGGXHX1KNmCLdBDZHx:fuOz1TFLZ29mCOqf3bHXCZX31xC/dHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633299023, "uuid": "69bcf0e5-52ee-4478-ac98-52dc35b077f7", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633299023, "uuid": "2bf574ea-aaea-4cbb-9c03-bb4faeeb4763", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633299023, "uuid": "80b1e492-ce56-4db3-9891-bb4986e24315", "value": "9ae2ad86a4719e1d1ef49e46aa3d188c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15fa234-2422-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633249250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633249250, "uuid": "928fcb1e-f786-4346-8c76-236bbbd2787f", "comment": "Malware payload (ArkeiStealer)", "value": "1c14f817504c54653c779387de0a058a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633249250, "uuid": "eb54095b-5de7-4871-9b12-54b25567c742", "comment": "Malware payload (ArkeiStealer)", "value": "394c61c695af669dcfe4d3dcf73de5099ed8e7fea036dd25f45ff6d234f9547a", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633249250, "uuid": "d5065f1f-aee8-4630-89c7-028635f36a6c", "comment": "Malware payload (ArkeiStealer)", "value": "87e8826484135a91d14a610176f7ed6347ebdc5d", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633249250, "uuid": "ccd713a4-54bd-46cd-b931-505e959cbcf3", "comment": "Malware payload (ArkeiStealer)", "value": "1ee821e3d3368314f49d9a90c896d8f98589abe2a5d10424417cfbd50d1d695309bb7e7bfbe8241a96549f05a2ad4bf6", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633249250, "uuid": "5c4528f4-33c3-4bf1-a1c5-6f5e4a1c621e", "value": "T1A80612BB8632EFB4AE683ABE945736402D512A9F80CCC779B18D51F739D3A0549D807C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633249250, "uuid": "1d505189-df3b-4707-8ac2-065b239b207a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633249250, "uuid": "bbc66843-2472-4497-b33a-e1a54a584916", "value": "49152:zMqcEXeQ0LZzl0LAiu0vA5ylRmqx0uBEGFFeVJHHhQo:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633249250, "uuid": "e171b128-f06e-4d52-86b0-0645db5ed1a8", "value": 3778560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633249250, "uuid": "1dd8ed70-87eb-47b4-b04d-b72982e3ba52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633249250, "uuid": "20722ea6-7c39-460e-983d-c7d501337962", "value": "1c14f817504c54653c779387de0a058a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1110317e-249c-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633301326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301326, "uuid": "6a479945-4797-4877-912f-35ed25297a05", "comment": "Malware payload (Gafgyt)", "value": "1a3a7c33ebe3d59ab6935ab3e4714077", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301326, "uuid": "ae3ea17c-28d7-4cb6-a755-16bba6cef26a", "comment": "Malware payload (Gafgyt)", "value": "3952dcd10ea2f2a8ae7d5d270f780501029371b8ae89d59e56d8232678be5091", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301326, "uuid": "8bbeabb6-ca91-49e1-a060-ba66678728d6", "comment": "Malware payload (Gafgyt)", "value": "e77116b892ba93281e2100e8091788a4d77de632", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301326, "uuid": "f4163557-d49d-4963-966d-9da873c3a74f", "comment": "Malware payload (Gafgyt)", "value": "839cc31754d7deb61086c286d056f0112fdffde61757e385f4fc824fbe432e0c3913f79bcb24824240ec267acf3f8e20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301326, "uuid": "567f79ad-3782-4ecf-868a-79b24b188278", "value": "T145E34B09F6408B53C0D32776B68F534537239BA5A3DB33069928AFF43FC27A94E22955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301326, "uuid": "bd7eb3d6-69c7-46e5-b552-e268d2d40536", "value": "3072:tdntU2haO5H1XacBoGmh9H5p5hDiGRvEM/9f9T637m5wTsL/Qpyn:ntVhaO5H1qEc9Hr5hDiGRcM/9l+7m5wS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633301326, "uuid": "9483dd56-200b-471b-9e80-9c51a6852c17", "value": 156296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633301326, "uuid": "52bc487a-bc81-4154-8c78-24cab2e0d974", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301326, "uuid": "a95138c1-d928-4988-8e02-8897d86ab47d", "value": "1a3a7c33ebe3d59ab6935ab3e4714077", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee44fcdb-242a-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1633252734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633252734, "uuid": "fbd8cc5d-7eaa-4255-a0bf-d6b4d53c0887", "comment": "Malware payload (CobaltStrike)", "value": "f607a7f8926fae5784d49308b22b5e23", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633252734, "uuid": "2ee40b59-56e9-4f1a-90bf-a80f8a97d806", "comment": "Malware payload (CobaltStrike)", "value": "3c28a84fab03d2b7070144dd8fec5fbb74c7ec1aa29d7a7eb64e4680d9e9e22b", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633252734, "uuid": "1122f45b-9615-444c-974c-b9c4ce8df466", "comment": "Malware payload (CobaltStrike)", "value": "f72fa2645637f4bd2ae6d19f7c14aeaf062feeec", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633252734, "uuid": "8532fc61-b953-429e-a276-bde93942f07f", "comment": "Malware payload (CobaltStrike)", "value": "f562c2c98470c6cb30a0db026bc30ecb2e8a08d9b93a9c5aa37e856cc43d6e0a41d00ba9ddb9685c096667b156fed902", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633252734, "uuid": "0ceaef4b-ba12-4f95-b924-99f4fc304d19", "value": "T16F24DFBC36436893EF77C8319865722F2D76DA0BDA027F99CD4D8E16CC9D887A039181", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633252734, "uuid": "45b92b49-a461-430f-bdb6-ee97ebc3b46c", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633252734, "uuid": "413c66fd-dd54-415e-9a15-9c1878a17c02", "value": "3072:NhA0U0b7WZSuipGIoFRRDNsc8SbFQeZaMiCZKL4hWmGuglkef2oa6AP8DL8v3CWF:NYeWaXoFXZsPe1LZi0GYHoa6APEAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633252734, "uuid": "c4f05f72-ed3e-40a0-98f5-bd6b9b9d910f", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633252734, "uuid": "0e895a8e-f1f7-4817-9473-727803b065f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633252734, "uuid": "11f82efb-50d3-4b23-9393-b7862fbf1c7d", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c65104f-246c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633280756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280756, "uuid": "2744f5ea-c021-4c32-8f8d-a7e0ec897b5f", "comment": "Malware payload (Mirai)", "value": "2e3758f6d151d64b69cb1c4fc6860ab2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280756, "uuid": "cb8a4907-0a9d-4ee6-b998-b60040c31a51", "comment": "Malware payload (Mirai)", "value": "3ccb177b7b576fc8a631f6ee767820100f3553261b24bd387d1a3c484c8e2978", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280756, "uuid": "04f90b3a-2faa-42b7-b808-3b4afd1929af", "comment": "Malware payload (Mirai)", "value": "d1d5b4e666cefa692181eecbff0ff2fecf8b70be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280756, "uuid": "cb9f0fa0-ef9a-41f6-b852-56377cf5e0a4", "comment": "Malware payload (Mirai)", "value": "c0e86120b3378cd3fb453df74706949e703ce595907da38643f2954b102548d85613109cc1da53f4f736cd0861a1cbf3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633280756, "uuid": "4c7624c1-aadb-43d1-b8b6-711199349f79", "value": "T1A5635B96F800DDBDF896D63B44130A06B130B3540B921B37B767FD93BDB21A49466F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633280756, "uuid": "388f30df-24a0-4048-aa24-9260c669d95f", "value": "1536:rfXqlMuQycBLbSUQD3j2vpF668fjSPiQvF4Qr8fQpmchPzCw:rfXql7c1bSJiRF67Qd4Q44PzCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633280756, "uuid": "969faa9b-f76a-40f8-87d0-39f7dd87a356", "value": 72956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633280756, "uuid": "a679a965-624c-4f28-ad39-a90724d1942d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633280756, "uuid": "cfcdc09d-1261-46c2-8ff2-f7397366122f", "value": "2e3758f6d151d64b69cb1c4fc6860ab2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "296d8d3c-2472-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633283328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283328, "uuid": "61d7fbf4-f449-4691-9987-17802f4e2f2d", "comment": "Malware payload", "value": "b74e980975804d76962a9d334ec92a85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283328, "uuid": "6af787ac-ccb2-4c13-a64d-17480b8269f4", "comment": "Malware payload", "value": "3d2aed4b74896ce400d1055f1d44f83d0deaa47ded36d3d527df9f4435966078", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283328, "uuid": "20ccca7f-c36d-4d39-8ab9-0597b7ffecde", "comment": "Malware payload", "value": "4de073d3f5bf7d31a3fb5efb019d5748be408146", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283328, "uuid": "19963d26-b6a3-484e-9792-635f9225dbdb", "comment": "Malware payload", "value": "2287053a9724f9ebc3dbed6a919f5d59d9cd35c512937158155d289d5a9b801b2dd41f10b0cd1c1a79abe2fb8a99eb8d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283328, "uuid": "ef682c58-9738-4178-8eeb-2f79c913b867", "value": "T1D6921B52772D0D87C2933BB03E3F1AD093DAEE6161F49244B9AF9A4AC171D336085D9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283328, "uuid": "824bc8fb-7bc4-471f-89b9-1eaa26bac485", "value": "384:lIAlUOLZoVvRvd+xUKvsKk+hFT2NOh1J4uJZgv4B4:eAiEATL0KNgTJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633283328, "uuid": "1482ceb4-6f68-4c25-9bbb-88c59c7411ae", "value": 21128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633283328, "uuid": "2d45fdf4-9b91-44f0-9ebc-285debf67f8c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283328, "uuid": "a3d38230-849f-4f99-859a-9f3cc9e3d498", "value": "b74e980975804d76962a9d334ec92a85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2604125-23f4-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633229441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229441, "uuid": "471cff81-f4f6-4b5a-b321-dd4032bae971", "comment": "Malware payload (RaccoonStealer)", "value": "1092f0452e7c4b82c9f14fb577e230f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229441, "uuid": "5afad707-1cfe-4481-bd97-83c7cf7c5dfb", "comment": "Malware payload (RaccoonStealer)", "value": "3e40f7f21045cd80edbb61f9add86be3e64ff92d6b8f0a2a6862adfccd4f959d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229441, "uuid": "0a604129-b86b-49f2-aa7c-dad34893f610", "comment": "Malware payload (RaccoonStealer)", "value": "45f3d1374dc8cd16ffbafde0e39b096f0612a4bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229441, "uuid": "7c556583-55e1-42e2-af8f-282b0baa9828", "comment": "Malware payload (RaccoonStealer)", "value": "2f1b9a2c0b336d0ec4fbbb096e8136201240f7f15f8353c7acd4a65b14a0b7ba13fee68882feb009ef675787a53d4466", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229441, "uuid": "f2ac46c1-fb1e-4792-af8e-b41077a9e582", "value": "T1E5D4F00475B2EFF2D57501F0AB26C3F0497DBD5D1926768B7B88322E7E3C3919A12222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229441, "uuid": "63585cc2-f6db-4d58-ab22-e5bd6631c0cb", "value": "f37786a16a90f8f3f38c22c48ff5cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229441, "uuid": "fc17e2af-39f3-4f17-ab61-a8a89c540d77", "value": "12288:HrisulklTdPgNm0uSIjibSER8BDZCpcUAL6qBOzxd6L:Lwlkl/b7jW0ZActIL6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633229441, "uuid": "c7be66f7-80e1-49d7-8baf-33eb5223596a", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633229441, "uuid": "a75065a9-1118-49e2-9392-d4d8b1e77eb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229441, "uuid": "7fb2d370-557b-4dfa-a229-2b8d67c80269", "value": "1092f0452e7c4b82c9f14fb577e230f8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60a954e-23f4-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633229447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229447, "uuid": "9dfde867-2787-445a-a378-1974683868d4", "comment": "Malware payload (RaccoonStealer)", "value": "2358de647c8938cffe940429722d1af1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229447, "uuid": "28ff6a9d-77d4-4d6c-a85c-cbdf1a1737f6", "comment": "Malware payload (RaccoonStealer)", "value": "3ffc865225f6f5239ca2000a0be34cf58ee386979c48bfe83cafaba48a8ea7cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229447, "uuid": "c4caf879-2f88-4b1c-b22d-1122abc2a599", "comment": "Malware payload (RaccoonStealer)", "value": "9c7e160d88546097fbb5e6418faae0cf89fd6557", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229447, "uuid": "7077dc9d-24ed-4d8e-bc77-daf079c3b918", "comment": "Malware payload (RaccoonStealer)", "value": "704e5b9eadef08eb76aa7520fdd28f6cb7c8840523c323a576cd6a79c9481276b4063a853a0e3055d50866e1ae4d2e65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229447, "uuid": "312617d6-feb0-4919-b357-4de6308b69a6", "value": "T1D3B4E03067E0C034F4B756B68DB68378AA2D7EB19B3450CB63E956EA56342F49C30787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229447, "uuid": "0dcd96e8-813a-4fbc-a3c1-792f31af7d05", "value": "949cb2a875d86b476d185d15a2fa1cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229447, "uuid": "8e6577be-8abc-4ab0-9cf6-e164be94cd83", "value": "12288:jz3PN3t7vXSNyUS6tRGuV+0pIJ1ih/Fh0cW4wpEOBBL:HzTivHiuVtx/FK4wpEAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633229447, "uuid": "f635cbb7-c631-43f7-90b7-6698dc38e21b", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633229447, "uuid": "58d80320-8493-48f1-8f40-2531e2dbb0f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229447, "uuid": "7d822e9a-23a1-4e8a-a656-901a2bd7450b", "value": "2358de647c8938cffe940429722d1af1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1779c5-2483-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633290605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633290605, "uuid": "44e0a1ac-e55f-43e2-ac5d-deb40137d729", "comment": "Malware payload (Mirai)", "value": "6e688bd39ca36753905455eaf9681563", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633290605, "uuid": "b8e9f03d-8f6c-4d2f-8ed6-a288a5b8e166", "comment": "Malware payload (Mirai)", "value": "41bef439f28004f05a67a0f47dd90fccc8b88c5e097ad29bbc9d12a18ca9f783", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633290605, "uuid": "51afc60e-0d62-4681-b7f9-42e29d0d5730", "comment": "Malware payload (Mirai)", "value": "d10d45deb13f10bd798a96ec2b9e411d5ce6936a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633290605, "uuid": "7c329d83-4e1e-4d32-835e-d6f94bcbf495", "comment": "Malware payload (Mirai)", "value": "3e531950ede528482ed2e8ca542aa45a8cdd0ff36744d8303b0c2987293d7cbee31a66ca8f165406a79e27ff862babda", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633290605, "uuid": "a11cf8fb-b9f9-48b0-9f01-6d59e2a37363", "value": "T106D2E1E5D602E0B0EBF16579E628C6861B1397B5D0FE343135054BB8AAD633A7AF4312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633290605, "uuid": "0acff8ef-e6f3-4c16-b88f-caec7e8cf56e", "value": "768:NDbWUQ+4hTbBbxLLQ/3kz6PLST2sGs3Uozm:ND5Z4BA3op2srzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633290605, "uuid": "248bd725-2d8c-49b4-be0f-0b6177d87ea3", "value": 29852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633290605, "uuid": "cd330c2e-c49f-414f-b008-13b39750f904", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633290605, "uuid": "d155588c-d850-417d-ad41-fee28747a73f", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86b0c63-2419-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633245316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245316, "uuid": "54c8d6a9-2e03-46f4-aa2b-c72318de1185", "comment": "Malware payload (RedLineStealer)", "value": "036033b2a010fe01bb954ada8769832d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245316, "uuid": "118c131c-5b9c-455a-9f78-b2777889ff62", "comment": "Malware payload (RedLineStealer)", "value": "44598f05340aa61c367f4c1f43708fb90a34ad5e82807329655b797b17078dd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245316, "uuid": "dd47bec2-a013-46c7-afc7-d695708e5aae", "comment": "Malware payload (RedLineStealer)", "value": "21621c1deb85214df37bfcb3894a0b85f8fd9465", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245316, "uuid": "55220f22-bc4b-417c-8762-069911b87c68", "comment": "Malware payload (RedLineStealer)", "value": "8000045e0d72f61d283aa08781c6d60c143b882a6dc2ba112451e21e575ceaa43b2e9de9be34ea5b2f647fd99c3b4869", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633245316, "uuid": "d0a5da6d-39ee-480e-b857-823f5e915380", "value": "T125A4EF28687FC019C5E3EEB52DDCA8BAD99A55E3640C703701B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633245316, "uuid": "7cad7a14-3b37-40d7-9714-9515b67b151a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633245316, "uuid": "ba2e7d41-3531-44c5-abcb-8092866ad403", "value": "12288:e8klT97igBMJM8Ajhq/dK98KGa4YR1HK53f8hit3hDyYhE:eD7jhm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633245316, "uuid": "e3f0f707-4437-46d0-b4d7-4674134cb45e", "value": 449849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633245316, "uuid": "61d74cd0-529d-48ca-8cab-8d1a742e2a0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633245316, "uuid": "517987db-ca19-40b7-b598-5ef0d8cc315d", "value": "036033b2a010fe01bb954ada8769832d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7352a962-248f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633295907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633295907, "uuid": "d1081b1b-df87-49f5-84ac-de452a2414a2", "comment": "Malware payload", "value": "1ab6425fe27eed5968bbb220c48e0ae7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633295907, "uuid": "cfc4a758-e326-47c7-869d-e56971adff07", "comment": "Malware payload", "value": "45658721ebbfda843579b6e9007d01a37b4083cf990a7eb02d681c11f1221afe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633295907, "uuid": "651e25d8-cd96-4fbf-8dd6-e885d52ffe9f", "comment": "Malware payload", "value": "968a3513a432f429d5a8ad7f8a80ff9bc588cec2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633295907, "uuid": "e0c365d7-4288-4441-a0e2-cd64b9eea5e4", "comment": "Malware payload", "value": "fcd18040dcb952c7d9f7d883407d7c2a3132bf0cda1a36addc32cbc39f51a00adba30cb07fe65fe1c45a895c27e31bf9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633295907, "uuid": "b4784871-3593-4ce6-8cdc-0b3e376a0d11", "value": "T12E84D0093290CBFEEA754131AF22F7F1457EBC6D5C2A458F6B98272E5E3D3929A11301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633295907, "uuid": "a18f68a1-1076-475a-ab1f-e214da9ab369", "value": "c15bb6cf111ec297d5d1e54944f0caf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633295907, "uuid": "cf04c3f4-be5e-4e38-94ef-f8b5c7e70037", "value": "6144:Sbpjm/cL484cmEQzc9FbLrgG7jso/dYkfgJ+iNT4S8bn7ROhxxpeTr/ekI:8jV14cJQo9Vrg7oFYkoJEMzxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633295907, "uuid": "2406e06a-1c67-48c6-9b15-1b96ce373287", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633295907, "uuid": "fc35a889-3ff1-403d-bdc4-fb7e2d141011", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633295907, "uuid": "3ba19bd6-ccc2-4faa-aecb-0b30380a133c", "value": "1ab6425fe27eed5968bbb220c48e0ae7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f43c1fb-241f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633247689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247689, "uuid": "2c78abd5-675c-42bd-aa58-3e9f71d55f4f", "comment": "Malware payload (Formbook)", "value": "015d157c73a9a51f0a3745a028d3abce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247689, "uuid": "8a9aac2b-cdce-4a7e-94dc-361d49f36dc6", "comment": "Malware payload (Formbook)", "value": "4633bc441c059884886be83a8733f355d933b58db80f81c0a56404bceadf9667", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247689, "uuid": "ddce8afe-edc3-4451-bb9a-a11c7b9b49cf", "comment": "Malware payload (Formbook)", "value": "594e74fe551ee2e3dcb7cef570792ee2e944b166", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247689, "uuid": "5109ca0d-e12a-46f2-889c-d9a46c231cc6", "comment": "Malware payload (Formbook)", "value": "b37aeb6f0a0a85492817e6c90369486c1622786cd10f156966a4316f362d31d67e7f3dfda313579e4b1dfe6d9d2d5c47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247689, "uuid": "fda1e0aa-1b73-46b7-aa86-8830b64af43d", "value": "T110B4AEDE1C68A3DFFB1E01F8FA79279C11AED064D8AFB1D3D606B03310669689924CD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247689, "uuid": "a265d937-e7c5-4d98-9a68-31a2cee86430", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247689, "uuid": "8b131254-9c4b-4377-bb4d-94c1a83c0cac", "value": "12288:uAUNi+hBr7IUAvHioJvR/WF9Tp9Z94W+UHuUAGr8RHj/tu:fUNi+hBr8UAvCs1WN9n4BUOU7r8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633247689, "uuid": "c810ff61-040e-4ffa-b516-b7ed42d051d4", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633247689, "uuid": "739074be-eedf-4e35-8430-b5f00a7bb1b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247689, "uuid": "3967156a-5872-4510-984b-7c7c81cb6020", "value": "015d157c73a9a51f0a3745a028d3abce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d18004e3-2494-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633298213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633298213, "uuid": "1be77138-38d5-4a27-a1d4-9361df12a059", "comment": "Malware payload", "value": "ecf0e7941f1e2dcd9291bfa16402e713", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633298213, "uuid": "575c931a-3d35-49b1-9751-48963c4412da", "comment": "Malware payload", "value": "465f36fde76cb16a578da90f4b64df8da4e9d67eb120ac65b80003bdb904b2ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633298213, "uuid": "5b8b673d-2608-44f6-9a76-92d140773df4", "comment": "Malware payload", "value": "7045270f7f50e784da105ad2a65984fa83212b2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633298213, "uuid": "c38fc69b-31e9-4600-80ac-9b985f774323", "comment": "Malware payload", "value": "afb527ee23b93f6dc7eedba9f061bb130cee0fc81c0e423a7823c5f31c100d5bc45c74337121e3d514df9b91f287936a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633298213, "uuid": "95d79148-52b1-4612-8d77-c3ca8076aa0b", "value": "T18974D00932A1CBB2D6720136AB16C7F449AEBC6C9C1A964F7B88675FAF3D3D1D611301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633298213, "uuid": "e73ebdb1-3d29-49ac-9fa5-7be4e357545c", "value": "c15bb6cf111ec297d5d1e54944f0caf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633298213, "uuid": "7e96cfec-a27e-4340-9bbb-620020af99bf", "value": "6144:+rRra41LvcYh8o0Gs9/749KzUlE6WYND6fwTILRJ8OROhxxpeTr/ekI:0RrauYYhP0GKM9lNWMe1o7zxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633298213, "uuid": "729c6d81-044a-42de-a3b3-9258b3976c7a", "value": 365568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633298213, "uuid": "071c2ed9-be17-4706-9a7d-084098d1078f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633298213, "uuid": "40225eb1-a8a2-4f28-9620-3483e2169aee", "value": "ecf0e7941f1e2dcd9291bfa16402e713", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20dfea44-241f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633247665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247665, "uuid": "160ce49e-e0a9-43b7-b79e-adc302174e83", "comment": "Malware payload (Formbook)", "value": "079c2e1c486dbdfd4259afc0d51f432b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247665, "uuid": "76570a5a-4071-4f88-8964-6a9102b93d7f", "comment": "Malware payload (Formbook)", "value": "46fa7e230e5d8398c15c24dd78906dcf50da9bb1d2cfd8682ad7f2f80819a3a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247665, "uuid": "350ffbf2-cf49-4d7d-983f-9dad5d6c7e46", "comment": "Malware payload (Formbook)", "value": "68cd10e08cb8fbc9fcc45ef4a23e2c2eec100e0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247665, "uuid": "bd0959c1-664b-4dd3-861c-844073ab3248", "comment": "Malware payload (Formbook)", "value": "a056f06929d1fc467250e8352365ecac433486dc84af83ba2f5bae2ef2fd7d63f99f776d44690a3e0ecb035dd4019de9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247665, "uuid": "c1617ce2-06f4-423e-ab07-104c941af252", "value": "T184C4024E332B182FDE3842F4A692849267F4E4293446E3F8EDC9799D25D7FE8498D503", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247665, "uuid": "a8af2c5c-3138-4a31-b30c-8a357a989918", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247665, "uuid": "8b5fe146-c2e0-4516-8c84-acd4c46f33e0", "value": "12288:yglm7yzAmZFj81+hra7UjPHEJG3S12U6LWOZgZ4/NcvJ:Blaejccra7sOd12UsWoNoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633247665, "uuid": "1bdc7ea3-c5e0-4c59-ab5a-3d6c3953ed6e", "value": 552448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633247665, "uuid": "1a2daf79-7f4a-4363-b0da-1561abbc248b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247665, "uuid": "9febc344-c20a-4105-9d49-4ca62e52f329", "value": "079c2e1c486dbdfd4259afc0d51f432b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "166f73e3-23e6-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633223166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633223166, "uuid": "768aae70-b97b-43f3-86ec-970142f8dd0c", "comment": "Malware payload (RedLineStealer)", "value": "46e6dd5eba1795c54fad7d9e5a4e034b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633223166, "uuid": "a337374a-370f-4eb0-8c5b-f54f1edf356c", "comment": "Malware payload (RedLineStealer)", "value": "4a413f1ffc68426b52cca4011600c29d2ef3def3deaa90fc3646357bb9d8889a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633223166, "uuid": "a4504d80-8c66-4253-995e-f3ef02f22b45", "comment": "Malware payload (RedLineStealer)", "value": "94bf623a7b86ca53947eb04f3b8066f260ce0fce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633223166, "uuid": "e319292c-3831-4a84-a8e9-dd0b301ad76e", "comment": "Malware payload (RedLineStealer)", "value": "1a5b1e35abcc9b9563a2f4c49adfc26444f9e892e25e34a20be8b02be43304c91f84ede998cd2eea637a73ece3cd74bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633223166, "uuid": "a2e9f180-f326-44f3-92c7-124962e70cb9", "value": "T11174BE20B7E0C034F9B752B445B583B9AC397EB19B3841CF92E52AE956346D8DC3178B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633223166, "uuid": "cd9ad302-2823-4f19-abe3-a3da928c629d", "value": "848a7504f9e97d3a5e7cf95079b638a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633223166, "uuid": "21d17345-c3e2-4a1c-9398-250ece5aec1d", "value": "6144:ovs4BGUCG0GMLPy+pUM9oTj2QLhLnTK1jxB2hQ9VQMEeeoGyK125JEC:o06LWGMPp31QF3wjxMm922el14Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633223166, "uuid": "89d8677a-f05f-4398-9907-934cadff83ea", "value": 340480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633223166, "uuid": "77cdf915-e0e8-442a-99b0-d020d986e376", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633223166, "uuid": "81475070-9da9-4ae6-a17d-92bc8ee9824a", "value": "46e6dd5eba1795c54fad7d9e5a4e034b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4be29b-244d-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1633267765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633267765, "uuid": "62c7b79b-4133-4050-a9b9-443997ebd175", "comment": "Malware payload (CoinMiner.XMRig)", "value": "7bbc2539d7196864b7745b8065a35e7e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633267765, "uuid": "ce0c7b80-2c46-4d76-a5b7-b0c4432f17c5", "comment": "Malware payload (CoinMiner.XMRig)", "value": "4d265a1ee6dd0bdccd7e31fce027ccd42f1e19c09a92e911fba7db7696698b4d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633267765, "uuid": "c042bfaa-e954-45cd-918c-f9a1adf1ab43", "comment": "Malware payload (CoinMiner.XMRig)", "value": "0dd2782389c400e8ebd57ce68c425a6e6d5134f1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633267765, "uuid": "57a096a4-d218-48cf-bfd4-59c642ac9dd5", "comment": "Malware payload (CoinMiner.XMRig)", "value": "74efa7869bbb5bc9ac0698afc1f2ac37a6fcbb1ccab825530df48faa4d7eca842303c30886f5595e4737e78673e89310", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633267765, "uuid": "69afc80a-a463-42b3-ad55-016c5ff680e3", "value": "T14D95023B50EFBC659A377AF87E4428447C082D9FC58492F4ED197567B0F91388BAD8A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633267765, "uuid": "2ed824ac-7b5e-4d92-9c37-17dd43c203e2", "value": "24576:g4RnFFdpiLbT2QPBaNJXU0CerUWAUw9PA8SCWqkGdqVnYhnQmYXZ54KbbAc:XijQXO3h9yDZVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633267765, "uuid": "c7998944-e242-4a6c-bb2a-53828f707adc", "value": 2058240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633267765, "uuid": "c7936728-879e-4529-8e42-1c3d10c11255", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633267765, "uuid": "058db56d-cda6-4bf5-ae3c-44bd2ba145bc", "value": "7bbc2539d7196864b7745b8065a35e7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05895aa6-241f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633247619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247619, "uuid": "ff0d897d-91b6-43c0-ab11-0d69bcfbed30", "comment": "Malware payload (Formbook)", "value": "cf38251ea9830826534aead3ce07a6d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247619, "uuid": "f2422b50-943e-49be-ba7f-6f3a97a5bc46", "comment": "Malware payload (Formbook)", "value": "500e8204e8284a6dbba99d308907c69f9fc5f0135ebd8d41a60d9f02c1076d0b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247619, "uuid": "95376a93-22ab-4da4-9810-d992bb652206", "comment": "Malware payload (Formbook)", "value": "7bb2c6bb0f6ba9832e1ff397621739753a641fc5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247619, "uuid": "58dcd4dd-7b27-4e36-9a15-9120940d04ed", "comment": "Malware payload (Formbook)", "value": "b24d61e27d74f6ad43f8648e60632b6d68ab975fdcf16e8a5f1aa16331ce9de3f242b485a500bd371f40c023abe5e63e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247619, "uuid": "30bcd6c5-7a8e-45cd-9496-1dcd148cb0c9", "value": "T13E941264335B570EDEA8C7F17122569113B6BA96202ED37C9FC8B09D71333F891A0A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247619, "uuid": "8ed47761-edbe-4f94-8ed7-f8240a0a9aab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247619, "uuid": "b5f38e47-3537-455e-943d-7afdf188caa1", "value": "12288:e9MzQxm1NQA0bUSeRIZ0jdmIljKO9MES8RB:e9MzQxm/QAsEIqwUjd9bS8RB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633247619, "uuid": "61956219-6467-418d-9aaf-af55124e362e", "value": 423936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633247619, "uuid": "3a3f5b56-5c85-4e1f-b565-d9d6d6e6ff1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247619, "uuid": "5f1667c6-5475-449d-a6e2-f9f2e48f065e", "value": "cf38251ea9830826534aead3ce07a6d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb28385-241b-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633246234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246234, "uuid": "1db77823-1bd4-40c4-84fb-17b511a30db4", "comment": "Malware payload (DanaBot)", "value": "536bec103459ce857cd9a3aca1afc8f7", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246234, "uuid": "2cedac28-bde6-4434-96ff-f5d8e5a75ddd", "comment": "Malware payload (DanaBot)", "value": "5096923b747f0cc35c156149f19587b53d62a111835ba0e0438b0c2ffbec2224", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246234, "uuid": "64c95242-9712-4683-ad68-9c2df0f04b84", "comment": "Malware payload (DanaBot)", "value": "078991fee7f85fa46e99976f2f8e6d9263fdaa2b", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246234, "uuid": "d574da9a-8f0e-4e07-8187-9dac85dc1166", "comment": "Malware payload (DanaBot)", "value": "4df928927f7ebc97e4b5c3f056f49f25db36db8e9e00d1b24f5bdcf6d50dbe2d473afe0e75638db74bde721625d696b9", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246234, "uuid": "a8483d28-ad94-481f-bd61-24c65a44f2ce", "value": "T1035633E321D824EBD56530F22EA64EB40F26BD204964993E3A507E9FFD73753922234D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246234, "uuid": "49979253-c826-440a-854d-bfa0571bdf01", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246234, "uuid": "37c8522d-d495-422d-b99a-d60e808d8990", "value": "98304:SZFXcD+HDuFSC/XhLo04KRK/OudM4nTxdzceJSPCqlShxJK+ojK4EVu4BH02aJ1s:SjXcDeTmXhLo04OK2udMAldzCC/XJKNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633246234, "uuid": "08a1fc4e-5574-4aa3-a956-58d2716c5571", "value": 6163685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633246234, "uuid": "9b0ddb48-c9db-407a-bec6-6b3741098a0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246234, "uuid": "21c11160-460b-4620-aa28-d2399a9f6228", "value": "536bec103459ce857cd9a3aca1afc8f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849a1771-247a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633286917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633286917, "uuid": "c94cf44d-c575-488e-bd84-8f0944f30774", "comment": "Malware payload", "value": "49caffd9e73d0b7aa19e9d905da8d7eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633286917, "uuid": "fb37400a-6271-40d8-b279-c5b03f99f4c1", "comment": "Malware payload", "value": "5221a9886df44c6e76d7a6d770ffe811d68cb8e6b96267e5ef40393ac675f6ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633286917, "uuid": "9648007b-0199-4045-ac33-f5756e366f78", "comment": "Malware payload", "value": "3336208e0e4e28101ea62592d1618c3619eea36c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633286917, "uuid": "1431931d-a335-4a2e-aea2-9267997687c4", "comment": "Malware payload", "value": "f0e061723a1dd2c5c1796c8e04672cb7f8b63fa32add89e21a8436aad55a7b1546e57daa9b9fd7fb917b2514c8ba7c49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633286917, "uuid": "a5fa791d-3dd4-458e-a991-3c075c38492f", "value": "T1E895335D8958273AE4AFB07FFC39810736519E4433C093C3DA84D4F3A30956DA6696EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633286917, "uuid": "18e615fa-10cc-4d3d-8a9e-0bef3813ccd8", "value": "27516fd8750f40bdecf52a1420a0296a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633286917, "uuid": "22becdca-bd95-4f06-a675-9fecd59fea64", "value": "49152:kI24sKJha7nAkBghexT5blYCGpyb6ClySOdqF1j2N2:kI22hsAUx5JY26ClLOQF1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633286917, "uuid": "94e39dd2-6ad6-4d07-bd2b-a408d8367994", "value": 2036736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633286917, "uuid": "495e00d6-6a73-47b0-b515-fe8e14891557", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633286917, "uuid": "2fa87834-40af-4470-abee-69b5d9093e17", "value": "49caffd9e73d0b7aa19e9d905da8d7eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4226162-249c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633301626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301626, "uuid": "8c7d5062-1734-40e9-bcc8-c1dd61ed8c08", "comment": "Malware payload (Mirai)", "value": "d43b381c65dd3a57693007aa145c5c20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301626, "uuid": "af285769-3c08-4b76-b03c-5a09f5ad6958", "comment": "Malware payload (Mirai)", "value": "54456e8bfdda3b55fe95c4514726581584c0d63781a18a4c11631fd94b61cbcb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301626, "uuid": "9258bc02-80a4-444a-9356-fbb513fb2a9f", "comment": "Malware payload (Mirai)", "value": "d1ed395f71b6ea3a60e50b2068ca04a7a9e0b952", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301626, "uuid": "3a1bfabe-d2d0-4821-bc67-de1b8beb0a5c", "comment": "Malware payload (Mirai)", "value": "686711330e8b0283733f5c2265989e2bbbfd9a7c4d7bbbdddb05a385344788abdfbc5564a663a63fbb3fb231f8659a2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301626, "uuid": "1061ed62-f95b-4303-958b-91c664c8a883", "value": "T1BE4319827C81AA39C7D057BBEA9F108E3354ABD9D0DB7347CC140B9176CA51B0D67B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301626, "uuid": "69c7a373-389e-44b0-a92c-fdb6f7b361ab", "value": "1536:VX3kcPLAR10ydj/BTLU8GYQ0zYJBb07N5z2yYceZW8eXtg:VnXPLJ0R5z2tcwsy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633301626, "uuid": "3ae53829-ab3e-4d03-8fd5-f3dd830768de", "value": 60180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633301626, "uuid": "3c420387-c75a-4cc7-92ea-da0d63caa8c5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301626, "uuid": "28da3ea0-a5f1-44ae-98a3-1972a3bdc80d", "value": "d43b381c65dd3a57693007aa145c5c20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a19f24d-2438-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633258525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258525, "uuid": "261356a7-af43-4686-b784-a7f9549cc476", "comment": "Malware payload (Mirai)", "value": "973881d63f524a3d9f4e36a03c569ea4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258525, "uuid": "f6594d72-215e-4374-92c3-6bc4f6e56ef5", "comment": "Malware payload (Mirai)", "value": "56165766a471f13422084d1d5bc59602ba5987db5f682d21ce06d040dd1489d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258525, "uuid": "b4063011-1eb2-4d02-aae1-75a8b266d5f6", "comment": "Malware payload (Mirai)", "value": "e1324a035ef00307c8968370d3a4ffbb8ebfd7e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258525, "uuid": "b0cee0b3-7b18-4350-85b5-3727e6cbcedb", "comment": "Malware payload (Mirai)", "value": "e6c67040ba58c4fcf78e63e1978753d9a5e91dc3452048408c8848efcdda2e8e3b481c6ea4eaf0bcbb72bc2d6cd71889", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258525, "uuid": "7d073690-12fa-4a35-b587-c4fd2a943b92", "value": "T189E2E1EDA571D085CE8C1EB952E90BB75900E1F8328B498CE3054EC935F689DBA2D07D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258525, "uuid": "3ed2ee91-b3d1-477b-b034-ef71e433b963", "value": "768:BRMleTJIXm6+xlztPa5ZBLw1HCJJz580bWWE:BhPlhKZBLwBCju0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633258525, "uuid": "87edda06-7cef-463c-a1a6-62159bb4044e", "value": 32128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633258525, "uuid": "2a8141af-b57c-4cd4-b5b2-30ad5211cf09", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258525, "uuid": "0ca4d2a7-1732-4efd-9ea9-0f9dc18630e1", "value": "973881d63f524a3d9f4e36a03c569ea4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e27951c-2493-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633297616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633297616, "uuid": "c9be48b1-2809-4af4-bcb4-5de8e96c9a13", "comment": "Malware payload", "value": "e1a9dcacfd460d7eda167890ad9e1366", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633297616, "uuid": "de1b7a8d-ff1f-4707-991b-8f69839dd21c", "comment": "Malware payload", "value": "57315cddae2c029d8b29557c7f2cd049a5a96dfc2134da57ab6bc0ac84997e5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633297616, "uuid": "4026b449-dd41-4914-a968-9bffe6e0769c", "comment": "Malware payload", "value": "b4e7821192a71d8166b17c9844d415518acab926", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633297616, "uuid": "85e67805-0382-4ad5-8897-da3feb8bbf0a", "comment": "Malware payload", "value": "f18765e84f1e615f2f2112d567f12bfc8a7e7ca5098066302ed34ac7d1880311726c841397d8d95de72426b62ce5fdeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633297616, "uuid": "72e566e0-f4eb-4344-9a69-c1c81de15aa2", "value": "T13FF3BF7116A89432E69F00B1D9D5E1754FA57C229E13089F38CABE0F1DB3F8255B633A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633297616, "uuid": "ed0250a3-35d7-45fe-94aa-10760b9c40ee", "value": "72fd45315641a3bb430827f4d003e6c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633297616, "uuid": "7b931ff4-96f0-47c1-8da6-3e5284d1f777", "value": "3072:EIaHW9jlOMElNAG0vQSybzFCTHPKHq9O6cZfJ8FUDtjbPujg9Ay:EIh5ElSjQSybRYKHq9O6cZfJqUxjLEgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633297616, "uuid": "7adc9057-1bcb-4875-8a30-1d754e660086", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633297616, "uuid": "eb8eb3a1-3871-4b01-8c82-c586e1401935", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633297616, "uuid": "f89e06b0-f2d8-4857-ab56-03e7c641e73f", "value": "SecuriteInfo.com.__vbaHresultCheckObj.28644.29004", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de7c3536-2445-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633264304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264304, "uuid": "1ff0dde6-6465-4cff-9607-fb8c899b61a3", "comment": "Malware payload (RaccoonStealer)", "value": "ad22f711bcc6087865853cd19ce3f813", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264304, "uuid": "1a24613f-1842-4be6-b66d-9d04cd030a7c", "comment": "Malware payload (RaccoonStealer)", "value": "58fb115999436b2196f3f008e7e652d5cefebbd1db2885c2d59af17ec32716fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264304, "uuid": "7dce6e6f-d8cc-4cea-8dfd-5776bf5f91f6", "comment": "Malware payload (RaccoonStealer)", "value": "b5f1c1fe8c37c113bef2d2968b6c4683c8d8e8ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264304, "uuid": "9ac3d4bd-dba1-40c4-8ba8-de442266d9b6", "comment": "Malware payload (RaccoonStealer)", "value": "08e0b59a9c2a2b8b0f3c3df331bde1801968a660d5e465b1e2a0ddc2f7e749dbb2a7e932a0b289d09fef969423816ce1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264304, "uuid": "638fb1c2-3623-4e02-a5b8-000608edfce9", "value": "T18EC4F00835A1EFF2C6B540F0A76AC7E5493DFC691E2A56CF2798375ABE3D3918613201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264304, "uuid": "ef9ab9c8-b7b2-4120-afe1-5725cb75f63a", "value": "401c37f2bd821b3afe64e4a9a74e43f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264304, "uuid": "55c64fdf-6534-4acd-b396-de8a82911df9", "value": "12288:ukdWBCLGQT7ZPZij67zW1CFp6xNLCDnNFJEFnrL6+zxF6L:utBeZZij6zF+GeJL6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633264304, "uuid": "4b7a7cf0-8559-4c89-82f7-66a05234b795", "value": 583168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633264304, "uuid": "714ae720-301e-412d-bf87-b3a6facd2a38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264304, "uuid": "e703d53b-196c-4f65-987d-4eb9bdebd7c6", "value": "ad22f711bcc6087865853cd19ce3f813.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a107b96d-241c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633246592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246592, "uuid": "fb84e04d-0117-47c3-80e2-a76652a7267b", "comment": "Malware payload", "value": "5a36ca054903b13eccebd9476e4f59c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246592, "uuid": "746e5a1d-af34-419f-a812-be9ec5b30eb0", "comment": "Malware payload", "value": "5b9c3634412b0c729160d9f275c2ad8b1b26a2ab8b5053803445bbf48256d44c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246592, "uuid": "fb9cccc5-4e61-4ad1-9e4e-1815ef4e879e", "comment": "Malware payload", "value": "9886ff212b77fb4734f379a475961d0927231018", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246592, "uuid": "1b4fccfc-d4ed-41cc-947e-f04ad40ac918", "comment": "Malware payload", "value": "148bdf4c596663f093c1e0ed20bc69e67a5f10f3da35a4b0fe229ebf271407a595342e7a81a00cde1e27ee83382ba880", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246592, "uuid": "92299068-7a71-4af8-86b1-75ad250a2209", "value": "T15F3412116BD499F3F5C546B44A7237B2F7B3E848266162C78BB03F1B7A306DB140A5CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246592, "uuid": "4e4cb25b-2e51-48f5-8351-984e34815144", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246592, "uuid": "f91bb051-bac6-459f-ade3-22f2e1fb97ba", "value": "6144:F8LxBsSRZJtf+0dO9Ld4sjkfAjtTp/OrqrcI:/SPfvd4aItT84z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633246592, "uuid": "e86eec35-35d7-416d-b331-91a1aaadaf8e", "value": 235694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633246592, "uuid": "6fcdb926-74a4-40f7-b103-f48be0efde43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246592, "uuid": "e7a191ec-6670-40db-8e80-ffcb14199a03", "value": "5a36ca054903b13eccebd9476e4f59c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be1d0687-241b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633246211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246211, "uuid": "05adb82a-ed77-4ce4-b5a9-dfd33e87e707", "comment": "Malware payload", "value": "98698b1aaffc4d9979dd1a4db38b40bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246211, "uuid": "4a8fe6a7-e412-443a-a726-2fb93aa23593", "comment": "Malware payload", "value": "5bb94cdc127af5fdb7e244c0f452b4bd6a3d9359d1bfb71cbfba9a7c24f82af1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246211, "uuid": "fb955789-c360-40d5-91b1-aa23e1c0fc10", "comment": "Malware payload", "value": "18a9d1a879dd5451c8d4035426d374a4d5a975c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246211, "uuid": "c13939d4-13f3-459f-911b-2f3d1d540952", "comment": "Malware payload", "value": "61dcf47e1989ae36fc39abc2b3a6a4d0bbf006b2a84a7d4581bdcf8f579e3b0df1a28c35a7eddbf80213c9926ded76ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246211, "uuid": "4f9cac6d-adc5-4df4-81ac-e8342abb6241", "value": "T1BB64013138C6E033E19765F58629D7F6CF793869142A6ACF8BE158702F30BD2D71A246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246211, "uuid": "4dae6a65-a37d-4517-99bf-560e40c6ce16", "value": "6144:ZKQoyfa1LeulRoDM/wL07SVfZBa4kCaSOmValkcWMP1j7sJG:ZpMyulEM/wLCqTklS9IvWMt7sJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633246211, "uuid": "74f9a856-8b7b-4dd2-8280-9ce88584e0fc", "value": 319694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633246211, "uuid": "be0844bc-f909-4005-8f16-169114767473", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246211, "uuid": "e727b21f-497d-437b-8fb7-23ee9eb61f4e", "value": "98698b1aaffc4d9979dd1a4db38b40bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2a81b3-249c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633301636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301636, "uuid": "06769bd4-434d-4bdc-9ab1-844a38b3fd86", "comment": "Malware payload", "value": "dcdd095eb110fb0d1b16564b30f34d72", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301636, "uuid": "bf2a730a-c24f-4531-b8eb-0b8e226a6002", "comment": "Malware payload", "value": "5c01e8c13836254c259049c49c6a6c7a9e575e6becd7f6b2ac7fe8575e332ee3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301636, "uuid": "ea336f97-410b-41c9-b35e-713b2ff17fbd", "comment": "Malware payload", "value": "fc18475a3e92c964256a55004cefbd51408afd49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301636, "uuid": "a10d78ac-97c7-4110-8485-5a238b3897c8", "comment": "Malware payload", "value": "a48c3db4116c55a9343d1a48b16264b4776f5eebd665c76fe83e074d1e5ea49091086f724dc77e0da6c5e9cd033b923c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301636, "uuid": "e76cae91-2bf6-4020-9db6-22bd2f63be15", "value": "T183933A07B71C4F43C1DB59F029BB2BF15769B9E112A36181B91BAEC05B33AB81523F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301636, "uuid": "88593409-88f5-4dbe-9559-90d20e9d35fe", "value": "1536:T3oCu/OcwUBvPsTbwHH3P6zMSIHsiO6aRv/lz585hLg6wOFO6V6qDjjofSee:T43/qUBvPs6X03IHsi2/w5hL7wOFO6Vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633301636, "uuid": "9da3cf4c-a383-4f02-b682-18d46ddbf420", "value": 92720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633301636, "uuid": "8d06237e-e84d-4876-81ef-ff619e9ddb9b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301636, "uuid": "17100a09-909e-40c7-b6e8-cef9101ee9aa", "value": "dcdd095eb110fb0d1b16564b30f34d72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c79c34-247a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633287002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287002, "uuid": "14e652c1-ed8a-4189-b810-a5cf7add3aff", "comment": "Malware payload (Mirai)", "value": "bc6132eef50b9cd1690c6d98cee27c6b", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287002, "uuid": "c071a571-1140-4fe6-9506-45f9723d2c83", "comment": "Malware payload (Mirai)", "value": "5c49a60faa0ef8c96fb91e2ea67745b83d2fe8ee15f0d4b982345eef6169fa35", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287002, "uuid": "e163c80c-9d5f-4d23-9152-c96c65b5a8c7", "comment": "Malware payload (Mirai)", "value": "29f2aa7de5d211faecdaedc95a421c33ad005b65", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287002, "uuid": "78c7e900-ecbf-4682-b188-6286ea1596a4", "comment": "Malware payload (Mirai)", "value": "7aa3413b8756f1bb4f4ce30051b161d408af1c012208e6bd1ac94d4253d2bb5a7637cf6ab81f5a474574bc1d60ae6ff3", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633287002, "uuid": "3f4a7de1-3150-4fca-911d-f420e6a8b9a9", "value": "T1F2E3A51AB7619FB3D81ECE3706AA4601108DE55A02ED6F6FB6B4C51CE78B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633287002, "uuid": "34ffb695-b932-4c7d-a9ef-e9d79956f36c", "value": "3072:K+MVwUm6Oq+loz15hd8EzhsURxuZq+1uPNd5R:K+MVwxq++z15hd85URxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633287002, "uuid": "a9f5e6ac-5e2b-41ae-b620-d09689a704b5", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633287002, "uuid": "d17da490-9255-46f6-b35d-6cf3f23cb08d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633287002, "uuid": "8e2b86f6-470b-445a-96e4-de3bacb58af0", "value": "assailant.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e73686a5-241b-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633246280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246280, "uuid": "96d3f23c-bbcd-4f4e-9b2c-dfefc1aa4c4a", "comment": "Malware payload (DanaBot)", "value": "2bce3c8efb3cb62fe2537ba2ff92030a", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246280, "uuid": "9df5ee62-2456-415d-9464-bffbb3f553fd", "comment": "Malware payload (DanaBot)", "value": "5d48b2614aaaebab4a97deafbd3117e2baa62aaf6a357003b10554e3caa60f5a", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246280, "uuid": "0df9feec-7192-47c9-b521-72d62b6d8c3e", "comment": "Malware payload (DanaBot)", "value": "426d0806320d005938fc7c698291bd6b9cca46ea", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246280, "uuid": "b40b9be4-31e4-4288-a501-271b0158f83b", "comment": "Malware payload (DanaBot)", "value": "f74d1077e8468ad200f84b5de26c358bcb69447ae7b25150cdd072f54fea57914447663e9b1a085cfb7df6d90ea4f2b1", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246280, "uuid": "245a659b-daef-4531-a9bd-bcf3960489e1", "value": "T1CF4512297681CEB2C6B402B0AB16C7F0597DFD581D1B714BBA98371EBE3E381E711246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246280, "uuid": "42e9b0a3-8278-4e50-bd37-6d5075fb7106", "value": "f37786a16a90f8f3f38c22c48ff5cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246280, "uuid": "fd8b83b8-7fca-4d14-82ce-c94a9fc516f7", "value": "24576:e/M1biswUmqkRGN+F9G1N1FI7GuzRDGTuDddBoCZ/QU1or4rz1yjL6L:eAbisHNI9WHFscToBoqQU1oc/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633246280, "uuid": "c0d75175-5803-4b25-a928-ee5582b4d153", "value": 1250816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633246280, "uuid": "b106d732-819f-47eb-a36e-ba79b18e5d78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246280, "uuid": "adf00ee7-3ac1-4808-8f7c-054164fee46c", "value": "2bce3c8efb3cb62fe2537ba2ff92030a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb6bdf4a-23f4-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633229456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229456, "uuid": "df323e59-c295-42a5-8705-dc4cca2293f7", "comment": "Malware payload (RedLineStealer)", "value": "7b7f7ee6b428da1108f6ebaac039edef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229456, "uuid": "634d8700-1940-4d0d-b783-043d04fc798a", "comment": "Malware payload (RedLineStealer)", "value": "5d4b5c255c24c109ad11df1469e4515cea1deacae8c896461c4a0307736352bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229456, "uuid": "193b467a-0c22-418b-b61e-6655f752f4c6", "comment": "Malware payload (RedLineStealer)", "value": "6b8be1e9d3075f7dcb89604d6bad61033976177a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229456, "uuid": "77f0902d-0e94-4dd5-b0db-ee8a74c28fe0", "comment": "Malware payload (RedLineStealer)", "value": "1ff39514a74106ffccc9b8b6f0a90e6e6c0ebd08eff710b1a25b901b1e69578d63573e4b660af07311e93a2fd7b10d6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229456, "uuid": "66baa970-e5c2-4915-b31f-b3de1d1f3df7", "value": "T159449E30A7E0C034F5B792F989B59378A9297EB19B3480CB53D126EE56342E4DD3178B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229456, "uuid": "64163b84-af6b-4bf2-97d3-a76072769ffb", "value": "949cb2a875d86b476d185d15a2fa1cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229456, "uuid": "c00dc95d-f070-484d-85d3-218d6fd51f78", "value": "3072:yvfqioEbQ5o9u4pcWvoFwXz2eeu6SHriqYrDWoQIEzvGE8kqzZtdsS70gdpHx2LD:yvfqRGQi44pc43H6MeqiESTH4uIBTUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633229456, "uuid": "b04d4ebf-e8b1-4953-92e2-65f71e5a196f", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633229456, "uuid": "47449b3a-af7e-42a6-b87a-af97be6c58d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229456, "uuid": "f4e105b8-c11c-427e-8ba3-ea6c8551dc75", "value": "7b7f7ee6b428da1108f6ebaac039edef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15fafb1e-249c-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633301334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301334, "uuid": "2cd1397b-d81b-4ae3-a25c-a2e4edb785d0", "comment": "Malware payload (Gafgyt)", "value": "32b3edd73112453023886f39177d5e0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301334, "uuid": "60d3876e-3d56-4dfa-8197-5683b9d28596", "comment": "Malware payload (Gafgyt)", "value": "60f702efdcd42db530f0ac836740af941f6f2dd2116685d6f42e31c627b92e0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301334, "uuid": "af79570d-d990-4c5a-9a07-63dfed2eb198", "comment": "Malware payload (Gafgyt)", "value": "040edcfd5d05e69d08d2cdf4e25469713a5f9b48", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301334, "uuid": "90526c49-e77e-4d8d-92b6-7dacea9e7e1b", "comment": "Malware payload (Gafgyt)", "value": "44add37ffc5b80266633843225cedc0ca33c4e066050916b61e055c5c826eee58cc2d1e4a8385128adc02886443cf847", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301334, "uuid": "6163888c-2391-441f-9992-2e1a0988e434", "value": "T11CA33A37BB130A23C0CA547212E30731BBB5D3D928FA5247BAA16DEC6F166803566FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301334, "uuid": "06c7131c-198d-4e69-8404-f31843175887", "value": "1536:xfRuqNM5h7t/RiRt4nyphaQoRKzO6F6OXj6ufeRTe:OqN8jRiRVphaQoRKzO6F6OXGufcTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633301334, "uuid": "e04696a7-3050-41f4-ac81-ddcddb30e35b", "value": 102442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633301334, "uuid": "a034e568-9b80-400e-90a4-2b36e9aba59d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301334, "uuid": "6a951b76-414a-4b57-b431-0f5c8a6ea5d1", "value": "32b3edd73112453023886f39177d5e0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a57e4a-23ec-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633225975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633225975, "uuid": "181cf45c-d061-49b1-a733-48ade7473d37", "comment": "Malware payload (Mirai)", "value": "c5cdc19870e556cc1e3b73cffda39713", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633225975, "uuid": "332ff6c2-0f51-4f60-ab8b-c4db96de5372", "comment": "Malware payload (Mirai)", "value": "612c2b7f9ae687e54cf00eb39f325298e539368a078449e375657253a50d898e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633225975, "uuid": "a63c6a4e-cc48-4a75-858f-ae23af720262", "comment": "Malware payload (Mirai)", "value": "cca75bcf50c81614501a5b9b415b3276dbf040df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633225975, "uuid": "6ebed4fd-084c-4fd3-9301-e91c84912fc6", "comment": "Malware payload (Mirai)", "value": "62af79c3feb49558d5a6ae1ca01954983d3bb6f26c07f8ccb7b0cde0c991ee51ada00dd30c2ea837ebe95cac349c1644", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633225975, "uuid": "ca37f89b-4320-4839-b664-949d811e5dae", "value": "T16282D0B0F65DDA1FD1C6433A03EA4EBF5C889C014E95D08B7A11C94A6D9E038616EBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633225975, "uuid": "210d83e2-3757-4292-a748-553853010b7e", "value": "384:MfVmDW+4i2JgI8+CAtK/HiaXHTtU/hLZwVQCl9nMv1RO:2VqWuRPiaXHRU/hdqQClwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633225975, "uuid": "f8cd4043-5251-43a7-947e-2e9e3188e7bd", "value": 18172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633225975, "uuid": "27a6c8b2-b553-4dde-b579-f187c377c8c5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633225975, "uuid": "a4a3b2fc-db98-46ed-97de-870aed390ac7", "value": "SecuriteInfo.com.Linux.Gafgyt.BEE.22705.3075", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97c508a-247a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633287005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287005, "uuid": "3a30cd06-c17f-4a26-b80f-35ca672cbb82", "comment": "Malware payload (Mirai)", "value": "bc2d60011c66a7329f21fa429b9af61f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287005, "uuid": "37181691-8707-4193-98a5-ec2dc2939876", "comment": "Malware payload (Mirai)", "value": "617d6da8e060f13de14daa8bdda2443569c630364a60fe49f575bc1cdb7d3fd6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287005, "uuid": "60c8f6cc-638e-4e32-8e4f-a84a589a6e94", "comment": "Malware payload (Mirai)", "value": "94f18dcd20148465ca6e48911b2abb592bd481c9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287005, "uuid": "b3fccaa2-e001-46cf-84b3-057949d16ca6", "comment": "Malware payload (Mirai)", "value": "d5cbf12b17366e593a9af0ee3c6c8fb35dab9bd5ce58cefe54af46819c2bf49f82c37b5b9f668bd52c145a7e5499c0a7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633287005, "uuid": "13de938d-2abe-4064-8fa7-3e7e1ea173a3", "value": "T139C31A05FD404B27C7D22BBAF79E438D773666586BD333115A296EB02FC1B982E39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633287005, "uuid": "9e91834d-db6e-49e6-b445-b6192203dfa2", "value": "3072:KJDZ+6lJQTnoo3TK9vmCL4Xg95hLLUNu+C6JAPbqojwQQRh6RYAvZR:2mCCg95hLgNuUojwQQRh6RYAvZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633287005, "uuid": "6423b398-7ae8-4000-838b-96684213e1a2", "value": 128317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633287005, "uuid": "811f8034-a93c-4a93-b5ee-ab165fb152ad", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633287005, "uuid": "6b6ce971-b26d-4211-a492-1be8cddd2318", "value": "assailant.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d9a435-2438-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633258548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258548, "uuid": "0d650c40-a75e-450a-96b1-c274f8ac70e7", "comment": "Malware payload (Mirai)", "value": "be41c0c01f239847063890e53259edb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258548, "uuid": "dc4c433a-9721-43e2-8c23-b9cb6f60b43e", "comment": "Malware payload (Mirai)", "value": "61b39c6e42c26e01c64ce079cd9d81eb591c70435c0d4c67a853ce87423211b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258548, "uuid": "e74ba6cb-d028-4dea-957e-5e8f979da240", "comment": "Malware payload (Mirai)", "value": "44ff0693d83622efc7ecaee15a74beb9a5cda53f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258548, "uuid": "8ba1e2d5-4b42-414a-bc25-07cd4447073b", "comment": "Malware payload (Mirai)", "value": "a32bae86d097f6e62c3baf52c5feffc4759fc8b5b0060c74b935baba773029db9880a155316223f0435ece9a90cb09b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258548, "uuid": "9aa0ce9d-c4c6-477c-8a6c-96bf9defd572", "value": "T13FC2F114E05494E5FBEF7030185783646FA2BF932FD9AFD31089E81249735B0AA205ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258548, "uuid": "843a47d6-ee7b-4f93-8bd5-52851507f104", "value": "768:tffbC2nOIFT+wPEVq8x9j/Ts4LcP/c4uVcqgw09K:5O4T+wk9j/TsM4u+qgw09K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633258548, "uuid": "d68706e7-4586-44c1-bce8-0b3fe9a2f9ca", "value": 28152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633258548, "uuid": "44bb0c24-4395-4097-9e69-368b1a99bc78", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258548, "uuid": "67ceae85-7ce2-49a7-bdba-e03679a1d96e", "value": "be41c0c01f239847063890e53259edb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853716d5-2438-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633258571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258571, "uuid": "0439f68f-8d93-448c-844f-ebb4444ebbad", "comment": "Malware payload (Mirai)", "value": "0b4fe7f149707f30ae6a2d12ab3060ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258571, "uuid": "ee2843e8-2af9-4b6e-9274-eee761eb2ce5", "comment": "Malware payload (Mirai)", "value": "622b9633c875fcae45cb97857073900da2e509116597bcda41c074c9643098a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258571, "uuid": "372104d0-be65-4dd6-a996-ceaa635c8a3e", "comment": "Malware payload (Mirai)", "value": "8670edd93a16ebeec2d09cc96adb6cf11ccacdb4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258571, "uuid": "171483cf-ff48-4b17-aaa4-9c007cdd2261", "comment": "Malware payload (Mirai)", "value": "b046d0b648eff74b4070395c05141bc10c81beb704e2915e01ab59d31e99062b21b096a5d54539e23229c84974672a1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258571, "uuid": "692aeefd-0595-49e7-82d2-5ad5465a86a5", "value": "T17EF2F111E126A0738F291771ECBDC5C5DFB606ACADBE78E6131040891BD64C63BE62CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258571, "uuid": "e060fd0b-f826-4139-9be2-86a9c06311f0", "value": "768:PUEH9v+2kGRIN2lKx7DIa79J6P5wsiPitAxC7bG8EFLpbEt959q3UEL5m:8+mCIN4K18KHPitAKqFLpbEt9sL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633258571, "uuid": "cccca9a8-5dc9-4732-8834-904077ff0d2c", "value": 34396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633258571, "uuid": "78c1d85f-2119-4b02-956b-d1459aca317d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258571, "uuid": "28101f66-f438-44f7-b0b0-64cbc1352e4a", "value": "0b4fe7f149707f30ae6a2d12ab3060ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd452533-2401-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633235150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633235150, "uuid": "5205ad37-a427-4785-92cc-296cc2729374", "comment": "Malware payload (RaccoonStealer)", "value": "4b93ae1d98090abef8bbb666b5c3dbc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633235150, "uuid": "f68760b5-a4c9-4906-a869-13e8e996ad38", "comment": "Malware payload (RaccoonStealer)", "value": "6468e058014074558c7d2f81db2d08d4f662771b147c608eea867191ceeeab09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633235150, "uuid": "73e3b1f4-b644-4fdd-99aa-f545050d0501", "comment": "Malware payload (RaccoonStealer)", "value": "8fc4b45b855162ecf1092a8d7be4c16a5d2ded15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633235150, "uuid": "893d9e03-2a16-423f-9473-5fb1914b053c", "comment": "Malware payload (RaccoonStealer)", "value": "6a736d89a0df82e32c0294ce6cb0356f0f91a2db14542d0fac72874ad9c9c426e20fb822f295b40c73efe0133e6af181", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633235150, "uuid": "5dcbb431-45f1-4e3c-a288-e30c85a15b51", "value": "T192D4F10835A2EFF2D67505F19B26C3E0493DBD681A2A764F7B48375E7E3D3E09621242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633235150, "uuid": "dfbcc7ae-2ff6-4972-a654-4af1858a9671", "value": "f37786a16a90f8f3f38c22c48ff5cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633235150, "uuid": "8e9ec89e-c9ef-467e-b168-ac0893551436", "value": "12288:z9NTul+qJZSf/b8GQocooSPTbfQG3lXYnM6BdsFmaL6mzxd6L:R4lzK/vcyTbfQG3lInZa1L6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633235150, "uuid": "d838b66a-92a9-4ba4-bb83-8029fb64f4ed", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633235150, "uuid": "b7ba1441-5ad3-4b7a-8f87-258f8c0e6b7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633235150, "uuid": "00a40e02-9dd6-477f-a02d-e244fea5aaa5", "value": "4b93ae1d98090abef8bbb666b5c3dbc9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cfbc77d-2475-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1633284622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633284622, "uuid": "02d1bfe8-e359-498b-9d0f-dcdedc8cbceb", "comment": "Malware payload (njrat)", "value": "3629444779e7e4fb9a023cda4f1473c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633284622, "uuid": "804ceab6-7926-4825-97f4-f45182649ccf", "comment": "Malware payload (njrat)", "value": "647b62057e0fce41fd1b3d7f4c99a834da671e36f4c72eb03bec9e7a34b24b35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633284622, "uuid": "f56b5376-a2b9-44f0-a030-a5f922e781dc", "comment": "Malware payload (njrat)", "value": "6dbc84ad7cd111eb34ef3c30186f5afc86304749", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633284622, "uuid": "196809f5-1e16-45db-b45f-e6aae9094339", "comment": "Malware payload (njrat)", "value": "886ac5e788b43dd3f1280172671738222ea2a53abcd1d834a650e03de5c903803200c81da50ebd03fa8f2ca0f266229d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633284622, "uuid": "678381f5-5c38-44df-85ed-34214ed473b2", "value": "T16EE207067BE94215D6BC5AF88CB303214772E3838532EB6F9CDC88CA4B676D00245EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633284622, "uuid": "ce41d990-febd-429d-914b-d126f2b54ed9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633284622, "uuid": "6699c58b-a5b5-4733-b17a-b1061f2e645d", "value": "384:I0bUe5XB4e0XIODzw0Q0mS03AWTxtTUFQqzFgObbV:9T9BufY55d2bV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633284622, "uuid": "ef1413cc-ed7b-4225-986c-4ca07f34b7d6", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633284622, "uuid": "da08d9df-b895-40f8-a28e-8fcc8a15c496", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633284622, "uuid": "4ae66dc7-2d9b-49f3-9d94-43e4f0889f02", "value": "3629444779e7e4fb9a023cda4f1473c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac8c802-23e2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633221536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633221536, "uuid": "220d5788-8736-4cc4-b633-4ba696be60c2", "comment": "Malware payload", "value": "f9ba5d0353bcd48580ae1da5c0e7e0a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633221536, "uuid": "3e804d3e-a19d-43c4-8f4d-8f849057d6c7", "comment": "Malware payload", "value": "65b9f3c78ed6c4ae341c4ecc82999e0c489b1d85ebbf6ee3a6fba66b12cb2706", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633221536, "uuid": "5abc8b1c-7294-4eef-afae-87c5b7498707", "comment": "Malware payload", "value": "c7f3341479dcc2dcaca58049bbfdcc6a4d7e078c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633221536, "uuid": "04f2a352-76b8-45c3-b069-35af5b2dcdbd", "comment": "Malware payload", "value": "81cbf83ca291b378f58a32beb29075b910ef286334d4d7b61edba9adfc622a49d735e953d9f506d8f70e5c48645ec6b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633221536, "uuid": "25e88691-4c23-49f5-82b3-dc67c266d75f", "value": "T12A7302027F15DD0ACF100C733ADD9E9E8D79AA5F4AEBB4B568E1948F27901CAAC52304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633221536, "uuid": "3565b1ad-a613-4a3c-912c-86015d250084", "value": "1536:pxpJNlEYvXndUt/afLuZmVelu9eoCtcCCzNbC4RWC0CQFW3D:phNlHuBafLeBtfCzpta8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633221536, "uuid": "176d0510-28a0-41a7-8d1a-8c7150c1f746", "value": 80504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633221536, "uuid": "bf4bc3f2-6a16-4985-aa68-28250b226d27", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633221536, "uuid": "d8104cd2-172c-465b-9efc-fa7da1081cfb", "value": "SecuriteInfo.com.Linux.Siggen.4218.19271.23582", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93d6d34-2472-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633283676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283676, "uuid": "6ef89685-ffee-41d3-ae25-65cf7dac2f2a", "comment": "Malware payload (Gafgyt)", "value": "19c8f97d16c8a91d11f88454ce7cd77b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283676, "uuid": "b9ff5ac6-d180-4a1e-af8e-72f3e1127701", "comment": "Malware payload (Gafgyt)", "value": "65f6f09612bfc29402913f009bbcd5a5222d106556c0fbd00baedc3517a2bc53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283676, "uuid": "0c11b140-9be2-4be3-9120-c22eb5022716", "comment": "Malware payload (Gafgyt)", "value": "1d438f011c00b295e0e5187d22564b9aee5cf532", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283676, "uuid": "c248b944-fd31-48ca-96be-18542986e3db", "comment": "Malware payload (Gafgyt)", "value": "93a867c28bdf49ad00628eca23e95de2e2ccb0072f04fb0335b90094fd6bb0639f5aeafc9712623fcacf7085e99eaa01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283676, "uuid": "bbce2870-2c53-4b69-9357-276608ee88ca", "value": "T19CC24105AFA14EA7EC6FDD3384FD0B4630CD900A21A53B662934E428B35F59F49F38A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283676, "uuid": "3565a5bd-d5ab-46b3-a27d-9568805ca48a", "value": "384:sQOxwgYdVem95LCCGZjqzm2/S1CPeleo1eVFqIF6XiWEtYJ9DTD:9ndV86S4Peleo1en8XifmJ9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633283676, "uuid": "10732f44-72bb-44fd-8d01-58b8100500f7", "value": 26872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633283676, "uuid": "87d73c24-6d00-4de8-b675-fd0c03e643a9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283676, "uuid": "d40d1df2-1120-40f4-95e0-51008106c968", "value": "19c8f97d16c8a91d11f88454ce7cd77b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9a2780-2472-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633283304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283304, "uuid": "8e415886-d439-467b-a63e-850aebd0df9b", "comment": "Malware payload (Gafgyt)", "value": "4a1890a4643533fb2f5257e28c88a503", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283304, "uuid": "005ef3f9-5971-49ba-9efa-a5a6fa7c46ad", "comment": "Malware payload (Gafgyt)", "value": "6777e5e37c9126c7445e145c15e17025c74e2aeac6def529f30b17a2c709accd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283304, "uuid": "906d89a5-009f-435a-9673-63c7616df29a", "comment": "Malware payload (Gafgyt)", "value": "f7894d43232fb32dc22b6bb1dd6a79ed902d0c20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283304, "uuid": "a6dc6d97-6e31-4106-bca7-036061bb8088", "comment": "Malware payload (Gafgyt)", "value": "34e03db167853a0378de836c249eef759b895a0d15d9796fff62b1282893b3111fd21f0f0809a073fce678ce4da9e5e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283304, "uuid": "bf0341ed-b87e-43a0-84cc-b9d8d61afb09", "value": "T1DBA20A4ABD81CE05C490963DFD2E510E37375B68E1DFB3026F047B242B4A96E4F76856", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283304, "uuid": "5c810142-81cf-48bb-9c4f-774c222961b2", "value": "384:Cwnclcb2Md3Mh4BLvn/F8KiDLpVNk7phANSxXKW9/T764aDUI0/coAjirBwUogXO:CwnGAWy/FFapV+oNSVD9H646Uh/co2i8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633283304, "uuid": "169b4bb0-fcde-479e-91c1-88ca9857d5f4", "value": 22352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633283304, "uuid": "e287341d-e177-404d-91d7-243885278913", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283304, "uuid": "fe9b0ac6-f17a-44b6-8403-52dc63ba06fe", "value": "4a1890a4643533fb2f5257e28c88a503", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753d08d9-246b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633280448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280448, "uuid": "f823ea34-b99d-4b5e-9441-7f1752462e22", "comment": "Malware payload (Mirai)", "value": "d1c482252894553866fe1c371355c84c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280448, "uuid": "8aedddde-6252-434a-82fb-6f644e867ffa", "comment": "Malware payload (Mirai)", "value": "67f0bbe5633c60fcfc8abd88aea38567ffca614321df643dba45e2d31dad4322", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280448, "uuid": "d4921721-61db-481d-8efd-32a79b55dd09", "comment": "Malware payload (Mirai)", "value": "ce8f778f8cdb25e1647a31aa29dc67c0a896856c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280448, "uuid": "786de54a-7754-48fd-9bcd-26e92d286134", "comment": "Malware payload (Mirai)", "value": "6c67bd6b04d18783400e45e4e0c6c0772c33128db53e25a42e53df8e835771af790ec492ed123f3b7152f936c0ce0747", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633280448, "uuid": "d136b530-2623-4977-8e8c-408d94a660e9", "value": "T1EEE2D0FDFEE4C944C9FF6D3EC25C0A66AE2550C2A20797CE93004D95BB88D41B91C2A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633280448, "uuid": "586bfbe6-953a-43f5-99ff-2cb5f03abce8", "value": "768:IrRKG+yWvPgaoHJeR0VW44D2Nd5JW2w3Usogc2d4qWSl:IEGfmPgaSJeSo4VL5sogcUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633280448, "uuid": "5eba87c5-ccd9-4672-a398-2c343b3b6b6b", "value": 33988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633280448, "uuid": "d1f64b75-2010-4e28-8942-5c83a4f9af4d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633280448, "uuid": "3efa45ec-c273-4667-afcd-41f9ab2a237f", "value": "d1c482252894553866fe1c371355c84c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf59155b-23f8-11ec-843c-42010a9c0014", "comment": "Malware payload (Redosdru)", "timestamp": 1633231207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633231207, "uuid": "c70ccee4-fc9f-4568-ae0f-e7963ae0b4b7", "comment": "Malware payload (Redosdru)", "value": "1444bebbb5deb71e3243aec2ac0d78e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633231207, "uuid": "127d06ab-05e8-4e07-93ea-d9766ed8835f", "comment": "Malware payload (Redosdru)", "value": "69f2373b506710775bbd98a31962f10737a412a6c95acbb71a586ae814464f65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633231207, "uuid": "b101db88-1617-42da-9df4-7a0ea2c54023", "comment": "Malware payload (Redosdru)", "value": "e17896294a5f9e88ec7c3ecb3cd466b8cbb1db3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633231207, "uuid": "a2bc24a6-4e8a-4237-998d-17bea1a49e8b", "comment": "Malware payload (Redosdru)", "value": "7400390c7e24373dea2ee92468e41031f04fecd1655e2c26e4b729543966653f0e6af4aad151e2646f1bc86f6e17b84f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633231207, "uuid": "f658348f-66b4-4862-b278-8f35b46e0c7d", "value": "T18474AE27B6A6C0B6C79301310FE25BBAE7F7EA704A32594373C95B1D5D358418E3A326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633231207, "uuid": "036264f5-75af-4bbd-9f28-1135dc760180", "value": "a168a228fd3fd77a76fc5dedb4b103bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633231207, "uuid": "aa3d8cb3-c499-4833-b215-ce6fe25a8d29", "value": "6144:7mBZ5WcNancq4m8Jm50HkbIn9tskARz/pkkYLZxYYWz3mvxo:iBZ5WcYnBH8Jm5Fg9tskAt/pkbrYYWzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633231207, "uuid": "c28632d5-3991-4bda-ab5a-b845e328ba2b", "value": 361472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633231207, "uuid": "895f7fc1-6fd5-4d30-8416-cc8ca546a2cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633231207, "uuid": "5d078d1d-e29f-4321-8bfe-0a3ecc404e14", "value": "RollStarter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d52e816-2445-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633264195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264195, "uuid": "cce89317-f04c-4069-bc18-6e8a1c2772b9", "comment": "Malware payload (ArkeiStealer)", "value": "72eeb925f7a4c3c5b6e57eb1e95d0f42", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264195, "uuid": "97ba244e-4671-4b70-bcf8-7f3849d6371f", "comment": "Malware payload (ArkeiStealer)", "value": "6a7a6f57334b02846920424f5d5b62d1e6ae1966282533b6cf1b322a4a77a936", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264195, "uuid": "c0929d01-7c02-41fd-bb93-68318bd586e6", "comment": "Malware payload (ArkeiStealer)", "value": "0aa3378867aa2d8af3b078bfe9eac9859ff63f19", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264195, "uuid": "a536ca15-e1ff-4d1e-9aa1-d9cdbb67cd41", "comment": "Malware payload (ArkeiStealer)", "value": "0def1563003b64ab6213309d2e1a19af3fcc8bccf958ee4edf721f05ca9dee521ca39547506f5c6bcc7dbcb21e9ba3ec", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264195, "uuid": "d4dd870f-5ebc-4a89-beaa-996703bfc9d1", "value": "T1D0F4012672C5DFFED27216B19B19C3E0457DBC6D591A668F3B89376EBA3C3818620301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264195, "uuid": "0c7f391b-76b1-4582-a7f0-0034325c245b", "value": "401c37f2bd821b3afe64e4a9a74e43f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264195, "uuid": "40a2e964-2937-4675-8d02-ddd19aff3b5e", "value": "12288:U9y1IIVVCc84SLh/NK40wWI3B+ICdS6GdIc6FKON240cvL6+zxF6L:7Ix7xT8PGwFxkwJL6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633264195, "uuid": "5850a2b3-eeb8-4d12-999f-e50f6f558e23", "value": 760320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633264195, "uuid": "517dbc3f-735e-4c64-aa07-e3a8debc07f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264195, "uuid": "3d77325c-4ff5-4944-b86f-0df059714be0", "value": "72eeb925f7a4c3c5b6e57eb1e95d0f42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b0c084-2467-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633278620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278620, "uuid": "a8882168-734d-42d3-8fd6-c4e78113f115", "comment": "Malware payload (ArkeiStealer)", "value": "29f7e1b86fed5fca5ab285a50a6f1aa2", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278620, "uuid": "2df7c67c-6da2-4a3d-8dce-ce1d1fc3c01b", "comment": "Malware payload (ArkeiStealer)", "value": "6e1b586d59bda966bb6ebd2b75ba8f58310dfd619920fd6cb4ba794bbd52847c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278620, "uuid": "9911f08e-6bf9-4baf-bc4b-23e09a2ec156", "comment": "Malware payload (ArkeiStealer)", "value": "b97ab6bb14228ea4f3b5f8bfca4d58400b9cc17c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278620, "uuid": "7cc95d0d-f8d2-4adb-b6d3-f47606a9d109", "comment": "Malware payload (ArkeiStealer)", "value": "985d208a95511cb2d257b9f822a54d77d7436f927c21abd3d883ef3707bc939a6a9d5972960b4c143d4e901d0401aa69", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278620, "uuid": "50a08289-8805-4003-b0ef-6f4c92cbd418", "value": "T11EF401693182CFF2D9B541F16715C7F05A6EB8699E16A5CF7B88371E3E3C3828621381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278620, "uuid": "6e4cbc31-a208-42b4-b215-681e265d1323", "value": "e1dc734f9d3fd8ffe237c21274508ba5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278620, "uuid": "5453e873-e301-498f-bc55-f61ae412f92d", "value": "12288:SSsEVSIbV/8rrw0xi8sE8XyxN6tMcKe3KtfPTsXeX6kdO5J6PTOgbvL6+zxF6L:SSXHbZb0xi8GXyxotUe3KBzOX6L7vJLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633278620, "uuid": "02c8e73d-f07f-4f3a-a256-905bf40e759b", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633278620, "uuid": "df917f62-8b13-4d43-ac55-73f048f9a47c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278620, "uuid": "3313e2ce-d3d3-4b4d-9e5c-da7bdcb9058e", "value": "29f7e1b86fed5fca5ab285a50a6f1aa2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "323ea0ec-246c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633280765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280765, "uuid": "3f5bc6a7-b586-4d67-8802-2e25d52ca4d4", "comment": "Malware payload (Mirai)", "value": "3b89fd79d7088969495018a48c8fcd0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280765, "uuid": "8cba2bff-d601-4aa3-ada4-305e98d161a2", "comment": "Malware payload (Mirai)", "value": "6e734cfca6d13c693d33f91276b7174497886bd8c5926d7f561371820204e0bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280765, "uuid": "f263af58-adbd-40df-bd6b-2c25079f32ef", "comment": "Malware payload (Mirai)", "value": "78a0d31014386bff7af076e169bf6a25190011f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280765, "uuid": "ec3d8837-f4ba-4050-9a53-4db7f27c1f73", "comment": "Malware payload (Mirai)", "value": "86ace9705b425857d26693e2392d5f72c48471cb4e475b2f0e4c6e718f4747fc008ed5be447c689ada7d64f41f6b14db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633280765, "uuid": "ee714e9d-3468-40e8-b60a-77d6b0bb0726", "value": "T198F2027AA10AC952CCE23D31BF10D187432F1678B5BD321535448AA595C5CE23EF9BCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633280765, "uuid": "d04dab5c-bc96-4b5f-9d17-ccdd87bd9c21", "value": "768:zNh95PuNlYCUXFyeN88bl8piG/TnPT6k8MPPLSn0Fd8r5+O1S9q3UEL+e9:zfrufYCUUeN888pTTdSEd8r5HHLt9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633280765, "uuid": "e99b684e-200f-46ca-ac5c-34fce560dc1c", "value": 37240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633280765, "uuid": "40006589-d904-4053-9558-4fb95918331d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633280765, "uuid": "7be3bd75-e2d5-4be9-ae8a-2483e5d47432", "value": "3b89fd79d7088969495018a48c8fcd0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eca4d7c-249c-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633301349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301349, "uuid": "45f70ab7-4831-40e4-a9d6-769046e576eb", "comment": "Malware payload (Gafgyt)", "value": "627efc1305fac728d3be52fb28b26fd7", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301349, "uuid": "b4a8ac96-e175-4a4f-b8a8-5121d5b6a484", "comment": "Malware payload (Gafgyt)", "value": "6ec67441855630d97d0dbee0758fc3d04289af8a17e4799e6fe7178c9268d426", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301349, "uuid": "554baa50-5d83-43da-baf1-042c59087c10", "comment": "Malware payload (Gafgyt)", "value": "e7f9d348b4e9d44aff9ca6e630c83b0d3fddd831", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301349, "uuid": "f828e493-0abd-4a82-9546-daa4bce962ca", "comment": "Malware payload (Gafgyt)", "value": "cb6b68de91ed6a4180d185eac1df3bb7210985513b24de099c434a3cbec5c93881f6ae5d6f7844c3c405eb20e5e2521a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301349, "uuid": "a3116e27-d0b5-409b-9ce3-4af09dcf68d5", "value": "T1BB934A17B653C6BAC0874BF41BDB9A314923B8BD0B227206B3D4BCE67F165A61D19F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301349, "uuid": "cd0aea4c-60eb-4b01-99d7-9327c5953228", "value": "1536:p7rHXokXsWFVSzkfLEkZAT5ipG5v3lphauH/vPNlDDUg6I9um2Xj5YZb0e:pcCPOkfQfNipGdlphaE/9Vog99um2XFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633301349, "uuid": "c6461c21-eb23-47eb-85b3-078720b809f0", "value": 94012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633301349, "uuid": "cada6177-8322-4a08-b42c-b5a9597b3ede", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301349, "uuid": "36094239-9d33-4c64-a985-b15d17c9eee1", "value": "627efc1305fac728d3be52fb28b26fd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47dd0326-249c-11ec-843c-42010a9c0014", "comment": "Malware payload (OskiStealer)", "timestamp": 1633301418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301418, "uuid": "a052f6c0-2c1a-458a-a9b8-d3aaeab7cd80", "comment": "Malware payload (OskiStealer)", "value": "a055eac672a64092435f44fc94cff5d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301418, "uuid": "fbfe5b53-8044-4d8b-8a10-efe70ac0fe30", "comment": "Malware payload (OskiStealer)", "value": "70d12ff2197a1f6efc86703837f617d923f83f4d0fb24a669ba7b6e11a4b60fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301418, "uuid": "cbae9102-aea7-4c90-8098-a872715dea38", "comment": "Malware payload (OskiStealer)", "value": "29b8d267cb9ce5542285fa359299906dd209b80d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301418, "uuid": "2be3c68c-d943-4cff-bcf8-c1bff48fbab0", "comment": "Malware payload (OskiStealer)", "value": "7de4c5a513ae03bedb95d3a179f7d6d60512446db60a3001dc84a47469a958f755105a0bf67ed9ae203a67b0dc429b64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301418, "uuid": "7ebb286c-327a-461f-b0d7-5f106b47a312", "value": "T15AC1B50573ED0235E6B74B38ACB397529279BB228E77971E24D0521E9E227205C23F31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301418, "uuid": "5927a977-b8b6-4ba2-98a2-5e807dd31af8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301418, "uuid": "c8402851-e6e9-403b-8b28-2d63303cc669", "value": "96:rGjyly8P6Xbu9sxc2v+MjbcjbTjbi8BbKx9AR3PfLwzNt:rsY88sbGMjbcjbTjbF8x9ARPfLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633301418, "uuid": "8213147b-ea98-4cdc-9e84-1a3301a55a8f", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633301418, "uuid": "49236f10-12b8-4075-82ec-1251adc84499", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301418, "uuid": "cd8c46b9-f65c-4bbb-aa80-1caf50778a49", "value": "a055eac672a64092435f44fc94cff5d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e03e1f-2474-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633284209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633284209, "uuid": "1d654f16-f79b-4f32-a8cd-fd17db4bb689", "comment": "Malware payload (Mirai)", "value": "b4d12eb072b4c1ae29d337565bd71552", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633284209, "uuid": "c3e01bd2-1c2e-4d2c-9ab4-92a2d86c4d1c", "comment": "Malware payload (Mirai)", "value": "724d34bd855052169bab2eaae6618cf6673c76c581cc22d5c0a5c9f6ae2b63e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633284209, "uuid": "0cad03a6-b915-463c-b2a9-c2339f444281", "comment": "Malware payload (Mirai)", "value": "a10abf9d32d2f61132d39297464bde81ab39214b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633284209, "uuid": "c1c2dfaa-c9e3-48a4-9f98-ce83c894d86f", "comment": "Malware payload (Mirai)", "value": "4072744509032eb32eb934088f9afa6a7492268e8d8738d903d4bdc844dd9ab4219bd8c645d700d1008b6e37fe9e70a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633284209, "uuid": "240995e2-ea4a-496f-ae99-fc59fd9bca6d", "value": "T1A0921985FD49C905CAC4563AFA8E828C7B265398E1CE33439B1A7F925747C2B0E3F954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633284209, "uuid": "ae806984-22c0-48ab-aaea-529b60a48176", "value": "384:fgUiHbuIHTDhV5JD8cd8yU3u6/vQ2nwl01EQDv+SFx4e:fgUGbuWhVPD8uxIHQ2n49Iv+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633284209, "uuid": "daa658b6-1ba9-4efe-bd9c-593fb2d20b3c", "value": 21040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633284209, "uuid": "886a874e-d677-43eb-9efe-8211ada4f841", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633284209, "uuid": "e55707f9-8be2-40f5-83e6-0d4b1e08548d", "value": "b4d12eb072b4c1ae29d337565bd71552", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883eae38-2445-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633264159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264159, "uuid": "148b52e1-37ab-4ab6-9622-d6b083683321", "comment": "Malware payload (RedLineStealer)", "value": "e494a5ad707a5770becf3eec98e5d030", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264159, "uuid": "65b8db3e-80c7-43d2-ae01-6103a30bb04b", "comment": "Malware payload (RedLineStealer)", "value": "73d5698377ad2484256c45361649897450ac42e520455e4badd20590aa727a7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264159, "uuid": "bb92c8bb-9b62-4629-ac1f-91a98371a5d7", "comment": "Malware payload (RedLineStealer)", "value": "ca69309042f9bdafd2b89fc2946760e1e6c76f9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264159, "uuid": "7582fb92-7d63-44ab-8705-927cf56ee222", "comment": "Malware payload (RedLineStealer)", "value": "f9853bff0abeb0fdc25f7333c4491e8092b603a1cf5badae8cef6a65d5739a719280952f067fdbaa9f3cb2c7e3fbe553", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264159, "uuid": "fe4f74b1-52af-4752-ba7e-bfee597bedfc", "value": "T18184C0097290CFF2D6B506B1AB16F7E08A2DF8695C97D24F3794362EBE3D3918612341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264159, "uuid": "b7576997-89af-4c96-b104-97f2ba74b411", "value": "e1dc734f9d3fd8ffe237c21274508ba5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264159, "uuid": "8657c5c6-6378-478b-9c6c-6c7b1ab77a0e", "value": "6144:kqzgRNxLnc0yfaN9VdsXX+7XCNd02qQUEEFSpL6MCOhxxFeTr/ekI:vzaxLc0yssXXiyNd3yEHL6+zxF6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633264159, "uuid": "01c81ade-cfd3-4964-9e02-0446b6484acb", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633264159, "uuid": "df9a1a3b-e034-4764-bbef-f04e9cb52db9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264159, "uuid": "5db97b17-1785-495a-86b9-cac3c9ccf703", "value": "e494a5ad707a5770becf3eec98e5d030.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea077061-2445-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633264323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264323, "uuid": "a669fef5-c0d4-4c75-a298-83d23903ec77", "comment": "Malware payload (DanaBot)", "value": "ef87029d6051827fe69f39b74bfb8ddf", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264323, "uuid": "9f37a0bc-20f7-4fd2-af36-0331b7310826", "comment": "Malware payload (DanaBot)", "value": "76518fd9a8d3fad5d9d294742179b2a19b63625b2f5ea62ce23000ed71a0d3cd", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264323, "uuid": "4749c2de-3b23-4387-8a0b-26add48fb005", "comment": "Malware payload (DanaBot)", "value": "3b8519fa650467fe08db83dee2dc4dbbf628cf27", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264323, "uuid": "d3f5b214-1903-4047-a396-9b26f14b9c35", "comment": "Malware payload (DanaBot)", "value": "abb5656e9f99249ff6b799ae6212100177976e2887e997b6e77d894ca827be93cf460f3c706dba8dc0c5b6bdf5341839", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264323, "uuid": "62e27e69-0925-4d26-ba7b-8aef8245ee40", "value": "T1A44512147151CEF2E6B105F0A716C3E0096DBCEE5E55928E675C376EBE3C3C0862A789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264323, "uuid": "c383a39a-7b3d-45a9-bc0a-6cb31f301732", "value": "401c37f2bd821b3afe64e4a9a74e43f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264323, "uuid": "b83ca07b-4b94-4ced-b7db-6d3931319196", "value": "24576:qz9jzoM7MVapyvDLYyIoYswGPCRVae1FcmXQgX331q6fQ9JL6L:qhjRMVapcLYoJwqCRVaeD31tT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633264323, "uuid": "30b22e55-0e0f-4a9f-b576-af6bd222a156", "value": 1236992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633264323, "uuid": "3963896f-a52e-422f-a747-1c2354c831eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264323, "uuid": "0ccbccc4-07a8-46ad-b142-aa03c54ba6ad", "value": "ef87029d6051827fe69f39b74bfb8ddf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7112c29-2445-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633264211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264211, "uuid": "0738adb8-acfd-4d54-80ee-ff2383704c23", "comment": "Malware payload (RemcosRAT)", "value": "013111bb173de8adac5846c910bac3e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264211, "uuid": "822f5416-1c6f-41c7-a1fc-0b489e1cc61e", "comment": "Malware payload (RemcosRAT)", "value": "772a319b31a1922eadd022f30aa60680e911f758d4c81c4dbf16614cf7791f0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264211, "uuid": "337f87b2-2aae-4372-ac05-0bed7e71b535", "comment": "Malware payload (RemcosRAT)", "value": "23f53c65c68613f04bdcdec1e2dae802d1176f49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264211, "uuid": "381eba27-2a42-49bc-b0bb-1c115042f298", "comment": "Malware payload (RemcosRAT)", "value": "f5b295219064ebefcdb6a5eb22870eb7f34c303884bb7d08beefd3ee7b2f8295ed6b709771583ea609c1a64bf5246987", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264211, "uuid": "6e7ebef1-3cc1-4edc-b16b-629fe2eb1126", "value": "T17D056B9B5EF90D76C162153E8D4EABA9B5197FA35E189050AFFF099C2B2F2033508743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264211, "uuid": "f513c469-d328-4722-921e-0da0c04cb7cf", "value": "6796b43d150beb39239379fdfb5b2577", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264211, "uuid": "86206385-eb83-428a-b6a1-5951647da340", "value": "12288:ZsuzGJs/oxKZsztEkPvnoO90Oe6jkOGbGsr4:Zzr/oxKizt1vjGD4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633264211, "uuid": "4ff6bbe4-55a4-488f-950a-ed65210f4830", "value": 835072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633264211, "uuid": "2c5dc779-a2c1-47b6-8f6a-dbe23cec6b5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264211, "uuid": "b3577e80-8381-4b00-b88b-95920115d8d5", "value": "013111bb173de8adac5846c910bac3e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55e4a8a-23fd-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633233338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633233338, "uuid": "2d1f7b8e-ca6b-413f-8325-d966e6d19e81", "comment": "Malware payload (RaccoonStealer)", "value": "4e9e6a2c8dbac36a98a396be8c3ba925", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633233338, "uuid": "1ebba9bb-9d72-4be4-8d92-966a387aa596", "comment": "Malware payload (RaccoonStealer)", "value": "774e2e652ad3d2c07841a504968277fa949ba80a30e621fc340efa68ee0403b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633233338, "uuid": "879a7d05-5be8-4e07-a23e-03cef03fd1d7", "comment": "Malware payload (RaccoonStealer)", "value": "40b9da7d065f4549590bff7a8bc6cf6fbe74d667", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633233338, "uuid": "7d66f301-e4b3-48bb-8b80-9b47151df754", "comment": "Malware payload (RaccoonStealer)", "value": "351dd05a90425a9f71230b5c9c866ec547aed439b6bc4feb239eb290e8dfae1505e17979532e17c2e22090fe47067927", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633233338, "uuid": "6462445c-6fac-4b20-a477-a0df9c3645cd", "value": "T1FC549D193182CFF2D67605B0AB96C7F0092DBDA94E26764F3B98375E7F3C3918621252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633233338, "uuid": "2c9627b4-372d-490c-aaec-db69d0d357a2", "value": "f37786a16a90f8f3f38c22c48ff5cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633233338, "uuid": "46d27d23-97de-4d1f-92ca-73694a300840", "value": "6144:+/CcSPf0NLxK5PzXhSX5iqlgwqJL6CvMOOhxxdeTr/ekI:+I8UzXhIQ6iL6dzxd6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633233338, "uuid": "4216002b-faee-4140-920f-438ef33216ca", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633233338, "uuid": "ab5486c8-a3f2-402e-9c18-9af91ed4d383", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633233338, "uuid": "5e959d5f-ef3b-4a39-a121-a9019921b3c1", "value": "4e9e6a2c8dbac36a98a396be8c3ba925.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f7c971-2465-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633277770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633277770, "uuid": "6b455f54-9afe-4279-af20-d518a665f24a", "comment": "Malware payload (AgentTesla)", "value": "58d83ce638452a15dd79786c7930c418", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633277770, "uuid": "c0e9bb21-2f38-4b50-910c-fc6e6f478418", "comment": "Malware payload (AgentTesla)", "value": "7769139d2931379a5d46acb955f2b228091dcea9134c4d84e116b877283c309d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633277770, "uuid": "6bff810d-3bcc-4b46-a266-134c5bce4dda", "comment": "Malware payload (AgentTesla)", "value": "29f6d31620bc4afd2c5584693e0ed0eba285d7e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633277770, "uuid": "a917b882-2319-40df-85a2-deeea5b5d86a", "comment": "Malware payload (AgentTesla)", "value": "da2a2ac2eec5da6a18393da6741dd154948d5d446e9d7e3c4d1615b52c75a1f8a02640c482da3dda2bd0196c4c9cd1ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633277770, "uuid": "865a356b-9457-4eeb-a7ea-d5fb6495573c", "value": "T13BC1B50097E8872AE6B24FB95CF3C2016278FB02ED17874E2494221E7D26364CD32A72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633277770, "uuid": "6c9520f8-44a0-4f33-b80c-0699514dd789", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633277770, "uuid": "dfeed703-8da9-4813-8671-cb07b3119e91", "value": "96:fZmJ5TpaAPgZ8bMEhLa5tS2tIj5VHbVnzNt:I9aiAND7o5ZbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633277770, "uuid": "14a1fd7e-199f-49c1-b681-b38c7573a4e7", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633277770, "uuid": "f2f9c4aa-b309-43c6-8cad-3addab476acc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633277770, "uuid": "1d580602-8952-40d0-9fde-f232c0dd67fe", "value": "Email Copy_HAWB S543153_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97cd388b-2439-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633259032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633259032, "uuid": "ef743153-fd53-4b1a-af3d-e2af67399e93", "comment": "Malware payload", "value": "d7fc1125c0a3e3f1bfbe5c54c33826b1", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633259032, "uuid": "260077da-c8d2-44ab-a4ac-ce87a4a81824", "comment": "Malware payload", "value": "7798576ac8980bc374906cf9773be343a22dd5192363e39ebed8d87f8a869a45", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633259032, "uuid": "8327c4f6-bc13-4d13-8456-be5c271fc830", "comment": "Malware payload", "value": "aa8c70b34fef1145ae07e3b6629dff547c12179a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633259032, "uuid": "3ba644df-1b76-4584-9550-dca275633177", "comment": "Malware payload", "value": "4d890bb76014756e09436f6bdcd559a5c2f03cc688e09630c08d3e2e6b522976f7622b1809dfb79cecf7e02da563824e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633259032, "uuid": "32b23077-f5d2-4293-92bb-fb633e2b9133", "value": "T159E633C46FEDE56BC033B4F9DA718147541584085968EFEB97A0D8AC4AEECC1C6ABC4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633259032, "uuid": "4328b727-43bb-4375-b6ea-d84e492d5885", "value": "393216:5KxmU1H18e6UcrLz44E+vpwgINXrgdutQn9cKXXEUh35WXj:5KBjkLz4IzINXrR4cKXXEgOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633259032, "uuid": "8e598a86-1fc5-4f51-9227-119e5c2fd657", "value": 14327109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633259032, "uuid": "6369de49-8476-4d50-b047-edeed106652b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633259032, "uuid": "29f7579b-b52f-4e3d-8207-a12947f1bff2", "value": "nhbank.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7ccbae-247d-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633288223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633288223, "uuid": "4b78ff4a-c591-48e9-a9cf-67e702217cce", "comment": "Malware payload (Loki)", "value": "2e503f5c34b44f11c0ce953d3d69a0e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633288223, "uuid": "9c5a6773-35ed-42dc-86cd-19cc3184bdaa", "comment": "Malware payload (Loki)", "value": "784f22f31bacf9e57c6162d31282e75fde015c4a74f6b126a9255c4a38be8a38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633288223, "uuid": "242fc66f-7f05-4cbb-893a-777187f3d623", "comment": "Malware payload (Loki)", "value": "ed67577c367413bda39338a1ca4e4e63050b83cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633288223, "uuid": "f1256e4b-ac14-4049-b5f3-ce15e8ba2f4c", "comment": "Malware payload (Loki)", "value": "89024d6e7758a3bd94fff271d0028e782cdf2f0da4c11c8f1442de3329f506acfd404a47b702a754d3d8d887f8accf88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633288223, "uuid": "a7394d64-7321-4a70-be4c-a10348c7baca", "value": "T104C422A4E7002CF5E99205319836EE252553EDBE9CF24A0F529F366079B738736D306B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633288223, "uuid": "4c5fb980-2265-4a40-ba83-9b7f901452da", "value": "1882e0582bf60c3c0bf3a2580fd0bf71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633288223, "uuid": "feb5c0f4-d766-48f0-9332-78cf17dd5ebb", "value": "12288:8qazX5Hz2LfzPTv+YbBKw7IXP7lJtqXi8M7I+esTCmFx:8vzF2zzj+YbBKz5yM7V2m7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633288223, "uuid": "50fea870-4c78-47f9-b780-3d41142959f3", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633288223, "uuid": "a86387c3-2b3a-46e2-9f9e-4b773708f939", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633288223, "uuid": "ce46e5c2-2dfd-41f5-8d5d-022f94ccd87f", "value": "784F22F31BACF9E57C6162D31282E75FDE015C4A74F6B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c710af-244b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633266548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633266548, "uuid": "fd3ff635-330f-42ee-88f9-0af704a4abf9", "comment": "Malware payload (Mirai)", "value": "b7be60b93b6ad4840cc9390dc79432cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633266548, "uuid": "15c720ff-844c-41e9-a7b9-fda9561b753f", "comment": "Malware payload (Mirai)", "value": "7be940fa6e254040f887c18c3caa37d1297c64e63d22c9f761bdf5241fd7d922", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633266548, "uuid": "e726b81e-116c-4c09-b5fc-04c803d929c9", "comment": "Malware payload (Mirai)", "value": "550b1710a47a38365a2f3fe9b611665cf9a7dcbf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633266548, "uuid": "3ad6c4cc-593f-4f63-9930-211bc15196d8", "comment": "Malware payload (Mirai)", "value": "24dc4d5fef9c0c6ef7b96a61b922279afb0ac5cb2cb90e8bb5901ba13a628172f08b3146dba532aa79d074f59b289655", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633266548, "uuid": "25a262e5-8763-4fc1-9eb5-661bef045ad9", "value": "T1B293175AF9816B11D8D926BEFE0E118933535BACE3EE72129D105F2137CAA1B0B77412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633266548, "uuid": "4ac4e9f8-62c8-44ea-abd4-585500b4a163", "value": "1536:tYnxlbvAbKaKK6zKaxKIKOYJQG94kehyNSqccazvVFL0b61RVal5di0mesmBgY7q:WbvAbKRK6zKaxKIKLJQE4keEoqHazvVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633266548, "uuid": "c54f2601-7a38-4e4c-bdbf-91482d129b55", "value": 95932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633266548, "uuid": "252ac537-6ee5-4509-8b14-99896af4c6b4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633266548, "uuid": "c180e0f4-0ace-4018-a14d-d7f7e4a76e77", "value": "b7be60b93b6ad4840cc9390dc79432cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098857e1-2446-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633264376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264376, "uuid": "40be87d3-9364-4f6e-a4dd-51ebc20db9d1", "comment": "Malware payload (TrickBot)", "value": "705d000c1a2292d80495cd13ee172711", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264376, "uuid": "b9f5af22-1ad4-4678-b07c-bb20fa6b639b", "comment": "Malware payload (TrickBot)", "value": "7c483138404aad6662938e6e4c100ad9b18ec636011b2dcd96607016d918c938", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264376, "uuid": "332d4a83-0986-4440-a616-0a83f20df700", "comment": "Malware payload (TrickBot)", "value": "dcaaaa0c25b9fc9e66153cca4013d8ac70da4592", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264376, "uuid": "4d6f5d3d-5d69-45a7-9ed3-0f9d40a4282f", "comment": "Malware payload (TrickBot)", "value": "92a35f47a11a47233092a04d5159a0054931efe3a48c6df926d5a03260fb80edb4b4a7fd1bc935e1bd70a7a849b53018", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264376, "uuid": "b4d0df74-5706-45d9-ae27-03dbe5ad4924", "value": "T1C594F1123AE0C877D0A745314EF58B79B6BAFB504F318A6F23D90F1E1D31A518A26376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264376, "uuid": "f89f110a-5325-4660-8f5f-230674507d78", "value": "220580f49c2724e661575b7bf3bd58ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264376, "uuid": "d99a1174-429f-4075-af5a-db78184e6512", "value": "6144:h0lJVu5xP+o2Em8NG/wBHRSIAR9687dX9szOHMVT+R6NWPFgQAXaneCrvD:h0lJ4jPczwn+96sdX9szOHMVFCgaJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633264376, "uuid": "8f6f983e-65b5-4347-9ce8-90ee24bf3179", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633264376, "uuid": "7ca6a196-f5ac-49ed-a881-96e9c0da31bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264376, "uuid": "9a062d54-6c1e-4917-bf6c-667cb70689e1", "value": "705d000c1a2292d80495cd13ee172711.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65059cb0-2438-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633258517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258517, "uuid": "dcdf4142-a3a4-4650-8672-e984f1ff721e", "comment": "Malware payload (Mirai)", "value": "96f6f940540c06d31582420f1ee6877b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258517, "uuid": "520347ed-f7be-43a9-ae58-c651b9296b61", "comment": "Malware payload (Mirai)", "value": "7ce9332f32665472de09934baf39928ec42a9531ef5663f0f78c93168b4ee384", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258517, "uuid": "73c7f0c8-f3e8-4fab-8b54-8395ca91a18e", "comment": "Malware payload (Mirai)", "value": "c6fb196fddb1d240d366ef1970d7f4c143fc361e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258517, "uuid": "54326f05-9630-49fd-a3c8-a907fd97609f", "comment": "Malware payload (Mirai)", "value": "58778c1c506200efd1068d037a665cdc1d1bd8994b7ba7ea51cceb4d25c34d44fdd513f6fce5497e696b0dead4d57ce9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258517, "uuid": "2449ef3d-de5b-49da-9877-fa4c417f99fc", "value": "T1F0732825A9792E26C5D4B27A61F7C221F2E6230D36B4865E3C720F4EFF14650295B3B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258517, "uuid": "7b4133dc-6cc6-4b2c-af53-e7db23710f2c", "value": "1536:N+zAhSRxjKJBI9J7D96yY6vtLlI3tygfQ:4Z3uXIjvvtq9ygfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633258517, "uuid": "2542f1f7-2b3f-44be-ad9e-7dfd18680114", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633258517, "uuid": "34e55336-bb4f-4aaa-a566-7799e91d1395", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258517, "uuid": "8336373e-462c-4a1e-a7cf-d7aadbaa015b", "value": "96f6f940540c06d31582420f1ee6877b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf64eaa6-2474-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633284465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633284465, "uuid": "4b112a60-1c82-49ee-b47d-bba167dd43a7", "comment": "Malware payload (Gafgyt)", "value": "50aa0d5c5b29ad43d93a954c1fbf7dc7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633284465, "uuid": "87affd52-58a8-4cad-bfdb-0f69385f586f", "comment": "Malware payload (Gafgyt)", "value": "7d11c5a3ec87073c138ce2d73de3615024a8c862a79e4b2a678545ad835bd2fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633284465, "uuid": "4d6dc476-1ae1-49cb-a31e-91081f1b2fab", "comment": "Malware payload (Gafgyt)", "value": "319795440d0b9a6b681c0d0378616209739c4120", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633284465, "uuid": "78ffb53b-8201-4647-9a73-e4c50bbb8016", "comment": "Malware payload (Gafgyt)", "value": "7a239ae023b6cfcd86394467f00953868ae1270fd5b0f44d531db3641e8a45b3f6fd510b665cd8cee52558511fbd5634", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633284465, "uuid": "3c201e51-0829-48de-89fe-24f9c3e79d73", "value": "T190820701B993D4F4EA1415B22653CF36BE75F5B6206ADB07CBA1EC3BA420691D71335C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633284465, "uuid": "17ab09b8-d8bf-416a-9a02-8c9a57e8d0d4", "value": "384:fenyF4MrFYT0ZuueAqNDKL1lVs4QXzwrCgM00h:2yFF+8U2lVs4QMrM00h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633284465, "uuid": "7f3837eb-a7b9-498d-881f-b1b0200cb6af", "value": 17784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633284465, "uuid": "923766a6-009f-4115-b89a-02f1875412ab", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633284465, "uuid": "3631091a-91cd-41d1-bf8d-bf86c0ffc32b", "value": "50aa0d5c5b29ad43d93a954c1fbf7dc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "751243ca-2445-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633264127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264127, "uuid": "3e523c3e-e45f-45dd-9188-ae33085785d7", "comment": "Malware payload (AgentTesla)", "value": "24a5ce83181d28d6903d37d1cb42fa1c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264127, "uuid": "e3f84f9f-f74f-40af-92df-bd9668f96a47", "comment": "Malware payload (AgentTesla)", "value": "7d8fca2469b4866bea321dc7d0b7fb963fe885c5c54e3d8fad651e24d7cf17ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264127, "uuid": "5b5316cd-7f7c-45bb-aa13-fd2add517c1a", "comment": "Malware payload (AgentTesla)", "value": "58cf600b97b2f00af1a5aa57356248511cabf938", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264127, "uuid": "8018715b-980b-4481-ac99-ec1bd8b19b9f", "comment": "Malware payload (AgentTesla)", "value": "12325078bea422e31957c5667adb22b4363d406a11f0a8cc6ceef54b5b260f7cc9dfd3e0ae8b3ba3bbb05ab2135656a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264127, "uuid": "d6b64e43-3cf3-4055-bbf8-6c38cd91c3b4", "value": "T1286542F0A143AE9ACA1D29B0033D3DE9F47A985B563EC75BDA91006078171F9EE7D183", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264127, "uuid": "19621434-3313-4687-afa4-0dff35189d7d", "value": "24576:/7nF0UiFDJNZeXJvNoCG6Uic3wu1Nxyuj11lpxLllCb3JkjOSMvDrx:B7lwLgOhOnDrx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633264127, "uuid": "ab2c7cb7-144c-43cd-8023-4ab241d05a6b", "value": 1451207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633264127, "uuid": "703920a8-b691-4b3d-9a45-a31289482c39", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264127, "uuid": "4809cbcc-930d-4cc4-9ebb-14bc66e7b48e", "value": "TURKEY ORDER NO 5645.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523a8dfe-247d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633288121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633288121, "uuid": "b1b4df31-009b-47dc-9f6b-8063f397d9bc", "comment": "Malware payload (Gafgyt)", "value": "01e3aae17ff0c2b476b381317aa7caef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633288121, "uuid": "eb299de5-a52d-4970-a412-abb6b8daaff1", "comment": "Malware payload (Gafgyt)", "value": "7eaab053130b4f0793412c39e1ad2417cbeb35f7b177d8d1a357eb54cb518358", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633288121, "uuid": "060b4ce1-5558-42c5-8fdd-8c5ea0fe917e", "comment": "Malware payload (Gafgyt)", "value": "9797fb7a7e512415a18c7c52593d8f897f05f6d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633288121, "uuid": "4df79983-2f69-4788-aabf-e45690dfe475", "comment": "Malware payload (Gafgyt)", "value": "1e4a70ea80348757e914c8c7fa87db17ea1bb1aeb89fcfcc9dd7fcae2ac2569ba53a8ce40ffc72e5cbeb0ba7ab5b457b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633288121, "uuid": "db445006-93ca-459f-9f2f-a87d4b24db85", "value": "T1D4C32B273B231E23C0C9547102E31331FAB9DB6938B953D7E9D06DAC2F26A943456BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633288121, "uuid": "0b0b5f7b-73c5-485c-af95-66004040afbc", "value": "3072:/YNa/GLBNPoQ5phakniQ9/nYEP/UnSQf/R:6a/yloephakn39/nYEP/UnSQf/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633288121, "uuid": "7c248121-b787-4cd7-959d-d63b06d663a5", "value": 126929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633288121, "uuid": "e93d095d-b515-4f23-8236-ccfbd2cb6a39", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633288121, "uuid": "aa17b6fd-973d-418b-bac9-717d46f0a26f", "value": "01e3aae17ff0c2b476b381317aa7caef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd63bc3a-2445-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633264356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264356, "uuid": "a2dffb7d-7fb4-4ba1-9f16-0719727a67fb", "comment": "Malware payload (TrickBot)", "value": "dbd86d62de3767f089f488e718399c1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264356, "uuid": "18eec727-c419-4332-9925-6e01f65202b2", "comment": "Malware payload (TrickBot)", "value": "7f24588c2d42a6f125ccc6b41da4c6f0000f018553086731f2b823b2fe95cab6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264356, "uuid": "ec7e1309-2c23-4a06-8777-d0f2f3c83d58", "comment": "Malware payload (TrickBot)", "value": "0b2c9a972418cc934ea2603f3456c6617fb8972d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264356, "uuid": "7c662ef6-e61e-4141-89b1-57e0e99fdc24", "comment": "Malware payload (TrickBot)", "value": "41da82e155ef2ebbe6074bc2a5aee5c8334bf269b41577ccffe50cf89e209b4d88c0a8a279116b432f3648d987198d52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264356, "uuid": "90fdc089-0050-4540-869a-a5cdf4c8b75f", "value": "T12B94E02236F0D877C16715309FE59BBCBABAF9104F724A4F33880B0E1D35A525A26776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264356, "uuid": "6b2967b7-15a0-42ef-84c5-66baec8f090f", "value": "220580f49c2724e661575b7bf3bd58ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264356, "uuid": "b58a7b6a-7e90-4b93-b6a9-b98d9fc5b686", "value": "6144:wkdJN4c+ePGcHr1tJ3VQl/XE3dAPr3x7835OPeFPQimA6Vk58qVEb9pE:wkdJLbP5tlCl/XIIx/lbVMlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633264356, "uuid": "bdff4d54-d727-4f9b-b77f-3fb73a41cc61", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633264356, "uuid": "88d7451f-7361-4283-8d6d-cb805806ce70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264356, "uuid": "24488267-2f72-4361-b8bd-3b63dc3dbb38", "value": "dbd86d62de3767f089f488e718399c1c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b299254c-2481-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633290000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633290000, "uuid": "0903bfcf-44ff-4044-8b36-cb4cd14376ee", "comment": "Malware payload", "value": "3ff6093dab1fcb8aea139a302fa81c7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633290000, "uuid": "8f7511ab-bb12-4ab6-a0f5-8014643bf2e9", "comment": "Malware payload", "value": "7fc5854433b6ba7716cd9d6b4923869d716fa6580fae0b0c839e698966982b37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633290000, "uuid": "a221b6c4-07c7-4dd9-a537-adda4899e100", "comment": "Malware payload", "value": "841f9dd1865a74f2b0400f6e117f7e2e58af672a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633290000, "uuid": "4dddbecf-0212-4d20-b867-0cd767fa5977", "comment": "Malware payload", "value": "d51c8842fd8023fcd17d9b586a681d3e759089b4821dc0bfb6a20a594441c1098b473d0119eecc59800866e237ea5464", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633290000, "uuid": "f7c01eff-f808-4982-9c52-a5d58a030cda", "value": "T163449D0931C0C7F3D6760171A796C7F44A2DBCEDCE2E564F2B88A72E2E383D19625252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633290000, "uuid": "08c65e71-cf4b-4bde-9be5-f56bd8d93d9d", "value": "d33805713bf84c5172011e6ee58dcc60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633290000, "uuid": "d1aa5893-a012-48ca-a9af-42d3edb32b74", "value": "6144:O3FuD9LJb2QZS7zp8in3re7M9EROhxxpeTr/ekI:wF6Fb2QZOzp8VEzxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633290000, "uuid": "e3c4f33d-ca9d-46b2-9e57-262a1a95b445", "value": 272384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633290000, "uuid": "1d2d505c-e232-4932-873e-0b2ed28b4538", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633290000, "uuid": "97d03f3c-b788-4257-85f3-783f84a4b1ea", "value": "3ff6093dab1fcb8aea139a302fa81c7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b4e94f-249c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633301355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301355, "uuid": "8f001439-e7f4-44f6-9724-58d3add00351", "comment": "Malware payload", "value": "de1fceaed8679ab748684afaaf7c07f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301355, "uuid": "ce81f150-c89b-4dbc-8e26-06b41cc6b525", "comment": "Malware payload", "value": "82a27f19d5a54d3d8822912eb9c3c179aaaeb6872ccaba66956557cb568c3fad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301355, "uuid": "f9e840d5-a0fd-43c7-ad66-ac5a6e18cfd2", "comment": "Malware payload", "value": "fc5746c4bf9a7d6cb3023a7050357b46bf49657d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301355, "uuid": "366b007f-23f0-4926-8448-1bf8284d844a", "comment": "Malware payload", "value": "10d009feffccf80fa727c8fb3bab8f734c2fb635c770637801b8b67219add28fd27d730fdb900e02995d7510aa77da02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301355, "uuid": "8aea0eed-d202-4917-b7fe-cffbbca34a45", "value": "T1C7934C06F8419753C1C327B6B7CF47093B3667B957EB330266386FB02BC67991A25A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301355, "uuid": "9a6d7177-9942-40fb-8e20-29b24a9eb15d", "value": "1536:ZvgGLI1gX3JGQxPuwjxtOZyl5hXNKV6T/Fo2kjvVqQEqn/lJXCPe:tIHQjjB5hXNKV6T/cjvVqQEqn9JXCPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633301355, "uuid": "e339071c-eb64-4b2d-8fbe-af06a677602e", "value": 96620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633301355, "uuid": "37780c00-ff33-4616-8615-1adb0e107f32", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301355, "uuid": "f531afb8-63b6-4174-b1f3-4a8d74f944a8", "value": "de1fceaed8679ab748684afaaf7c07f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b427be8e-23f4-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633229444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229444, "uuid": "9d5da6bf-fbd6-43f5-88c1-9bfb42b687a2", "comment": "Malware payload (RaccoonStealer)", "value": "490709024fc924ae713612683ba7f9d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229444, "uuid": "78a7f2a3-c571-406f-a6f8-2f48feeaba7b", "comment": "Malware payload (RaccoonStealer)", "value": "832ae46f13fa233c5d74ae6653d3777aca89edcb5858797a092e9b9ca3baf80c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229444, "uuid": "0ad301da-da2e-483e-bcd0-57d304c5539e", "comment": "Malware payload (RaccoonStealer)", "value": "59ea3e2e7ec781ecf4d4b36eda7eab2b1bd11fbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229444, "uuid": "d6b0f202-0347-4e49-a62c-3f2b068d48b2", "comment": "Malware payload (RaccoonStealer)", "value": "ef6d9ad955537778aa7713eec109ffd5cb22d1d007b8bc0a79ce362eb541499449358325b65a361e2ef4085bf0290ee7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229444, "uuid": "536bfc38-180c-4976-81f0-863b07368a52", "value": "T145B4E030B7A0C031F5B712F549B693B86D297DB19B3881CF83D156EA2724AE4AD31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229444, "uuid": "e74ca60b-c5df-4b12-bec9-6291457d40f9", "value": "949cb2a875d86b476d185d15a2fa1cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229444, "uuid": "ffcea422-dba2-45d1-96ca-3bd63008dfd8", "value": "12288:tvaPjEaqjX6fPYTR9U2eR+Q8KQzrOfVoTpiE/y4yOO:0TAKonU2Ir8/iSIXOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633229444, "uuid": "52b97f7f-9fda-4495-9fa5-aaf368929c65", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633229444, "uuid": "040c4047-ae3a-42b4-9217-2cbbf00f93a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229444, "uuid": "3d04e9cb-2d88-4e7f-9709-3f7186b0e850", "value": "490709024fc924ae713612683ba7f9d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab852989-2417-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633244462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633244462, "uuid": "671b80b6-4c8f-4c71-bc1e-6c67384ae53f", "comment": "Malware payload (RaccoonStealer)", "value": "42481d36a70d7d1a21a1750ca2c7f9ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633244462, "uuid": "0cca1bc9-ff35-4efd-bfe3-da41eef32292", "comment": "Malware payload (RaccoonStealer)", "value": "842988b3f7dace3af12d511d8ea57ed26b40e77dceb7556ef4f37c0833bb79d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633244462, "uuid": "5b558daa-4a3b-4973-9a6b-8223c9a280a9", "comment": "Malware payload (RaccoonStealer)", "value": "c7bb81aedc5f55483d5a532b48f6d008c66b65df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633244462, "uuid": "6e8b6f36-7ceb-477d-a2b5-801fe1655778", "comment": "Malware payload (RaccoonStealer)", "value": "8a6c77f805f6544a02224b6054ccca459b9cc27812703b71427fa584e67a8b1e7a6df2769bbf1466e606e6e3cb77df6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633244462, "uuid": "b1ffbb42-e1b1-463c-9a52-37d52ae20d3a", "value": "T18CD4F11831A3DFB1C6B506F16B25C7F0496CBE285C16768F7B9837AE7E3D3819612202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633244462, "uuid": "e71a6199-0018-4e87-9603-18fad0406ea9", "value": "f37786a16a90f8f3f38c22c48ff5cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633244462, "uuid": "4266f1ab-6fd8-4bae-ab66-595b7e451293", "value": "12288:UQ8VulNqHlFtpmnkzaYorJ+A+bIhALfS7DL6g8zxd6L:FBlNqHKk+bKkh1vYL6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633244462, "uuid": "5fd50902-486a-4535-be63-8beeaec80f51", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633244462, "uuid": "bcebc174-b805-4238-8412-5045c615df82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633244462, "uuid": "bc20fe51-3bb5-4a59-85e5-c88a0ad4379d", "value": "42481d36a70d7d1a21a1750ca2c7f9ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aafd8a49-249d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633302013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633302013, "uuid": "c91eb096-1821-453b-b11d-75370830393e", "comment": "Malware payload (Mirai)", "value": "ecb43cb656bb77776722c64ce73fe4e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633302013, "uuid": "ff2632c7-1fdb-4017-8b9f-ee8d1259f21e", "comment": "Malware payload (Mirai)", "value": "858ac079267b4d661a3ba6f9bc69b2af9b4ed207d48b0d10515efacdb98534c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633302013, "uuid": "720d399d-4bc1-4176-a677-76ad48facefb", "comment": "Malware payload (Mirai)", "value": "69a4f0c4b112590f2559973e3309dedfbe61fb29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633302013, "uuid": "af632e21-ddd6-4458-982a-8054d3607185", "comment": "Malware payload (Mirai)", "value": "4e7fcaf4d015a9f346c152505f243ee3df8e0f70e5857d51c3de7ab171cccb90a09c49ed400f1016c61c62db4a9314fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633302013, "uuid": "4ce44473-6d4e-4c6f-8c6a-9ca23599f1aa", "value": "T1A383A20AAF614FF7E89FDC3749E92B0624CD5416219A7B79B974D808F20E24F19E3871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633302013, "uuid": "e61568b3-bae8-4df4-a4cc-e46509d8c45d", "value": "1536:WCdHTb4ob1jz4T+3BLy0u/0NPJwo8KkPaJ7HTvEzS4a94EU:fd6+3m/0NPy1SP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633302013, "uuid": "f89dbd47-918a-4d3b-8f36-82df90f1dd38", "value": 88660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633302013, "uuid": "b8cce125-d726-4058-b122-fa03b72102f5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633302013, "uuid": "fb455cb4-b8f5-4ea4-93fd-0973dcd50648", "value": "ecb43cb656bb77776722c64ce73fe4e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2cc59c-243b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633259921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633259921, "uuid": "7cd92771-361e-4524-9236-4b59b10375c4", "comment": "Malware payload (Mirai)", "value": "157ae09274559a064bb350aba6cc1d2c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633259921, "uuid": "901c1cb8-a739-4896-8c95-b6cf7cfabff5", "comment": "Malware payload (Mirai)", "value": "86f12d70fec8689f457d818ef656aa026343458546bf6c6735164cca6a7cf98a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633259921, "uuid": "0c362b99-8844-4995-b174-6ae6f5b571b4", "comment": "Malware payload (Mirai)", "value": "874acdb5231807c892049aa0197152141af336b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633259921, "uuid": "18152a80-f912-4106-b342-838f6a332725", "comment": "Malware payload (Mirai)", "value": "b311e1b9a3be79daca6cba09a46960f4cdd019651de7bf94b8f9979eee1cb8c4f724d1c01af85c4b2dfc36a50847889d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633259921, "uuid": "53573562-0b3e-444d-8125-5466c63c1a4b", "value": "T155D2E06550D21FB2C264483F8F51429636F10BFEA0EE167A35A84BACD39881DB07A787", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633259921, "uuid": "f181a56b-b4be-4d9d-9b4d-c24955c7c149", "value": "768:lhs+P3bsd2TmokTNDgX0E8/91pvPoAzUcVkeRFR0iz+NZ9V7Jos3Uoz8:o+/bVWyX0E81PnlBF3SNZ9VXz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633259921, "uuid": "5cf77e5e-16d6-4650-bff8-f6dce9d99edb", "value": 29852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633259921, "uuid": "9b62a65c-bab6-406c-8c2a-1201685f6270", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633259921, "uuid": "4ac236b0-5cd2-44cd-81c6-1cad1a2a3b60", "value": "157ae09274559a064bb350aba6cc1d2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c97bd18a-247f-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633289180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633289180, "uuid": "0ad6cba7-a4f1-4d3a-a1fb-4f2f04f83227", "comment": "Malware payload (Mirai)", "value": "a951aed69326c37d8cf26e664c8d7798", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633289180, "uuid": "fdd2da97-ef89-4e09-93d7-32100031cca2", "comment": "Malware payload (Mirai)", "value": "87cd723bee71c959d0c1ab3a4c0a689cd0f7700a975e3e2baa37ab93d2025394", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633289180, "uuid": "2f9ac571-5dde-43b2-b8ef-7febbeee3780", "comment": "Malware payload (Mirai)", "value": "ff97be9b0baa85679956da9fe20f04165e00b708", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633289180, "uuid": "d9a943ed-5d98-42cb-8176-45b052bb823f", "comment": "Malware payload (Mirai)", "value": "f0b395b2b15f390f6ebdf5ea3ca7076409a16208242194d52a1254ccd21830fd2ddae838755133400f2c3d6cce72a035", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633289180, "uuid": "64497b65-f7df-47d8-a38c-db12476d12dd", "value": "T10CB33A57671C0B43C59B9AF52D7737F187ADEA7102E221C1A40EBF801B72A701626FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633289180, "uuid": "b2ac530b-084e-4b6f-8c14-6485c5b99c77", "value": "3072:hHXj8UjfsEsbN7ONRwQ95hnJLfNK62QnI0PDG4gQNcR:h3rjsbN7OYQ95hnJL12QnI0PDG4gQNcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633289180, "uuid": "d5825ec9-5b55-469d-9c90-ff7a2be50d51", "value": 116369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633289180, "uuid": "04c2cb73-2d89-4ac7-8f21-66aa41009d45", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633289180, "uuid": "5f04e5b3-ad99-4cb2-95a9-9ea97a5b9d7a", "value": "a951aed69326c37d8cf26e664c8d7798", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22ca4d3-248b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633294321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633294321, "uuid": "05a7b9fb-a6e6-492e-b87d-8ef53b1ec10e", "comment": "Malware payload", "value": "f508c9697bf14a187f2eb879739ac562", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633294321, "uuid": "8e961f12-7d29-4286-a634-c34867659549", "comment": "Malware payload", "value": "88b500fc1970a2d0b727ab2021e8a6f06576608dde612df11fac4260cb51552e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633294321, "uuid": "b311bcee-125f-4801-b509-05e6e7fb8616", "comment": "Malware payload", "value": "2dbdc2e6467e01acd693f2cdb41cd403db22efff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633294321, "uuid": "a1c9b085-4ccc-431d-9238-fde2970fd468", "comment": "Malware payload", "value": "716f7c1c7d18daabb9cc9a670cd6c37a963d64c6c503679d05e391516b1aad051c4875b4743b074114feeb2acb31c146", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633294321, "uuid": "3981097e-9469-4794-98f6-2a0d8509f183", "value": "T1DE321B00BFE949B9DDBFCB7448B3122296B0CA453515DF0FAD88089D9A27F508D43EE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633294321, "uuid": "2bf91a5e-bd89-4c02-8bbc-000cb8596af9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633294321, "uuid": "d98799da-a1d2-4b12-9b18-8a31b14290a9", "value": "192:qmaPIbmWehhxCq5VPaKX/0E4em27lRybqUQpWbx3cYzVy+Xn3PXT:DdbmWQNPRXcE4eVlk6mPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633294321, "uuid": "4437751e-bb9e-468f-915d-ed463dd11fe6", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633294321, "uuid": "b4e6fcc6-df79-466d-bf88-9ccc0e6156e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633294321, "uuid": "8bf2dddb-4453-4705-9740-2ff197c25424", "value": "SecuriteInfo.com.Trojan.PWS.RedLineNET.2.26836.19647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b80d992d-247a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633287003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287003, "uuid": "c048cf76-0639-4525-9c6a-550021a15411", "comment": "Malware payload (Gafgyt)", "value": "495c762c4afb4931492facedccb46c07", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287003, "uuid": "e2d61888-6222-44e2-a805-44ecde22585a", "comment": "Malware payload (Gafgyt)", "value": "8922a52bb509ab55f801bb31a5890de6c69a9e214078904b3be1995a98aaf908", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287003, "uuid": "463a1912-3a57-4d91-8e5e-256275d033d3", "comment": "Malware payload (Gafgyt)", "value": "9b535f3f464658cd7050ed0017e057acbe68b774", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287003, "uuid": "b12e5024-a93c-476a-8cb4-3510a9f5a616", "comment": "Malware payload (Gafgyt)", "value": "7d0b6c407723de2f1aab2455c5e7f16603db6a74114c2df6404b8cc43e4cf6a67b2a2553f2921f751e2bb7181fce5b99", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633287003, "uuid": "26907977-4c1c-414f-94b6-35c1a4a6e6e3", "value": "T196B36C176692C5FAC08342B92BDBA1618823F67D0B36331773D5BDA43F158CA6E6E740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633287003, "uuid": "e5df954e-23b4-48f9-9f67-f3546aec8320", "value": "3072:Zt2nlia9rRBFZm4z1EYfcbJ8phawruJv03CKPCNVOXinYuM8R:MbVm4z6Ygipha0qcFPCNVOXinYuM8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633287003, "uuid": "d3518fdb-0292-4e84-a276-9424175cc1a5", "value": 112336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633287003, "uuid": "54e69cb3-36e3-4358-88d6-291a6439c049", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633287003, "uuid": "04b97d3a-987a-46ee-abc5-f98ea93ac5cd", "value": "assailant.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec3ec116-24a1-11ec-843c-42010a9c0014", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1633303841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633303841, "uuid": "fc0ce89d-e831-469c-94bc-c7f2a88cd688", "comment": "Malware payload (Gh0stRAT)", "value": "7448f07e20cc2a5e59ce8de6d88a3241", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633303841, "uuid": "ec92b850-aa71-4451-b276-8c9593573e37", "comment": "Malware payload (Gh0stRAT)", "value": "8b79dcff7e5007961448d9baeb7fa7ef65c399166b5250c982084b22899466cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633303841, "uuid": "120a36dc-f071-4757-a904-b8a37154b9ac", "comment": "Malware payload (Gh0stRAT)", "value": "1655c29315145cbd4622c24f268245490bba069c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633303841, "uuid": "a9406927-3815-4d0b-8f06-dc4a4aea956a", "comment": "Malware payload (Gh0stRAT)", "value": "3cdd8e47bbe7928c5972c853e19b679e57ad22cc05d4db33902e88d32b618bff0cde5b4ed962a309c27d8f5fc8ef0418", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633303841, "uuid": "40b50499-4897-48e1-8a17-fab09aed30af", "value": "T1CDD3AD9EE0415F1BC232D1BB0ADF9935BCFE43BF8E915B0737652853AB80546B02915B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633303841, "uuid": "2b3b14bf-5de3-4cd1-88f4-63cd3e4e8bd2", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633303841, "uuid": "0727310c-8d3e-4918-927a-00926d8a41f1", "value": "3072:ALk395hYXJ3kN+4EyCDgPa9tG9Xd28E/vgJ8u:AQqRkN+NyCsi9t2CvgJ8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633303841, "uuid": "4babe2b0-4009-4441-9d73-469abda7cc29", "value": 134753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633303841, "uuid": "840dd42e-ce08-4b9c-8c1f-4f2ce49cb7cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633303841, "uuid": "74d06d57-0053-47c9-8d2b-3749774fb89c", "value": "8B79DCFF7E5007961448D9BAEB7FA7EF65C399166B525.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b70acb32-2466-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633278411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278411, "uuid": "83bb2e43-19f8-40fa-86f2-7d43a90055a5", "comment": "Malware payload (ArkeiStealer)", "value": "d01b6855b2fba0679d29038f0c5fa8bd", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278411, "uuid": "86a3c7f0-6567-4796-9cca-2d600e654ef9", "comment": "Malware payload (ArkeiStealer)", "value": "91b65e855c866100ac6e97540a60c80f64710ab9777b47389c08cda93461a916", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278411, "uuid": "52052ee3-7c4a-48ae-923c-5f35c254872d", "comment": "Malware payload (ArkeiStealer)", "value": "8bc8341de83c73ad687d903635580feb51fe585b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278411, "uuid": "9f74f947-6e3a-4a8c-a7fa-c266aac72614", "comment": "Malware payload (ArkeiStealer)", "value": "97011b1ab06ae23ef015b17b3981d7671745a950d8cc90b9b1b42d8cfd4cf7ad5cb58547984cd8a248e9ca4a8d50092a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278411, "uuid": "e1887a40-b877-4145-aad3-f8bd57bd2f11", "value": "T1B3F402193181C7F2E370023AAB16C7FC196DFC6D4E59A65F2798275A1F3C3939A21392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278411, "uuid": "ec159ddd-3c06-42a6-ae95-62196e47b8ab", "value": "d33805713bf84c5172011e6ee58dcc60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278411, "uuid": "d9ef860c-853a-43d1-91dc-8cf73bcba2be", "value": "12288:pwfHgOMbeRs2mVZ+p4viQlJ8tLoq1IFeBWq7OrJ2O26zwZzxp6L:pwInb9Pb+p4viQlW5oq1OO24+a36L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633278411, "uuid": "d8fdb6ae-dad8-465c-8048-aaa7800664da", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633278411, "uuid": "60bc7286-11bd-476c-b575-d9ed667ba37a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278411, "uuid": "a442f1e1-ccf2-4a43-978f-0f3bbfc6b9bd", "value": "d01b6855b2fba0679d29038f0c5fa8bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24240dc5-2472-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633283319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283319, "uuid": "1f030419-b033-4678-8ecd-188727258f8b", "comment": "Malware payload (Gafgyt)", "value": "ae9b1359d7181c6fde563ddc50e6b7e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283319, "uuid": "a4fe2e56-5baf-4a7f-a839-984a0aa674da", "comment": "Malware payload (Gafgyt)", "value": "9217f19e2a872f961eee565cda40e8d5bc13871106f1601b3b0a08e64e23368a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283319, "uuid": "d2dfd54a-4287-40f7-96cd-30cbbb4a75b9", "comment": "Malware payload (Gafgyt)", "value": "e745ccc18eb152d1734e89dd4b2b10d7960eec18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283319, "uuid": "6abc85e6-8a1e-4633-b565-152a49baac51", "comment": "Malware payload (Gafgyt)", "value": "974bfa1304c473d5dade03871406219b5e5dd5ec3194991b55ce31f210f65a5a3b14c9f425c0d066912ae5ba950066e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283319, "uuid": "8eed9f3d-2b4b-45fd-877c-6fe69b3ff599", "value": "T1B6C2525E2E225FECF718853956B34F70A35933D622E5E784E26CE8040F7424E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283319, "uuid": "22b5455b-e8aa-4665-8aa6-d1782ff84334", "value": "384:Cpy6uHasHZLahgWIA59XQMqHBPHV6bbGyZM6GVrPyExL9gJGDac+0ED:Cpr4Az7ay6yZdOjLgOcnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633283319, "uuid": "7b4f5bb8-ebbd-429d-99f8-6a38cb0e0826", "value": 26648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633283319, "uuid": "a093ea5f-7330-4bbe-801d-ebc76193f9f5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283319, "uuid": "7034655e-abda-4fc9-9146-6cb1a6392e8d", "value": "ae9b1359d7181c6fde563ddc50e6b7e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80376d5e-247a-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633286909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633286909, "uuid": "4d4b05f2-b22d-4c0b-8769-bc6d7ff586cb", "comment": "Malware payload (Gafgyt)", "value": "ee1beb42fcaf09dae9896b3b1bb7f57f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633286909, "uuid": "bb96b656-92cd-4d8e-9a19-7a48c76b2fb5", "comment": "Malware payload (Gafgyt)", "value": "9596b66c64a75a02af5f516dbe19ab271b59cdae7de397880959bc91238e9f26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633286909, "uuid": "ca6e643b-74cf-441e-a636-fd5d81a3dbed", "comment": "Malware payload (Gafgyt)", "value": "b38aad86354d77662e981759bf5037157909934d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633286909, "uuid": "9e10be7d-dd72-4875-a26e-b5bd84377fb2", "comment": "Malware payload (Gafgyt)", "value": "c87a72c61099fde5165a6678de55a3528812513df2efd91d1bcea3b3caf112b7a09fef676e6a5db0e26f645e2806b433", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633286909, "uuid": "90cf8588-5fdf-4aad-99fc-64a1ea0d7ba9", "value": "T156D2D61B95F99CFAC298C039A87B2149074FC761FB1E049325EE29131A2F68C4B6F71D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633286909, "uuid": "e9765baa-9db9-4b6e-8d42-8562e8a93e53", "value": "384:gSlZxQex0l5HcYeTdpUXQwHV74kpSck7OwFVqNpBJL:BXhx0l8TdpUX5V74QTrwFIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633286909, "uuid": "13cbaa4b-bba4-4783-a691-1aabc01e73ca", "value": 29880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633286909, "uuid": "39e423fc-c89c-4a18-ae5f-fed8ea5919f0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633286909, "uuid": "1cceae6a-a549-47b0-a13d-e98e0d93554d", "value": "ee1beb42fcaf09dae9896b3b1bb7f57f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c1bc3e6-2474-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633284218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633284218, "uuid": "9de92da2-94d3-409f-8482-ccc8511ce49f", "comment": "Malware payload (Mirai)", "value": "637208092cb89d9af1b42e06f4408e8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633284218, "uuid": "6ea212cf-77a5-4aef-bb7a-db5e71e2b9a4", "comment": "Malware payload (Mirai)", "value": "95cfc51db1961abee19744f3ec06664038fa0da681a1a7948c13c357398fb62d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633284218, "uuid": "b4c9ae19-41f7-4d5a-b4e3-67e276a14a6f", "comment": "Malware payload (Mirai)", "value": "aa53c2e2abdd39d166157cef51f09054ed342891", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633284218, "uuid": "854306fc-b0e7-4182-ae04-f8ac4dbe4a59", "comment": "Malware payload (Mirai)", "value": "ed399092bb82c97211aafb4fa0c8e3b74faa510d187f4f89a6a56e85c7b0759f24741b7760c6097996a0856c0acc8b5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633284218, "uuid": "356480c0-ca51-4f2c-a7a7-3e8ca017f9d4", "value": "T120B229B1EEA3186BC4C5877651F6062CFAF6835F58B84F2A3D630F49AF04A4059476B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633284218, "uuid": "2367ac6e-2e5f-4892-bfc4-24fd89fe7d64", "value": "384:zRH/L0uquHwmwHI43Ags94XSBZIfHFU+ppi:F/whHI0Ags2XSBifHO+/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633284218, "uuid": "eb31dff1-a226-4230-95a1-ab8a5e588c02", "value": 25132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633284218, "uuid": "a45a2aa4-63e7-4ffc-88a7-38fdc64d3775", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633284218, "uuid": "2e9c241d-cc7a-41f8-868b-6118fb8132ff", "value": "637208092cb89d9af1b42e06f4408e8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aee4cdf-246b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633280431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280431, "uuid": "eb11ccfe-eeeb-491a-9196-57e20b96f351", "comment": "Malware payload (Mirai)", "value": "5e2fe5ea36e947505daf171fe07fe53a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280431, "uuid": "af3ad899-b419-4b8d-883f-c61bb7bc5bde", "comment": "Malware payload (Mirai)", "value": "96ff6c3553e2686cce20f2ebeaee024911660b372087fb06181a70191c5cc157", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280431, "uuid": "7b64fcee-035b-49a6-a268-26f73119c3a5", "comment": "Malware payload (Mirai)", "value": "3e001190262b6d6641d84d667062e318417862f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280431, "uuid": "45657500-944c-43d0-bb94-63bf6acea617", "comment": "Malware payload (Mirai)", "value": "765d33b674ed1fabf70ee9644148fe1dab5006f291e51258d4a10ff23b59631779206d1f8089f89b0e58c2010e3b9ab0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633280431, "uuid": "17ee9612-4bce-4cb4-865e-2f67da4cd79d", "value": "T140D2E114D6DBAD75D8C01030E7088B8A37F706F6C0EA73722D61966CF7D1911AB7C69A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633280431, "uuid": "d731d9f0-3462-499c-b696-c916304fae44", "value": "768:l/0K3nwOPE/MD8ec6y7FGEBrykT1ieDW4QoiRhLFqyels3UozD:lMKXwOFVYFFxi8W465dzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633280431, "uuid": "778d07f5-b384-4ca3-8658-0e3b3151e1da", "value": 31100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633280431, "uuid": "9d7a3133-8e41-4b2b-a7ca-cc5bd96e6761", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633280431, "uuid": "e141be1e-638f-42dc-98d2-694c3578168e", "value": "5e2fe5ea36e947505daf171fe07fe53a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fbcc099-2438-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633258535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258535, "uuid": "74bf088a-e552-48a9-8028-02c8e0a08d30", "comment": "Malware payload (Mirai)", "value": "500a06509d404aaffc05ff81db240ea3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258535, "uuid": "0d764322-4f2f-4c88-a0d8-08bf9bd0da92", "comment": "Malware payload (Mirai)", "value": "9810fc44d7ce87d905ef8200526def54f674eb58fcfd1a33cf381e0f3f03ec74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258535, "uuid": "9ad00aa7-be80-4b8e-b27e-91700b78f57d", "comment": "Malware payload (Mirai)", "value": "cfaf0a996d47d20b904d3d310bcef9343e25e6e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258535, "uuid": "2ada7651-2b01-477a-8e25-78c41623d0cc", "comment": "Malware payload (Mirai)", "value": "117745a5771bbd1fdc7042233461e8f1729001680707f299b98cecc31ab88a101ffd3182f2d2f26cc1dbbfc476e13933", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258535, "uuid": "caf0cf81-e57d-4741-a98e-4a8495b8488b", "value": "T15CD2D016A3112AEFC659E5F80F880B1517620FB76EDF294522D9CF27EC9E16035876C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258535, "uuid": "7c192f19-655c-4571-9362-662430088c75", "value": "768:OVIGbWZQ7Qgbk3Br3GYTdi0dNSRx747N55JgGlzDpbuR1Ja:KIGiZQ7Ql3Ba6i0n0947NBVJug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633258535, "uuid": "6fcc30d4-1880-4a74-ab64-12e3d27a5fb5", "value": 30980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633258535, "uuid": "3acf2051-f733-4247-85fd-eaf595f7650a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258535, "uuid": "ff8ea9a7-17bb-4726-b575-31300c36e6e4", "value": "500a06509d404aaffc05ff81db240ea3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aeec8c3-242f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633254688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633254688, "uuid": "a0c33ab0-dff5-47a0-a67d-139dcbf87350", "comment": "Malware payload", "value": "b6af0517d80a8c5e962674bad3643c3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633254688, "uuid": "fff06fe3-4617-47d1-90d6-c4af51284c0d", "comment": "Malware payload", "value": "9b8c70d1c0537d946bf7233df72a7e0ebdff2cb70404a69ee6a2419730973462", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633254688, "uuid": "4d87df2c-5ad0-4e4e-a581-04e137a29c00", "comment": "Malware payload", "value": "0c719e9dd9a9c8f903ffd521fc8e3381e71dec08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633254688, "uuid": "da705364-5f8c-4531-96a8-b1be2f7856a9", "comment": "Malware payload", "value": "2345059175ef68e55e3afcba739d3398f7bdb27616038c06dace1ca36b23414f4217e05d7420c09c681142a906d6b8ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633254688, "uuid": "08474403-2444-4891-bdc8-bee96fb753d4", "value": "T12B95337D4A3BAF70DAC290BF98D908768C6464B29FBB0712252BFFF06165E14D48D790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633254688, "uuid": "2e2a6446-dbab-4d64-ac7c-722838c3c440", "value": "27516fd8750f40bdecf52a1420a0296a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633254688, "uuid": "383425f6-e309-4733-8807-6eb96f00c418", "value": "49152:YGE8qDJ7hmOWOZjcgOVDf8wLrcBPbl5Fv/V5AClyBBSQZH:Y9eYZjctFfyP53ZMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633254688, "uuid": "b5b4c6a1-6497-4890-9268-b16c69eaed29", "value": 2034176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633254688, "uuid": "bca34e73-7648-40cf-8498-ffe4586c152b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633254688, "uuid": "bead5325-cb44-4b57-807e-0f6eb9a2109c", "value": "b6af0517d80a8c5e962674bad3643c3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d88d00-23f4-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633229450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229450, "uuid": "25a6090a-45e2-4e45-a0ba-78252b9ce647", "comment": "Malware payload (RaccoonStealer)", "value": "5a7465b6c29dfe3bdb462fcf2eab23c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229450, "uuid": "e1d94d24-a09c-4f71-b5b3-aa20f2337aa4", "comment": "Malware payload (RaccoonStealer)", "value": "9c1bd729a791c52aef604e683c45cecffb91b1f397055e2adf10ca78c969c2a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229450, "uuid": "ab54084e-4f34-4d73-8783-805feb0b0fc9", "comment": "Malware payload (RaccoonStealer)", "value": "890100edd35632c3c6c30b64b2a25d1e292c7d78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229450, "uuid": "51118a88-69f1-4447-baa3-4cfe34f43b7a", "comment": "Malware payload (RaccoonStealer)", "value": "a09e35deb3e99495625aba388732896dc60e4d2c26024dc80dbc4df42e0aed462cd8a83210650357cca83b1d10dc0de1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229450, "uuid": "27be9d4d-8a94-43e5-8bbc-f3203775c86d", "value": "T12CB4E120ABF0C034F4B712F549F593B8A92A7DB16B3490CF53E95AE956386E48C30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229450, "uuid": "d09c5dcd-8419-4925-9f07-8824b4d5a962", "value": "949cb2a875d86b476d185d15a2fa1cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229450, "uuid": "d25d05b4-c5a5-4bc9-a91f-30e0c835f443", "value": "12288:khkPsIjAZH8hR8X2HTRloK7uUihc032dgXNlYBADZC4:jJQc742dXawwlYu04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633229450, "uuid": "86dd56d5-f73a-46a3-a506-8859484f8953", "value": 522240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633229450, "uuid": "bb2d5798-3bb9-4422-9087-c4bd8a95acca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229450, "uuid": "a7ec171e-dbe1-42d4-aaef-6b8e2f2be1bd", "value": "5a7465b6c29dfe3bdb462fcf2eab23c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d103f8d6-249c-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633301648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301648, "uuid": "89fec0e9-58c1-4bb2-ac03-f2830d341e53", "comment": "Malware payload (Gafgyt)", "value": "ba6f2711c81d912ddf6f5718ad213147", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301648, "uuid": "2120c8eb-7d0b-4873-9afa-cf1049d80ed5", "comment": "Malware payload (Gafgyt)", "value": "9c7a37e000aea63c746d2527ddac7756848449934e8d09abc0888ecd0dc4a5d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301648, "uuid": "c4ef6584-1e54-44bc-965f-193dc95c2b79", "comment": "Malware payload (Gafgyt)", "value": "3077eab6e828009454754d7dce19f67ac4a590f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301648, "uuid": "7a764c99-d3a7-4ccb-a992-7361e79f7198", "comment": "Malware payload (Gafgyt)", "value": "0d055b5fbd59c9ae318f3fdfa186cb75f1be0cb33cad7595d032ee34564b7cc64ca12036421ece3879b683dca7fb2c8b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301648, "uuid": "d2ead1d0-80dc-4193-bd84-a654d098729f", "value": "T185C33B06F5108753C1C2177AB79F561A77232BF897DB3312A6247FB82BC279A0E39950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301648, "uuid": "50528bca-f830-4ca8-b1a3-de650ea9799c", "value": "3072:idwracAAviNmLpMQ1xd5hKHKSrbqlAdmyDQUJ1UX4Tn:SwraFgikxd5hKHKnlAdmyDQUJ1a4Tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633301648, "uuid": "15b55cfe-9c77-4e8b-b694-1fe49f1b4f32", "value": 118932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633301648, "uuid": "3e96918e-7571-4d9c-8f7f-b82f16f9f5ed", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301648, "uuid": "2b2eb12f-b9ae-484a-bd57-1e74418c4fca", "value": "ba6f2711c81d912ddf6f5718ad213147", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80a8456-249d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633302008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633302008, "uuid": "cbf0c843-6b82-4234-8d93-20b5394c6f77", "comment": "Malware payload (Mirai)", "value": "bbe37ec268f6c7748220c0392323f166", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633302008, "uuid": "d05b212d-32a6-45a2-8e4a-b0244003885a", "comment": "Malware payload (Mirai)", "value": "a035629b3ded81c4905c39e0b92023410058c34e6ddbf8e1f32ffb04f1b2122d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633302008, "uuid": "bbc5c2a7-6f4e-4f66-bcbc-812bf8413587", "comment": "Malware payload (Mirai)", "value": "baca9725e78676e99c2bfb5ecd89648ffb768941", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633302008, "uuid": "866c2a2f-3017-4330-8edc-c70a75142ef8", "comment": "Malware payload (Mirai)", "value": "730efe5ef062a1ae320c842c0b92163d59acd0f3680e85260d89c99a260bafc0cf799819d47072008218c5016d6d96fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633302008, "uuid": "bae8855a-5309-45a4-9188-8b7a6b2ee4e7", "value": "T13D33198E64112E6DEAD66CF950A64F0ADD441220B1A3171FA3FEFDC33933368EE51949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633302008, "uuid": "7cfa7aac-514b-4a60-8fce-67238d108713", "value": "768:KOEBC4hP0J4suEUuMK0yer1gRu7Y+YxZWCPWjm/iJ7QIQm+f1prr/boxZ0eL0m:xEBCQhsnUuMKFIYZRC7QIXg1pokm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633302008, "uuid": "08e93005-008f-45b5-a637-1166a5e0c771", "value": 52780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633302008, "uuid": "0a73621d-37b1-4440-a2a0-1564946a3896", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633302008, "uuid": "57f6319e-fb81-4542-aa98-35332bb9c92e", "value": "bbe37ec268f6c7748220c0392323f166", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794b791d-2415-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633243518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633243518, "uuid": "0336033b-e1fc-4a2e-a811-4edd3cf50da3", "comment": "Malware payload (RedLineStealer)", "value": "e4fccb0f01fcfeb171b3783ab094f21d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633243518, "uuid": "4ddac543-7bd0-4fd8-bf0e-e2aa9ec0fa9b", "comment": "Malware payload (RedLineStealer)", "value": "a19c6c6ababd9decea2b6b842586a9e17b55554924a0e9a29f8abb7bd7b4980e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633243518, "uuid": "eee12be8-e4ec-4c01-84f5-a15ace1c7117", "comment": "Malware payload (RedLineStealer)", "value": "58a1f244347f104e4ec803e8e7332a5eaae55cdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633243518, "uuid": "ca4a5b5b-5269-4ef7-9c46-b80ed95d8a5f", "comment": "Malware payload (RedLineStealer)", "value": "b5837dc951b3a84dae0f8fa3f5e4307248928e3770efe2c612cbc8b7c7ea0a8bccc1e5e4ff709a40b1820e068c1e3183", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633243518, "uuid": "73285c52-8fc7-4119-9858-c8d790fc8240", "value": "T1AAA4EF28687FC019C5E3EEB52DDCA8BAD99A55E3640C703701B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633243518, "uuid": "35dc3285-30f5-4ae3-82a5-7cffc432d37d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633243518, "uuid": "56df68a0-3f36-4b48-b26f-391261499c9a", "value": "12288:e8klT97igBMJM8Ajhq/dK98KGa4YR1HK53f8hit3hDyYhE:eD7jhm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633243518, "uuid": "ffe9dacf-7986-4a93-a974-bbc5780bcc95", "value": 449832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633243518, "uuid": "9e3816bb-d987-4864-b433-25053a28ad7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633243518, "uuid": "651a2dd1-a67f-41e9-9a3a-49c8e2eecf97", "value": "e4fccb0f01fcfeb171b3783ab094f21d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad001983-23fb-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633232438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633232438, "uuid": "f575590d-a490-4119-af6e-51c45d2698ba", "comment": "Malware payload (RedLineStealer)", "value": "922e58fed94bf67d74276fa38aede439", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633232438, "uuid": "2c26f644-2371-422f-b60b-96c97cc0ee46", "comment": "Malware payload (RedLineStealer)", "value": "a1b29584402503925406ceeb5be6a463eea7755f401e3a2c8f82ae3897e3820a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633232438, "uuid": "fc0e1303-b486-4d0a-ad2d-94717967b2c1", "comment": "Malware payload (RedLineStealer)", "value": "bcdc607d558a78c569e6e19106715fddc2b36d2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633232438, "uuid": "efd942b9-001c-49b4-8833-4cb174c4c74c", "comment": "Malware payload (RedLineStealer)", "value": "7ce4bd6956860782758be3b279b4bddfec5908ef99c39c81cee383d7367879079c3d597a262d0c66e3a0a126017a9742", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633232438, "uuid": "e99fa406-6c15-4e1b-a764-ffc8bed9b35d", "value": "T1B8448D30A7A0C034F5B752F949B593B9A92D7EB0AB3450CF53E126EA56347E49D30387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633232438, "uuid": "2e1a0fc1-caef-439d-bc44-40b963ec43c5", "value": "949cb2a875d86b476d185d15a2fa1cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633232438, "uuid": "ef8e9d41-dd3a-4bc1-9a23-ac77b3905901", "value": "6144:nv5/RGQvnD73OHiMnlc5EjbvCffSvAzqF+vCKuU:nx5PvnD7+HzyEjbgfoA+FyCKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633232438, "uuid": "d6444eb6-3b00-444c-b31d-c87f4f2f1c6b", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633232438, "uuid": "c0b1e93a-eb9a-4eef-a5c9-47133ff6fea3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633232438, "uuid": "573857fe-2ec8-4600-aaaa-6bf7abfe3571", "value": "922e58fed94bf67d74276fa38aede439.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a74decb-249b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633301073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301073, "uuid": "e8274e6f-0100-42ae-aba1-f5d44c3c2864", "comment": "Malware payload", "value": "f96dfc5ad86275ae9bc0c532f881e183", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301073, "uuid": "22418ce8-d694-4dfc-8d37-181cb498a5b9", "comment": "Malware payload", "value": "a2f89bfff46acc98334846bb8a79074e11f8d4fb65bdaf971cd67b89b735c7b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301073, "uuid": "64eeb60c-6551-4516-9539-e072f7e7e262", "comment": "Malware payload", "value": "d3ad142fc93968f53aab022db69bd64eb5f06da1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301073, "uuid": "e3e43b6d-c9e4-4588-9588-d7199082b529", "comment": "Malware payload", "value": "61427cf06d2f618c02f60ad0b70dce3720fbf465dca776556ab0ae0a1bb2c2cca890629f2eef371c28d8f51f2fe51856", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301073, "uuid": "7d8d76b9-bc69-444d-a511-5807e2fdf562", "value": "T14C74E01D36A0CBF2E67312357B16C7E4492EBC5D4D69528FAB8B271EAE3D391D610302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301073, "uuid": "5b65b2d9-ea9d-4e93-9234-09d61e104eae", "value": "c15bb6cf111ec297d5d1e54944f0caf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301073, "uuid": "72a87021-e3db-43e3-83f5-c8ffcfc52639", "value": "6144:smXba41L/cYh83wRjsWpIbYla3p2hGlHqDfT/y4+ROhxxpeTr/ekI:jXbauIYhJRjsMm3p2YlCfTxzxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633301073, "uuid": "17a41052-8ae0-4867-adee-1fdf09f728ed", "value": 365568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633301073, "uuid": "ae509592-d948-47c6-918c-02cb65b7735d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301073, "uuid": "1b1e52ce-6b73-4716-bce1-b7b26161155d", "value": "f96dfc5ad86275ae9bc0c532f881e183", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6784a259-246b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633280425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280425, "uuid": "240f8873-725a-4943-a162-6ad50006e296", "comment": "Malware payload (Mirai)", "value": "6439df5a9c677bb7bb5c061a812e3685", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280425, "uuid": "d5108514-e9ae-4a95-8039-882296b6cc38", "comment": "Malware payload (Mirai)", "value": "a76627f9aef2cbfb003942c523ea48415b60b7265fc61c8e0b0a61b5b6de376a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280425, "uuid": "e1d48474-1ad2-474d-9c7f-d63013ad567d", "comment": "Malware payload (Mirai)", "value": "58d09e8d0601fd5de9dfb00e3bd0dcff45db1972", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280425, "uuid": "9f13e452-2292-4017-809c-b150ada6112a", "comment": "Malware payload (Mirai)", "value": "4415e89b1d69776f5aa6bbc0b0a92606c074190f88e2c8eec7a9b2458aab4928b5058c196716b5f862647ff2e5cf199e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633280425, "uuid": "8346b3b1-6a61-40e1-85a6-e051a5f4c0d3", "value": "T19CD2E16A1495C92FD87C827B6FD7AF1960B60C8D9A0FC25398C9A74E5EC30E0B634E15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633280425, "uuid": "f557579e-8abd-4b1e-878d-792f8a92b555", "value": "384:MXkzON8UBTjnixQfjmwlAjC3SaYpdGgPRGILMth0bfkpsbqrOh6yV5+h9v1RD8:jzW8UBTjiarzxChpogPxM+VbRh6+5sA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633280425, "uuid": "4fd751aa-4345-4ceb-894c-f232960265d2", "value": 30852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633280425, "uuid": "8dbc1088-dc22-4b37-9371-1ebb4ba746d2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633280425, "uuid": "5e035f09-3ee9-495a-8110-9837c7b7c033", "value": "6439df5a9c677bb7bb5c061a812e3685", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73db285c-23f9-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633231483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633231483, "uuid": "74b55869-9681-45ba-8528-aef6c4c911f2", "comment": "Malware payload (AgentTesla)", "value": "c56e32027ccd7a04db2cb6ebbb39bcf2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633231483, "uuid": "3c7d4265-ca1b-43d4-8a79-f6387899ba6d", "comment": "Malware payload (AgentTesla)", "value": "a7dc1b812cdc25fb3eb7a0e8e9e32e75a395b35621ac0f743cbccfaf1da56b51", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633231483, "uuid": "728aaa02-3e01-47f4-9c49-4ced2d7687c4", "comment": "Malware payload (AgentTesla)", "value": "36615574cd8728ebffd48a89f39760752451bfd4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633231483, "uuid": "a65ec933-dbd1-449b-8a3d-4817e43e7ac7", "comment": "Malware payload (AgentTesla)", "value": "736aa4a40b752a2436f5f56820c8cf52a9b0233c0cd20276e0d3286bc19a718b82bc277c182083cf1b562f5abf25a138", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633231483, "uuid": "c9c7208b-5118-454f-b8cd-3ea455fc6edf", "value": "T1D5E4D0E262170296EE2947F168374C8517B7BD3E7D70F52C1D9AB1A60B733A3016AC1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633231483, "uuid": "3c796820-871b-4bf0-a8e8-e8b86e3fbf28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633231483, "uuid": "891841ef-c2fb-4610-9db6-c7b44cd7e86b", "value": "12288:TRP56V86cnMH/1+UOoiXCjuQ1/9+x2bJrk83MqPIrRN:R56VKSN+7DXiuQmA1rkWQrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633231483, "uuid": "7a1ad0c3-19ff-45ba-98c5-f6dada82c8f7", "value": 695296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633231483, "uuid": "05b743e9-624d-4d22-a51a-06d55d7ff097", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633231483, "uuid": "612c1d69-3bab-492b-9f13-4e8051fb81c7", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5303a5-2467-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633278606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278606, "uuid": "03c4672c-1784-4110-ae6f-a349f51b039c", "comment": "Malware payload (RaccoonStealer)", "value": "b05c52d24b7a81b302be0c380512282a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278606, "uuid": "bc779003-20bb-45f2-9b60-8aeada801f3d", "comment": "Malware payload (RaccoonStealer)", "value": "a95df870da90caddc739ba5c272c1f3db50fa8f7671a399abc7f0bb84a15b8ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278606, "uuid": "cceace5f-ffb2-41ac-874c-fbefbeed1335", "comment": "Malware payload (RaccoonStealer)", "value": "d030ff53e5b0deefae8242759c54c8e9dde53630", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278606, "uuid": "842b2abd-8fce-4318-9183-1b616a185187", "comment": "Malware payload (RaccoonStealer)", "value": "bd8a6622e45a7c4ad3a0ab487dfbc6e4ddd670ac9e45ce5d9e8ea47c438c7215e8430b0144951c3bd034440ee3c5c3a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278606, "uuid": "ba4c7760-7ab8-4b62-a012-702201e5a985", "value": "T1BFC4F11931B0DFB2D5F546F1AB66C3E4446DFC688927858E3B98BB2E7E3C2905321346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278606, "uuid": "9a7ced96-bf00-4200-8cec-a571317c9c75", "value": "e1dc734f9d3fd8ffe237c21274508ba5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278606, "uuid": "76d1b451-02ec-4f62-a184-825429d246c5", "value": "12288:9FJDQfnW7LI7lfHKQi8cHOLPI+cx13s9Xpr36xX1DFTzdL6+zxF6L:9v0PW/Idk8cawRxF2WX1JTzdJL6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633278606, "uuid": "d3a9d652-fd1e-49bb-972c-855c73015912", "value": 585216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633278606, "uuid": "237dc8ff-a6de-4990-855f-c1e06791cc53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278606, "uuid": "e4c1ec3e-f1e5-4afa-85c9-d7416ced8e89", "value": "b05c52d24b7a81b302be0c380512282a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf4fcdc-2445-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633264218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264218, "uuid": "7020b57e-f551-41b1-8186-f38e4f9b5670", "comment": "Malware payload (AsyncRAT)", "value": "c7124bd2c9f21c379d73cda731cbee70", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264218, "uuid": "aa9b5ec1-d677-4830-a16e-22a9dfcedc8c", "comment": "Malware payload (AsyncRAT)", "value": "aa5cc189a5088b12e88827e19f0505fd4b51212151b54957dd5551dd0494c393", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264218, "uuid": "16501a60-3e54-40ea-89ee-485964f119cf", "comment": "Malware payload (AsyncRAT)", "value": "ce1c0da7db0b74db37b68251aadcfd8e639a80ff", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264218, "uuid": "11d539d0-f670-47ec-a04f-017ecac86a55", "comment": "Malware payload (AsyncRAT)", "value": "1a9cec63c63d9684ce7507c6e60467c64fb2f739c7a791523ae8d8ba576dcd1226d60e73bb9d6457d727c39b1a40cc02", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264218, "uuid": "b92748df-b2f6-4691-b86a-2442ba6f163a", "value": "T19B05F1705613BEA6CE3C0B78945518B0CC941FDB41B505A4FF68BA65FCFA231EA6C0B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264218, "uuid": "5e68866b-ec9d-4480-868d-22feddcbf83a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264218, "uuid": "611960d8-60cb-4b42-a4cf-d14197ef7b07", "value": "12288:fxLPH+cVARznabPI1Ngv6rHBFlhXNKXf9rujfd8EcMsvTH+Uptv8oNRBTxwmBt:fFh2zaU1q2BlUf9ai4SHp6obX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633264218, "uuid": "0bb47435-2149-42dd-bbfd-a8037fa3fef4", "value": 844800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633264218, "uuid": "d60499c8-de09-4394-8719-8a2e79c583ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264218, "uuid": "9f4808d0-0af8-45d4-9ae8-0c92e3d957e7", "value": "c7124bd2c9f21c379d73cda731cbee70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ffb1a9f-2472-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633283285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283285, "uuid": "20aa1666-72a8-4749-865d-529adebf132e", "comment": "Malware payload (Gafgyt)", "value": "a530906d8ccf9d3de4d94282fb0221fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283285, "uuid": "2569eab2-5502-4b23-9179-152488b9508a", "comment": "Malware payload (Gafgyt)", "value": "ab45ff14ca00b8b73a347a87a2525f07991b443cae9e232c5b24924c8f1e7ee8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283285, "uuid": "3c15940f-8982-4f71-8e3c-b2e62c44529e", "comment": "Malware payload (Gafgyt)", "value": "0a8c8fb058f2e99af1af04e97f3a3f4e2b27b736", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283285, "uuid": "5f70f21a-fcba-496c-a5a0-a0abff1bfa97", "comment": "Malware payload (Gafgyt)", "value": "2d439fdeaef97b91e9e00e16785f43d0929d222914238154e3b6ee829d9662f6467e38b705fcbe214916facec5805ed4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283285, "uuid": "280cfbcd-a3b0-443d-9c2b-fdc813a3dfb0", "value": "T137922BC5BD45C905CAC4463AFA4D868C3B266398D1CE33035B1B7F926786C2F0E3B958", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283285, "uuid": "037bd95c-d666-4d50-8868-6af9fd8d4bc8", "value": "384:tR+1YQyude97DLjPU63hJqeEiuLa3Q2nAl016envuXFx4e:tR+1fyuwLj863DqeEiHQ2nozOvu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633283285, "uuid": "7830e18a-e5f0-4991-9971-9da0fe64cc49", "value": 21040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633283285, "uuid": "d90bcdb2-479d-4b78-92a7-27ac4f66ee06", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283285, "uuid": "8c2536a8-b0fb-4dd0-a349-7415e552545a", "value": "a530906d8ccf9d3de4d94282fb0221fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec5146e6-2445-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633264327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264327, "uuid": "3c2e901f-6790-4137-ab45-e4533661e12b", "comment": "Malware payload (RedLineStealer)", "value": "8fcb3bbb57fa860a37da5cc9249dbbd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264327, "uuid": "3bf4c109-b402-4d65-bc5f-0041f373d889", "comment": "Malware payload (RedLineStealer)", "value": "ae4e86797fd91e9bef807f0bd822d0c77f37b03e20eec889bc0ae9f9af738b32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264327, "uuid": "3d4a0dc7-27e3-413c-9740-2b1fcfab4d12", "comment": "Malware payload (RedLineStealer)", "value": "fc94b87714b7b04c973b2c76472ef7ad31b5a77e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264327, "uuid": "769142b5-ff7e-4acd-b589-e15cd17e7be9", "comment": "Malware payload (RedLineStealer)", "value": "3606120834ffa20be4fde407456e7a5b1a2b42eeef71a071a4e444153cd6806d482412cb982af0a8a987d9ad68a116ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264327, "uuid": "18dae046-c423-420c-9f81-5e8eed9b7c17", "value": "T1A384D0097290CFF2D67111B5AB1AC7E1493DBC691E26168F6B98376FBE3E3C18612341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264327, "uuid": "d6b9b0bb-f3a2-46a6-a0f0-af50bf8931e2", "value": "401c37f2bd821b3afe64e4a9a74e43f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264327, "uuid": "b4e5b44b-b3cd-4660-80b2-dcbb5b4a0a22", "value": "6144:sOy8E8XvLCZrhE+Z0s4lH8wnT0+/vm8eGA8b1bcB18CmhMuL6MCOhxxFeTr/ekI:1eZrhEPse8wAOm8e2EhmhMuL6+zxF6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633264327, "uuid": "b9963fae-860c-4673-b23c-ba7884a222b0", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633264327, "uuid": "45e31933-fe99-446e-bf95-9a3553f04b6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264327, "uuid": "bf71bc92-2764-4780-8c64-09b759d2172b", "value": "8fcb3bbb57fa860a37da5cc9249dbbd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3a02a7-2466-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633278531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278531, "uuid": "3f70edb3-8749-4407-9ed1-1c2fd7b28bf1", "comment": "Malware payload (TrickBot)", "value": "6ea58220956907d6850198b4b2217135", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278531, "uuid": "64401834-f828-4a62-8c4e-81147ad3cef0", "comment": "Malware payload (TrickBot)", "value": "af3346ae78376e9b1a0025c938af5b4dd75842181e30b4ea6a4801f75fe07140", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278531, "uuid": "1a77ea99-5558-47b3-9aca-3c07ca07ed0c", "comment": "Malware payload (TrickBot)", "value": "b016f6f7693ece8ce567bc7d52c8a371aa52ce04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278531, "uuid": "b12199fa-8885-4515-9863-ff8aa9afa3f2", "comment": "Malware payload (TrickBot)", "value": "b1eb28e19759815f5ced3787327347f97685232e414c83be28ec516541712aeb79d8f5a368ef9eebf1f76ce4fc3830b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278531, "uuid": "a1d75764-3407-40b9-9cf1-50ab31dd4627", "value": "T13194F1123AE0C877D0A745314EF58B79B6BAFB504F318A6F23D90F1E1D31A518A26376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278531, "uuid": "b40c7a65-96b8-4f4d-8670-7f91a20e1b85", "value": "220580f49c2724e661575b7bf3bd58ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278531, "uuid": "baacad01-80e3-4a16-9bc6-71b253d739b6", "value": "6144:h0lJVu5xP+oYEm8NG/wBHRSIAR9687dX9szOHMVT+R6NWPFgQAXaneCrvD:h0lJ4jPOzwn+96sdX9szOHMVFCgaJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633278531, "uuid": "601311ab-a3d3-4834-87cb-404995081d2d", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633278531, "uuid": "ce9b6947-2e1e-4166-aa9b-bf8c4a23ef8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278531, "uuid": "1e3baaa6-e1a3-47dd-be36-0540c654a0ce", "value": "6ea58220956907d6850198b4b2217135.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c1f00b-247a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633287002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287002, "uuid": "9ec5fd0c-bf2b-4330-b02d-f98536f9306f", "comment": "Malware payload (Mirai)", "value": "ad7c6231d866aa0cf0343ca11894b0d9", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287002, "uuid": "15440ffd-2fc8-4c38-8fbf-e119532a6b58", "comment": "Malware payload (Mirai)", "value": "b21299e11b4b03c9e46d7a0dc3c4f4e430480eff76e05e34515ca4007dd827b3", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287002, "uuid": "7f82017d-7995-4a96-bd77-20c7ecfab333", "comment": "Malware payload (Mirai)", "value": "118f92c4f77eadb84787f535fbcf35fdb732d149", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287002, "uuid": "7a7abb54-8d70-4c6c-b8b9-d5e59383e735", "comment": "Malware payload (Mirai)", "value": "6397a714fc86aa8f9a546622de33133ef45587cc29814672977e0dea3cf8476290dfc826b6435ce26d58e9120183f672", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633287002, "uuid": "e717b94c-356d-47f4-8b18-80b9c795e889", "value": "T149E3756E3E21AFBEE268867107F75F70C395259326A19382E26CD7085F7128D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633287002, "uuid": "570dc9e0-91cc-45c8-be58-b1fec23ec157", "value": "3072:4nF0BZ1GPyaT/H5hKIE2aWURxuZq+1uPNd5R:suORH5hKI3URxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633287002, "uuid": "5d361c3e-9e03-48bd-bc55-976dc9b0450c", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633287002, "uuid": "95edbda5-6a74-4bef-9a64-be72869421e2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633287002, "uuid": "944bd30c-204c-48ac-9ed0-c9463df8edc6", "value": "assailant.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7dcacc6-23f6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633230336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633230336, "uuid": "3afe77b3-c53d-4687-881b-3729431a842b", "comment": "Malware payload (RaccoonStealer)", "value": "5145a3e1ae17f0503d1a1a9ea08c5d2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633230336, "uuid": "e771fe04-9488-4d78-a692-b54b1822cc85", "comment": "Malware payload (RaccoonStealer)", "value": "b336634f313c9ac830e2314c47c6d016a135c8125507b4a4e2cb5f224b3087e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633230336, "uuid": "37d7417c-8cff-4755-9e0c-42962dc5b9a0", "comment": "Malware payload (RaccoonStealer)", "value": "074936d101cf1669b1f76175fca1f2b1e06ebe94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633230336, "uuid": "9d81a724-3e6e-4bd0-b24d-595605a9c4ff", "comment": "Malware payload (RaccoonStealer)", "value": "d406cc6785b89296e95c3a0c2eb8b027d0a2ee40ac5456f0204b074bb9d0948e67a1b6a89a367ca25c7a523ea745a77b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633230336, "uuid": "f3638b8e-573d-40c3-a0ce-84e6e4643cfd", "value": "T160B4E030B7A0C035E6B752F889B583B9A93D7EB16B3484CB52D41AE953387E49C32753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633230336, "uuid": "47becc1c-66b2-438a-b86a-17d417bf94e8", "value": "949cb2a875d86b476d185d15a2fa1cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633230336, "uuid": "0b1a3932-6695-4f7b-9e18-7b38694ebc04", "value": "12288:1AZPUZMT2Xjj9PEd3N3nq+uJ6CjR4M468jWelOTH4:W9qTJSqJ6Cl468aTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633230336, "uuid": "3c37e65d-b7ad-403c-9c5f-8a9ebf1b8ac1", "value": 522752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633230336, "uuid": "4426f847-8f5b-4e2d-8381-d4b01c8104ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633230336, "uuid": "22496a06-ea6d-4b08-9f53-33b7f77bcdb4", "value": "5145a3e1ae17f0503d1a1a9ea08c5d2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46de80f0-2441-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633262332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633262332, "uuid": "59f97dc2-3cfa-4202-a7e6-dbce4e75f270", "comment": "Malware payload", "value": "924a8b1d7396a7e21e026b4424fcd080", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633262332, "uuid": "709d32c7-2fd6-4392-a362-84d18ab476ed", "comment": "Malware payload", "value": "b42bdfceb8e7733db22645fee95482dccf5260dcd3ff15ede0de77d2120c3845", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633262332, "uuid": "353d2ecb-a85b-4758-9aea-bd8263b45d5a", "comment": "Malware payload", "value": "1a6193b9c349913c13d4a2aeae208c027394f9c3", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633262332, "uuid": "2dd08911-4f29-4f66-9f77-c0ba0d8d65f3", "comment": "Malware payload", "value": "115733e41531de701d6d98f98612823a337dcd0dd1eab5e425e218e40beff2fe9b947f202f9a3100f22a266e78af6b31", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633262332, "uuid": "86562c6b-7f03-44df-bad7-7223f657b058", "value": "T1A295F141F754A82FC87780374AB7076A22529D4ACA95C70786B4B31C7DBB9C14FAAFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633262332, "uuid": "570d7f51-0b74-41a3-8f2b-b02ff7117e93", "value": "49152:BjgmCcSRi97ERKeVrl6rMa+wTBHpEUBtgen:BcmB2ixERDVr4Ma+Ad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633262332, "uuid": "b9e35f2c-6e7c-4bc1-a0c1-bb70c7b64df9", "value": 2012953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633262332, "uuid": "771d4b5f-a858-4f69-86d4-21f75e39125a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633262332, "uuid": "5797a859-5c6b-4f0b-9c0c-0c41c13b8af6", "value": "NTTsecurity.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3baab4df-242b-11ec-843c-42010a9c0014", "comment": "Malware payload (CobaltStrike)", "timestamp": 1633252864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633252864, "uuid": "e26404d3-f3e2-4f61-8b13-b31c12acbbf7", "comment": "Malware payload (CobaltStrike)", "value": "5d8464810ae36a62ab1b78986c0ec321", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633252864, "uuid": "be161d2c-541f-4c3d-aed7-2ec3bcc37468", "comment": "Malware payload (CobaltStrike)", "value": "b55574d4e02ae573f5918e5883dc83d6c3381e73375be814ca4906ee591dc0a4", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633252864, "uuid": "8e68843c-c662-41fb-877a-bfb382b1d9de", "comment": "Malware payload (CobaltStrike)", "value": "c83abaaea952e66ee564154328a0966ebb8b6c74", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633252864, "uuid": "f5da8775-87ec-4c1f-86a8-b3aa3fd75c35", "comment": "Malware payload (CobaltStrike)", "value": "4b1134cd073c109a5f2793725a0701751142a4ea60e2f20df104876dd2bfb313d62d95986b6d9fc708c4b215aff88111", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633252864, "uuid": "893cf92f-fd76-41ce-867f-63b803cd7475", "value": "T1F724E03973402C72D0395AF077622174EFA1E27B18FD4966C71EE485D28E279A1E368F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633252864, "uuid": "80e6de2a-6871-493a-b96d-19496b21476c", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633252864, "uuid": "94ddde4b-d6d5-4a44-a986-4785419ee5bd", "value": "6144:D2yVmMl6orBea8/h0FYKm2hVdKCfuCEL3jRJV3x3:ay0KrNea2hWzmYVbwjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633252864, "uuid": "83317125-7d67-45a1-8b99-ab9cdcd7520b", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633252864, "uuid": "2ca17428-5661-4919-9375-0c1017eb1b1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633252864, "uuid": "91a424ba-9218-4388-b947-b094878a8af5", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a6b4b15-2483-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633290604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633290604, "uuid": "057d01bf-7145-4d7b-ba6a-b8add8043e7e", "comment": "Malware payload (Mirai)", "value": "e89c8f3c1867bed068b07e41d89b6733", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633290604, "uuid": "95fded07-3d67-4931-8105-6e6b813ee060", "comment": "Malware payload (Mirai)", "value": "b59fe097c9888ddf2300bf580d9c3efb2d371f91bcd14a18907028e9ce1ce5bc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633290604, "uuid": "8ecb6c18-774f-4a9c-9974-f77d2012b9e4", "comment": "Malware payload (Mirai)", "value": "30780fe34909fe53020fe1049f2559f3943e9725", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633290604, "uuid": "960e6774-4849-4579-9d6c-aac4099e68f6", "comment": "Malware payload (Mirai)", "value": "361ef5a51d0c67ab251134b93ca504060e54d0961ae8e3ac7700f6f4378fd94d5087bbaa973900f47b478c1067dcdad6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633290604, "uuid": "480e72a6-9b71-405c-a536-a59d3e8ce3f4", "value": "T158D2F12D6FE4B4B7F46277331B0CD345812DB6EBA79988D565840B0436C20191DD9FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633290604, "uuid": "7df22c47-ad0a-4c88-914a-725a799731e8", "value": "384:MkgYRwKusckSImz1Qlm2CWkvWYipIY0obGJH0+pZJ8+KDMndxX8b5hxd1UhwSKGc:xealmMkvIbOrCrMdJ8b5jXUhw0YoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633290604, "uuid": "a9b0093f-2e5c-4954-9e6d-a2f5d1abf7a1", "value": 30152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633290604, "uuid": "17bc991a-6ce1-45c9-b1e9-271bf27956eb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633290604, "uuid": "a8507c48-1613-4b67-bf76-7a51fa43945b", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b5b1e0-2415-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633243514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633243514, "uuid": "286b0ab2-27e3-4e05-9ec1-7e26927db3aa", "comment": "Malware payload (RedLineStealer)", "value": "66029e6310d878c3cf1407727cfb3a88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633243514, "uuid": "713d5ada-32cd-4e6f-a58e-47de942fe542", "comment": "Malware payload (RedLineStealer)", "value": "b5dbd687e03ca05e79cc90bb069df6fad6c379b99fca6e0366934a690322bfad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633243514, "uuid": "7ec32b55-a37a-4f2b-8373-f175f63b1949", "comment": "Malware payload (RedLineStealer)", "value": "efa4e22bd103a57dd8218f9d0d28ce8868c4d15d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633243514, "uuid": "5d319b4f-8be0-40a4-8f3c-5c5ee2293e5b", "comment": "Malware payload (RedLineStealer)", "value": "92a2155b7bdd7d1be92d9672b1cc91c22ab7dac5597a5a9fe4b4d5c9e966b2a457d8727ff88c251e6592beab9ac1ea1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633243514, "uuid": "1245cdd8-ba37-4fcd-abb4-b2155da3b7d7", "value": "T136A4EF28687FC019C5E3EEB52DDCA8BAD99A55E3640C703701B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633243514, "uuid": "335d5d59-22c9-4538-b9c4-e3f7dd2f20ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633243514, "uuid": "83215ada-e167-405c-824d-d900674d8f04", "value": "12288:e8klT97igBMJM8Ajhq/dK98KGa4YR1HK53f8hit3hDyYhE:eD7jhm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633243514, "uuid": "cc431f08-b228-42f0-b32d-4ea35a38411f", "value": 449821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633243514, "uuid": "6f4401ac-721d-4635-b330-9bcfc5c38ae4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633243514, "uuid": "0da93b3a-4a32-452d-a451-2822317c6a3c", "value": "66029e6310d878c3cf1407727cfb3a88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64fe6cae-2486-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633292018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633292018, "uuid": "c47396d6-7e62-4afd-8a9e-01a870b09a29", "comment": "Malware payload", "value": "809a5c6cef4dc6200f0e2fffa8c4f311", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633292018, "uuid": "3722b631-2ea7-4e00-9bcd-f1e366f6772a", "comment": "Malware payload", "value": "b86ef6990c59e33deca76103b740084871993a9c417b2b802c608c7604ea8b25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633292018, "uuid": "1b4eff86-f302-4551-9556-55ec7a37a8e4", "comment": "Malware payload", "value": "916bad004c711c1a8b309412596a29f3b99e5fe8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633292018, "uuid": "20c61970-61d3-4a3e-9b95-855ad5721a79", "comment": "Malware payload", "value": "af529bb1d7b3434defca91bae81007cbf4ebe4b14364f0e770964878c84a93a18344ef90e63614d3258eda4aee49d435", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633292018, "uuid": "9f7c73f3-8f3f-4457-907d-0a4a148b9343", "value": "T1F484D0093291D7F2C6BA0630BB26C7E40A2DFC9D5F2A55DF2799271E6E383D18632305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633292018, "uuid": "3ed7555c-586e-477a-90bb-1b89a7ad63fb", "value": "d33805713bf84c5172011e6ee58dcc60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633292018, "uuid": "901da07f-cb08-452e-838e-065c8c92e152", "value": "6144:aB088cxeLrFkWmKnWcMzH9xLZ9c6T/vSng5Pd6/ZBfRGgROhxxpeTr/ekI:a04ePFkPLBxLZNPsBmzxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633292018, "uuid": "7687cf89-9f3c-41a2-a9f3-0b524a06584a", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633292018, "uuid": "5830ce06-440d-4b69-a658-bd5ca59498de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633292018, "uuid": "44497d4f-f4de-42e8-bd97-4ee56567e49c", "value": "809a5c6cef4dc6200f0e2fffa8c4f311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924acbdb-246e-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633281786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633281786, "uuid": "d067a3ae-4634-4d2c-bfd9-84cd521d7e64", "comment": "Malware payload (Mirai)", "value": "f449ad86dbebdf25438ded18c4507b8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633281786, "uuid": "9b35812c-8b27-4fca-84e7-8b945bf3b19c", "comment": "Malware payload (Mirai)", "value": "b8760b2f2c336b94dbee4b8ea828577764e523e06987297fb09cee00ae43484f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633281786, "uuid": "4dcb71fa-bca5-4c87-865b-3212b73453d3", "comment": "Malware payload (Mirai)", "value": "837d2321977954a627d747c8bb4df57a455fdbe8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633281786, "uuid": "8c7be239-4be1-42ab-bb4d-fea0bc6db9f3", "comment": "Malware payload (Mirai)", "value": "46080f16d42e8a631aa018edea6b7e9c85a2c635d58f9409af53971c9cca0555537e2ace415d9a5dab1fd9292c7e8fea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633281786, "uuid": "3bc95950-1f18-4609-ba76-f887896d4fae", "value": "T1FC734A32AE651D27C4D4A27A21F78220F2F6531E22B8851E3CB10E9DEF74A4471677B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633281786, "uuid": "6fd3db3a-1e9d-4e60-963c-d6256e410d4f", "value": "768:jsnoEjo/rmwLwCiLIGlasLHfQ/wck67pzZO+75oG8g2B3+1tEFRmIQ:Qnjjo/CwLDiLAm/BOb75VvtEFRmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633281786, "uuid": "2725449a-70ff-46ea-8b9c-0f04f2fc56b1", "value": 75152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633281786, "uuid": "66d3111b-3a1d-426b-adb0-fdc904a1f5ff", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633281786, "uuid": "95478e12-65ef-47f8-8172-22020eaede32", "value": "f449ad86dbebdf25438ded18c4507b8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "780e570b-2415-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633243516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633243516, "uuid": "8209f51e-8331-41e0-be27-134103678b51", "comment": "Malware payload (RedLineStealer)", "value": "713da5cef8b9bb671a1ec2924557a394", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633243516, "uuid": "f5907a87-07df-4e6a-967b-76ac921b9dfe", "comment": "Malware payload (RedLineStealer)", "value": "ba4d16c9ab70e69152e0c693a6a3aa5c3dcd26129e5a13b9dcb6645ff9940283", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633243516, "uuid": "c8a984b2-1e91-49f3-9bf8-5e69decd3faa", "comment": "Malware payload (RedLineStealer)", "value": "10fe1bd7fa01d371612bc45c2a3eb2ad18ff456b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633243516, "uuid": "b0ef372f-acd5-4f1c-80fd-faf161ca7ff8", "comment": "Malware payload (RedLineStealer)", "value": "b108e27cb3cd978173be14bf995014c1161850dddfa1f3cd131e53a32ac41bfa0ff6ce2a3d3130f03a25704272893114", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633243516, "uuid": "04c4faa2-9398-4937-a3a5-bd460f174b37", "value": "T1BDA4EF28687FC019C5E3EEB52DDCA8BAD99A55E3640C703701B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633243516, "uuid": "b4d99705-5d26-4240-a392-3491768c1178", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633243516, "uuid": "aede1419-4164-45bf-a2c6-1d678ea772f6", "value": "12288:e8klT97igBMJM8Ajhq/dK98KGa4YR1HK53f8hit3hDyYhE:eD7jhm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633243516, "uuid": "6be326ba-5832-451c-b514-51f7e3344799", "value": 449828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633243516, "uuid": "78061324-3038-453c-a461-9e97f8448633", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633243516, "uuid": "0c2e3404-1ecb-4b0e-a248-b76435c40d92", "value": "713da5cef8b9bb671a1ec2924557a394.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846a8d3a-241c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633246544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246544, "uuid": "c1052c2e-0008-4203-8e2c-498f0594bb46", "comment": "Malware payload (RedLineStealer)", "value": "f5cdf4f9797dddb1e18b206c3cc93f6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246544, "uuid": "bc556ca3-c7de-46d7-b229-262c1b8e1982", "comment": "Malware payload (RedLineStealer)", "value": "baabe1f7bf9f0034037f5ed924b0b3e5637fea32e63c83c2321e088259384650", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246544, "uuid": "93a943b2-ae0f-418b-8082-6a58dd5f316f", "comment": "Malware payload (RedLineStealer)", "value": "781a81a814439ba0cc2e1cd896f8b5dd665a7cba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246544, "uuid": "88ee2ba2-e2ba-4038-a3dd-b7170e3cb382", "comment": "Malware payload (RedLineStealer)", "value": "e0224e9578bba79c274d851341f0dd7268bd02d914b2c8756ad26b278d4161a1d18a24d1da228131b7a0bc0f9b28f09e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246544, "uuid": "40c32fbf-1c61-45a5-9273-531e79c6c9b7", "value": "T150E5CF052E8F8A01DDFE0EBCA83B95A413677D40AC7CD0A7B165739B1A30B43DA76716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246544, "uuid": "f37a724c-dccb-4e66-a796-a796e162ff78", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246544, "uuid": "d26c1297-96f9-4ae0-a3f5-a1a723e07499", "value": "49152:Y0V8dG5+WGJGEbvNwcdNOt5Fpqxi0AS+0BC1wFarWtt9ykLUT2XgBvwgD9:TVKG5+NrNhePCh+0E6FaLkL22Xgv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633246544, "uuid": "48b0aa40-fdd6-4001-92c3-a688f50d22ea", "value": 3214336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633246544, "uuid": "6c9b65fa-8b52-4aa8-a71d-9991f143922a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246544, "uuid": "4310c43e-5d57-4b88-a5e7-e2fb74d9d64f", "value": "f5cdf4f9797dddb1e18b206c3cc93f6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c207319-241f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633247657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247657, "uuid": "94da28b5-8f4e-4c79-80c5-91d44db824ce", "comment": "Malware payload (Formbook)", "value": "af5aec64e95c21aaa7083c96ab1c417e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247657, "uuid": "2fbf57f1-0bf1-45cb-9196-cf3a468ab3c5", "comment": "Malware payload (Formbook)", "value": "bc4d625ec4ba48b9c17bcd907fe509539a12bb0d6103ff65a4e3c59fb4eca07c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247657, "uuid": "139569c7-0e06-4f7f-8630-08766aac8272", "comment": "Malware payload (Formbook)", "value": "ebad1d58f0d61e15be17043269546f159b084575", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247657, "uuid": "a9e937e3-ce7d-413a-a169-8673954dd2c3", "comment": "Malware payload (Formbook)", "value": "987f55ba190ef2fb7cd136782e4f292278346324b0c01842a31a53c31c0821347d15bf258ff89b0848a52f9f8c1a850e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247657, "uuid": "c378a29f-fdd0-4f0f-b836-d6294eb47790", "value": "T1419412B81B5F152AEE2583F29632D29037B9E564B41DE7387E89702D70D3BBC47E0606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247657, "uuid": "7bd47e94-e779-45d4-bf0e-34e85c60fb8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247657, "uuid": "6d749cd7-0e72-46f1-812e-08a9a853465d", "value": "6144:Z6O/lGqjqd7ym95IdbhgMzYhV855FtBr46vL3SJOv3Fd1OgkWAp2UMOE7:Zu8qom95Mbhg5E551r13j3FX8glt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633247657, "uuid": "cf903941-2538-453b-b87b-cfebbec9ceca", "value": 420352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633247657, "uuid": "c2718480-eb3d-464b-8089-c772db9dd26b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247657, "uuid": "4d23f10a-9636-4e80-885e-e6ff711c0802", "value": "af5aec64e95c21aaa7083c96ab1c417e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ecab6d-241b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633245949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245949, "uuid": "9c6a1651-e5eb-4b9b-88f7-f0274787cb90", "comment": "Malware payload (AgentTesla)", "value": "9546f93016dab5eca6f66194e2a6bc40", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245949, "uuid": "71190c5e-e02e-4e85-9162-48e5e3a5bafc", "comment": "Malware payload (AgentTesla)", "value": "bde48026da531da2960b2fb57f23976fbb31ce7c36134997fe57b10697be899f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245949, "uuid": "68a7c5e4-cc68-48ee-8ce3-c8dbf1da68c2", "comment": "Malware payload (AgentTesla)", "value": "3001bb2f270c8d3f5febdc0f8fa8b10f65f5c49b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245949, "uuid": "6ea16218-811f-4509-901a-1ce1217ac00d", "comment": "Malware payload (AgentTesla)", "value": "f057e85692178d2600cff81f3ae3fc738a0720f6c003dd921a8941bd40d3afe0be6450442a133ceeeee0d46ded259bcb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633245949, "uuid": "fbe2e9c7-5586-4bee-b4a5-1033ac93b22f", "value": "T16222AEB3CC0552A8EE664D74B33E16B57076022DCEF44E9AE19433B40C2AAC5B44B7E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633245949, "uuid": "f87a85ef-17a9-4599-bf60-5abf6ffcedb4", "value": "192:P7XHPRSP3f2uD7jJsGfq0GrEZlN9e0jeWz7I3RhdVmWKft9jh:PLPR2f2uD79smKIZly0rz83yXftBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633245949, "uuid": "dc4a9c30-8f18-4add-8f54-6e58234cdaff", "value": 10669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633245949, "uuid": "b7d49c42-684c-4e1a-931d-01955056f0b4", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633245949, "uuid": "18cda1c4-b194-4dd6-b54a-8fc928d62f95", "value": "Reservation.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a34630-2466-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633278414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278414, "uuid": "a9851db9-61af-4efc-a1ce-cbc4f5dd7756", "comment": "Malware payload (RedLineStealer)", "value": "19d6991eedab50844eb6a2b409d8afd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278414, "uuid": "daad5cb4-a633-4760-b643-a6509c8d2d36", "comment": "Malware payload (RedLineStealer)", "value": "c0229d60231c1631796fb5f3bb37f8a814e599bafc0b4f72c17c0e232a2e3176", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278414, "uuid": "e370c578-99e5-48e4-b6a8-3f0be7693a62", "comment": "Malware payload (RedLineStealer)", "value": "44bd78360414b1d5bfcdf515aae4931224f414e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278414, "uuid": "8540d553-671a-455b-aaca-022f538200ab", "comment": "Malware payload (RedLineStealer)", "value": "2e85b587dae4277c686577bf587b5166257a4630e1f0353752b41b81c7626f03be0c4832e7426e40e8fe17c3ad24702a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278414, "uuid": "bd98f91b-c8d8-46e9-a36c-9af4134d8b4e", "value": "T14084DF093290C7F2D6720135EB66CBE1593DB8E99C69424F3B98275F6EF83D18623306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278414, "uuid": "c930d8e1-29dd-4aa1-8085-6df2c33fb512", "value": "d33805713bf84c5172011e6ee58dcc60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278414, "uuid": "64a04aab-4eb8-440b-ad49-1c7b642d919d", "value": "6144:V5p/R1xLkA4yCwPBEwgNK0W5pRD/6fT2nKFcROhxxpeTr/ekI:Tp3xIA4yL6wgNK0W5pRmZzxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633278414, "uuid": "06d89836-8471-4abe-954a-6aa895406fcc", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633278414, "uuid": "f5f8465e-26ee-4035-9e57-8945641edaa4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278414, "uuid": "087bffe9-1ff9-440a-8921-5283bfc97984", "value": "19d6991eedab50844eb6a2b409d8afd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611a6bd1-2480-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633289434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633289434, "uuid": "b89d330f-db8f-4391-8cc0-75129608e8f0", "comment": "Malware payload (Mirai)", "value": "99282c144bccef324ce58ede8e9edaca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633289434, "uuid": "882bfcc5-c651-4c5a-986b-5b47507294a5", "comment": "Malware payload (Mirai)", "value": "c361b712fcdce32d533cadd93302fd98cfcc1a0346abe147c73b1d5a4c778abc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633289434, "uuid": "6bd144f0-e445-4e60-8e69-9090e5598647", "comment": "Malware payload (Mirai)", "value": "8bd2358e127126eb8f0a5cae44bbe8e656274f57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633289434, "uuid": "03a0ee54-0e66-4eef-86d4-65844085db3c", "comment": "Malware payload (Mirai)", "value": "6848827f7be1b8e93ca55306e90fd66ac80b6003ad9f9e18b888117a08ba9d4d71c1f4a10c9833ed615ec96ff40e7e7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633289434, "uuid": "c88f2f23-aef6-47aa-973c-1e038577c111", "value": "T173B32A0798615F77C045ADB129A75530072ABA120F8F1F9AB57DAAF4074F8CEB40FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633289434, "uuid": "75cf483f-fe97-46f1-81ae-a4edf054d35f", "value": "3072:bMTwsiL+Y94kYgSsE5hLW0rXiILkY0Px9gQNfR:bMMLK8PSsE5hLW0XzLkY0Px9gQNfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633289434, "uuid": "af52f81d-66e7-4442-8c4d-c8924d998cbc", "value": 108423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633289434, "uuid": "8162a0c9-f47c-4ac9-877b-e70fe65e5e4c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633289434, "uuid": "2a979214-4c06-4969-9df2-1a8ab4767027", "value": "99282c144bccef324ce58ede8e9edaca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d62ef8-2401-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633234847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633234847, "uuid": "4154bfd5-e00d-48de-a6f0-dd638d86c904", "comment": "Malware payload (RedLineStealer)", "value": "0ed0ed66bca7dea4b4db2d774d0bc20c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633234847, "uuid": "054bbfee-dc82-4da0-9eb1-fb2e0c85d7a5", "comment": "Malware payload (RedLineStealer)", "value": "c3bf65401ec1efe7d49bcaf30073800089212b8d8dd5b8c56cdbcc661c713d88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633234847, "uuid": "d73a2165-ce02-45ad-85fe-3b6e9731363a", "comment": "Malware payload (RedLineStealer)", "value": "990d7397df84500308f3469a148e7b1ad86d9309", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633234847, "uuid": "9dc021e5-c098-49f2-8f1d-9fa9387adf88", "comment": "Malware payload (RedLineStealer)", "value": "f23a1a938c11ffdac056a7a15d575d527ecc4553ee60ae008ecd4a5147a14301529952ba10304d8575d24b392f10cad9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633234847, "uuid": "9442f829-3c57-44e0-8e47-24d7528b2b43", "value": "T1B354AD183182CFF2D6B605B0ABA6C7F4092DBD6D4D16764F3B98372E7E3D3919612242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633234847, "uuid": "a448aba8-d26e-41c5-a2d9-c48034ce326b", "value": "f37786a16a90f8f3f38c22c48ff5cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633234847, "uuid": "33fda5ab-5e60-4e7d-8f35-7a1f53fcccd7", "value": "6144:PYfcSPf0NL+K5PzXlCG3xTqJL6SAJOOhxxdeTr/ekI:Pm8zzXA4mL6SSzxd6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633234847, "uuid": "85acd3a5-387f-4bd9-b0c6-140962342ab7", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633234847, "uuid": "d9fe610e-f56c-48f9-9b51-ee5c21b241ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633234847, "uuid": "ec2612b6-a4bc-4007-9678-dfaa8574fff3", "value": "0ed0ed66bca7dea4b4db2d774d0bc20c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae362d4b-249d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633302019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633302019, "uuid": "37faef11-dc60-4995-ab0e-f07508a550eb", "comment": "Malware payload (Mirai)", "value": "e2236af4d7c075cd136a2a9777356c26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633302019, "uuid": "eddd9103-910a-4ad2-9fcb-00293035b874", "comment": "Malware payload (Mirai)", "value": "c4fc3fb1f73187737321c14f37814d4af72553b8ed1a170de28a4b20bb24a7dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633302019, "uuid": "e894ccd0-8128-46d8-aafe-5dc08405cba0", "comment": "Malware payload (Mirai)", "value": "0bbcbdb826cf9eaa93848e6037b02e9a3c319513", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633302019, "uuid": "c92eeaa6-e52f-4c80-8186-40886131f39c", "comment": "Malware payload (Mirai)", "value": "17798448be31f3998e4b68072bc0d8323add25fadeb05070232d193d8e5d4ae0843c1378a60382eb0cc3593574f896cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633302019, "uuid": "d858c7f2-149e-480e-b0c4-000c369d8ad0", "value": "T1D683754D3E619F7DFBAC823887B74B209249339626E1C584D15DEE021EB034E745FBA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633302019, "uuid": "c4443cb6-2ed8-499b-926c-2238474cb64b", "value": "1536:tR4urouZ1X56QtaDi0vRA4Q9OXwkpSCYrWNEv3YJW1/:Uuo405tQ98pSCYrWNE/Iq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633302019, "uuid": "43c9bab8-96fa-4444-9834-e3d278ca34e9", "value": 87908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633302019, "uuid": "cf965756-5f21-46b1-8eb2-fa1883dc27a2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633302019, "uuid": "6df3e635-52fa-414b-9c67-58abd0ba1b42", "value": "e2236af4d7c075cd136a2a9777356c26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd51159f-2472-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633283683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283683, "uuid": "5d40f4f7-5ede-4f70-8620-7f547e56c2cf", "comment": "Malware payload (Gafgyt)", "value": "623590c901aadfc0853639eb4d4e0615", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283683, "uuid": "00030af9-b507-4599-b677-96ad6abf00c3", "comment": "Malware payload (Gafgyt)", "value": "c6fd13a01cb21c4a39d8d5e306f2f3a29a42f613acbf6e4c422f6452f7a626ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283683, "uuid": "39845dc0-2dda-47b7-80b1-bfffed39a982", "comment": "Malware payload (Gafgyt)", "value": "c807cc3547cfae67a8bd7c4a7ad1708b0b1d9e82", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283683, "uuid": "f712773e-e65e-4775-a1f1-6b3441cc23ea", "comment": "Malware payload (Gafgyt)", "value": "f36a21c253c6800335032683d64d715852acf2ab802a0c595a2d7574d70c1a4bd94870bbcbe84b0b8efbef4dc9575808", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283683, "uuid": "42d8c85a-bd9b-4f56-9103-ac740a53a13d", "value": "T1E59209E1B504AC7EE446E73DE805480AF279FE2680665B71637BF863AE731D0047AF46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283683, "uuid": "11eeac57-b389-4c2f-82b6-d49b057faabe", "value": "384:6XQzPO3TdY33A3ROBbJ6oJ+p8MZUDJP4NWZnt9DDhM/UGgQF50Y48HAIJktoZb:gEpbA98Lz/S/UGxP0Y487JktoZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633283683, "uuid": "41001cf5-3aa6-4fcd-a9b4-60d5d35e6d68", "value": 21172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633283683, "uuid": "a6fc1654-baa8-491a-a9a0-7c00a72ec17b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283683, "uuid": "1a15f768-5cac-45ce-8e52-96d450338228", "value": "623590c901aadfc0853639eb4d4e0615", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3291223-246c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633281035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633281035, "uuid": "6ea6bdb6-b6c6-4e58-a754-33694a5c4e05", "comment": "Malware payload (Mirai)", "value": "1e5aaa5877dc5f883347a9e2c2082cb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633281035, "uuid": "5943e862-64d4-4655-adbc-09b38a9b2afb", "comment": "Malware payload (Mirai)", "value": "ca3d882fbd6335817f499396a65baae177e40a84f37a527f8b3a0b618bbc89f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633281035, "uuid": "78719167-ceed-4b66-b884-acf1b6e470a5", "comment": "Malware payload (Mirai)", "value": "94126bec18b23aa61565b61bdaca6e4be5aa5c66", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633281035, "uuid": "6d025155-2c0f-4b20-bc74-e3b83cd59015", "comment": "Malware payload (Mirai)", "value": "750a146ff6b61a0549b260a6868bb7419e951a9e31238849a78c76c49b44eb63dd020d9e70a0846b8156f266b06c0e58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633281035, "uuid": "c31335ef-bcc7-4c6a-b731-1f5f460cfac0", "value": "T1BAD2E151F9927FE5FCD7EBA02D17F2923EE55A6A1F8BC94C22C07BA0481307356846C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633281035, "uuid": "e1033fc5-60e7-43a8-b17b-3991ec796e84", "value": "768:ARbRgPIYgTqONA8IVomqd6yIlT57G6prjiUo7T2OmL4uVcqgw09Y:APgPNOaHVoCRd57G6pKU67mL4u+qgw0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633281035, "uuid": "b6ed570d-6e51-4d2f-806e-0d0b3ba74750", "value": 30608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633281035, "uuid": "6b37623b-1acf-48fc-9de2-72270535321d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633281035, "uuid": "9adcb4c4-53ac-4784-a3c6-54172173d80a", "value": "1e5aaa5877dc5f883347a9e2c2082cb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea1c9bd-246b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633280437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280437, "uuid": "523e383c-5dfa-4918-86fe-519592b1577b", "comment": "Malware payload (Mirai)", "value": "873771a63ce2bee6d1cf402e04254bb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280437, "uuid": "82e0d52c-057f-46b6-b0c5-f98453211d6b", "comment": "Malware payload (Mirai)", "value": "ca3e5ed2833f4ac461916df4f4dd691609c45a62ebfc99d87510a07ab06364a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280437, "uuid": "3337c271-2133-429d-a694-155a8f934e7c", "comment": "Malware payload (Mirai)", "value": "203452df8442f627243426eb847ac485d3754acb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280437, "uuid": "f7d2beb7-1e03-4cb0-8d8a-33ff73755387", "comment": "Malware payload (Mirai)", "value": "e3be7b1cc525cc27e2ce6664c9ba92287739e414c5cbc286469443d48c8bfbccd5c39690b972a33c368505dd826e3ee2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633280437, "uuid": "fe495fa3-e88a-425a-b79f-2677a97f4bc1", "value": "T15553AE62C9642D28DA254A74B810CA749367F43483972FFAE545C27CC027DEEF1AA3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633280437, "uuid": "53c5d18e-9b3c-400c-844a-d33b964fb9b5", "value": "1536:5aE+4+P+6mId8KxAxliyad35YKF75BkJ3cCHpu7yu:5j+4+P+6t8KxArTu5fFQJ3cBGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633280437, "uuid": "8775df87-9d54-4c5b-83da-2fcbef0a8be9", "value": 64304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633280437, "uuid": "cfc7b23f-8341-4e4f-82bb-1ad5c9bbcbe8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633280437, "uuid": "aed5f911-b561-4bf4-92a4-e2c85a335dae", "value": "873771a63ce2bee6d1cf402e04254bb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f97916f9-2444-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633263920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633263920, "uuid": "081318e9-888a-490c-b072-1999fb0fc9db", "comment": "Malware payload", "value": "ae518b55b991f4d558b90b88760fa197", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633263920, "uuid": "212d1c91-57ac-4a5d-b26a-90dad79926d2", "comment": "Malware payload", "value": "cb1be0fa4e0f27c032c552a1fa811d9a6292826798b35bb420f6688ed5f95d56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633263920, "uuid": "411a2361-b282-42d6-a8da-bce8ab0667aa", "comment": "Malware payload", "value": "fe00938444f72570c541c056d5ec28bcb4ee315e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633263920, "uuid": "284b6a47-eac0-4ee6-81d3-93bb26120636", "comment": "Malware payload", "value": "90fe6646f528b34bddd470df02be554f5ff3cebba8a8138cd27030a1ff6c01eb12473020c9a6238d5fdc1a348f3eae87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633263920, "uuid": "78cff8a0-43b3-4c4f-b094-ccf84d59ab8d", "value": "T18D157D8AF6C751F3C8934EB0025BE73F4231AA268017CD96F78DDE15F823E96570A259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633263920, "uuid": "c917c41e-1b67-4632-a910-3189aa0ea33a", "value": "12288:/UZssk3AvXrCOHdhA/vsBg4svy+8zC3ltGf2uW4+n2fFf+j9DIhs/:/ussgAvXzHdhW0Bg4Ru3DGfRZucf+R+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633263920, "uuid": "96d7d8b3-6602-4cfc-8332-86b655d67cb7", "value": 949066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633263920, "uuid": "2ae27c8f-ef5d-4d02-84ac-b2c11c2b6096", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633263920, "uuid": "a2d50e21-9e18-4c8e-87ca-daa6725c5f55", "value": "ae518b55b991f4d558b90b88760fa197", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a6db86d-249c-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633301341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301341, "uuid": "6f8657f6-a86d-44f1-8d3f-8bca462e38e2", "comment": "Malware payload (Gafgyt)", "value": "9769bd81c78296f6f4973fc3411e50a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301341, "uuid": "2bae0b6b-c7c7-4bdb-88c9-9e7818edb344", "comment": "Malware payload (Gafgyt)", "value": "cd039d8ed2729609e59bce48b320bf902175eed3c7eba2e8d04406c75ffafff0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301341, "uuid": "72aa0203-08bb-42d7-b277-3f2bebc977ac", "comment": "Malware payload (Gafgyt)", "value": "481b9bbf0208112ea1220cd6b3b4190833d78cbd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301341, "uuid": "ff8370da-0b7a-49b1-984b-a393408bd7ef", "comment": "Malware payload (Gafgyt)", "value": "65a516e71a315454512fbf2e3e6d32d3fe8cb5fb51c160f7374890309d2de48614457f9dbc1d8736cadabe062e03aab8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301341, "uuid": "d7379afa-6d03-491f-a043-e289a50df43f", "value": "T133B3E857FB11CEB3C85FDD730AA68A01108DA99746D57B6BB3B4DA5CE74684B08E3C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301341, "uuid": "ae8989e5-c17e-4a51-95c3-4914e47d914c", "value": "1536:Tgz/qzNLW/fMiZIX98U0I/QwErQNO55hVwbfKdwwjF9GhCPR1Ae:Tgz/5f5g8utgd5hVwjKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633301341, "uuid": "b942ae73-412b-4f61-bbbf-9c3cdb616e15", "value": 116647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633301341, "uuid": "54fce33c-dee5-4571-b87e-1d9910d9096d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301341, "uuid": "5a58ef11-42c3-44a5-ad25-975f47993f82", "value": "9769bd81c78296f6f4973fc3411e50a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ffdd41-241c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633246518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246518, "uuid": "e9d4ef19-00b8-420b-b3a9-f0ebcb39a69f", "comment": "Malware payload (RedLineStealer)", "value": "d90f6e2a21a073ac1e03654d85f6f69a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246518, "uuid": "28f8515a-fbf7-4132-a16e-170ab77c7dcd", "comment": "Malware payload (RedLineStealer)", "value": "cd5fe26fcc5833050f6371baff7fae45070cdf8b03b7fd5f082b1c21cd42a2dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246518, "uuid": "9d331c30-1697-4b53-aa9c-bec2b847cfdb", "comment": "Malware payload (RedLineStealer)", "value": "a4d5d9d69eb3e1d339afb526ba33cf698139257a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246518, "uuid": "5e3b10b7-41ea-42e9-87c3-3a1b43022acc", "comment": "Malware payload (RedLineStealer)", "value": "fee8972a43b9f528957f92ca6b9542043a28f24a51383becbbfa4b901f35b3f14cd788a44e1484881b826daa6a752645", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246518, "uuid": "1fba7ac6-f211-4458-b225-742e995743a9", "value": "T11CA4EF28687FC019C5E3EEB52DDCA8BAD99A55E3640C703701B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246518, "uuid": "e9cab742-6da5-4541-9656-dfbdba341fe7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246518, "uuid": "87c48221-d754-4640-ae21-6d362e74c306", "value": "12288:e8klT97igBMJM8Ajhq/dK98KGa4YR1HK53f8hit3hDyYhE:eD7jhm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633246518, "uuid": "f76ae4a5-ed54-47ce-be52-ada65084b201", "value": 449893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633246518, "uuid": "7207b7a9-8c79-4d00-860d-8b84dd477e70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246518, "uuid": "167d690b-5dd0-4e5b-a1bb-1e1d58776bfd", "value": "d90f6e2a21a073ac1e03654d85f6f69a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c20a050a-2445-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633264256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264256, "uuid": "7b2fea57-c1b4-4f6f-a57a-73d87847e8d7", "comment": "Malware payload", "value": "77660feaa0a13e4209e50860de77a2db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264256, "uuid": "33bf9ba0-fc92-4e52-9978-8009fd822ff7", "comment": "Malware payload", "value": "cd6f4032380cd399d9320ddf9bc6f805838e455f9ab39e84100b30307cf028db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264256, "uuid": "6233453e-23a2-4de7-bd35-1b50733a39d7", "comment": "Malware payload", "value": "15e7e73c32d8f2faf284ec0db24e405fd255be2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264256, "uuid": "448cd556-d04f-44fb-8b01-9272fb135a35", "comment": "Malware payload", "value": "ad485829252afff79258099359887bfa10b9cc5867e0af79702ed4238af58a9e9090f9b60af44f3a897d082efcee99f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264256, "uuid": "b63b2d30-60b1-4d9b-8224-892a1c79dfe7", "value": "T131056D972DE48CB6C652503CAC8DDA96F424AFA7296CD85257FF485C273F276300839B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264256, "uuid": "315ac80f-9ac6-48de-8a93-10855211d2a8", "value": "6796b43d150beb39239379fdfb5b2577", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264256, "uuid": "681b43f8-d9a1-4ed6-8cf3-b5ec6d09dc99", "value": "12288:ZsuzGJs/oxKZsztEkPvnoO90Oe6jkOGbGnr4:Zzr/oxKizt1vjGO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633264256, "uuid": "9d5e9aef-5e4c-41f9-a4c8-cfa1ea75ec31", "value": 835072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633264256, "uuid": "2777b00e-1efc-47a7-87d3-9c91a963d838", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264256, "uuid": "5c02704a-4047-4e1e-9b4f-6e6d81f42779", "value": "77660feaa0a13e4209e50860de77a2db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb3055f-249c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633301370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301370, "uuid": "ce498563-1da4-4b41-b46a-04be6641b7a0", "comment": "Malware payload", "value": "590f72fda45cf843b515be8127ee7691", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301370, "uuid": "53d21a01-b403-4624-9815-044d454d0894", "comment": "Malware payload", "value": "ce63d0229ddfce614f3d5bf83727f9c93b554594e48f7a617a39ed3aacbb0427", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301370, "uuid": "857c7544-edae-4c21-aaf7-9575dcbfa418", "comment": "Malware payload", "value": "92a7645632a8b61e5cadeb4aca8ba85303bcc37f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301370, "uuid": "49c1887f-c6b7-4ac4-aa74-40a8ffbb9c06", "comment": "Malware payload", "value": "f1aa81b161cc779a1266f579cdafb72f7cf2dc6616b94a385c72848d3c1cfedafc60863a9b64df2750ecffa4a14bf183", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301370, "uuid": "a5aabe9c-b982-4e68-833c-15943e1f75ed", "value": "T111B3D86A7921AFFEE06883310BF7AF20C7D521D626915386F15CE7585E3128D2C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301370, "uuid": "90ea638b-616e-4f2c-8642-34d064fc2737", "value": "3072:C/4g3Kd1r15hZmxgA9OKdwwjF9GhsR1Ae:O9an15hZLHKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633301370, "uuid": "6117b766-1a25-4ea2-8e5e-c07c0e75b03e", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633301370, "uuid": "0c40e768-4cdc-4223-a2e7-9e38b4d00a36", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301370, "uuid": "43ffcab0-1aa4-42ec-99cc-a4d95ae58172", "value": "590f72fda45cf843b515be8127ee7691", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4428303-2445-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633264314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264314, "uuid": "e3a8f502-e4a0-47b1-9f9f-9ecc02d49d94", "comment": "Malware payload (RedLineStealer)", "value": "eca7ff7ab84611c1bb487f7e94fc5fa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264314, "uuid": "ee06cfd8-ecae-4ac1-9041-ec618d70d829", "comment": "Malware payload (RedLineStealer)", "value": "cfa3fbc90f716e334b59c121fc7374b2adf4b5290bf461007a5fa514b5338553", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264314, "uuid": "5eb7ab8c-55f3-49a5-9c4d-982583f6621f", "comment": "Malware payload (RedLineStealer)", "value": "4dc7af6428bde41e0e40a89fdda393b82bb4710f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264314, "uuid": "3d8ad18b-6351-415b-b599-4d59d762f5c1", "comment": "Malware payload (RedLineStealer)", "value": "39ea3d13716a238f711d826034501df6147efd818606195456203ffcc82d6d6f2a379a0aed660700e9237a256a34c70a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264314, "uuid": "704b6aee-6fbb-46e2-97f9-297c2d3a55b6", "value": "T14284CE097691CFF2D37105B1AB26C7E14A2DB8295D2B524F3B9C3B6EBB3D3918621341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264314, "uuid": "1aa1ce6f-b1ba-4582-8195-54eb4d29233f", "value": "401c37f2bd821b3afe64e4a9a74e43f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264314, "uuid": "9b6a208a-63d2-4c05-ad21-d68670645476", "value": "6144:v+S8E8XvLSZrhzMRrmXeGEaUvuYNogFkYQ8ED9nlCfL6MCOhxxFeTr/ekI:AuZrhvZEa2uYNogkA+lCfL6+zxF6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633264314, "uuid": "2e737cb9-bb34-4536-a382-488af0b03aee", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633264314, "uuid": "dc0152d7-4db0-48ea-975f-fae61679eba0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264314, "uuid": "023be19a-1c9d-458c-9df5-495eaad303d4", "value": "eca7ff7ab84611c1bb487f7e94fc5fa1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45baa6fa-24a3-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633304420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633304420, "uuid": "72e297cb-c32b-4325-a82b-d203b081596e", "comment": "Malware payload (RedLineStealer)", "value": "94f06bfbb349287c89ccc92ac575123f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633304420, "uuid": "8fd547c2-2c6c-426e-a434-d35167a56c10", "comment": "Malware payload (RedLineStealer)", "value": "d05cb3a734aaa9d090be20fbaeddf8069a829fa78c44dd8378a2350c1510e1fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633304420, "uuid": "b0f8c416-9300-40dc-b027-c26a0bcbda2d", "comment": "Malware payload (RedLineStealer)", "value": "34e36e640492423d55b80bd5ac3ddb77b6b9e87c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633304420, "uuid": "e3407970-4b0a-4586-9fed-5d4f7007ffea", "comment": "Malware payload (RedLineStealer)", "value": "a8ff3103be7c78cee689cd56d699789d7dadf1156f797441ee1e9a72ab9b30fa037d642f1dcf4c262fb35a05609b9a47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633304420, "uuid": "14537c38-3a32-41fc-87ed-e15489129728", "value": "T19BD4493155A4F866F4A50CB8A1A6E3B798286F798AD78493F2B1773F86313C07C24537", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633304420, "uuid": "5922cf30-bbd4-45c4-8437-6aaafdbbebe5", "value": "5e66d8d528d67d716d50d46578794396", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633304420, "uuid": "61b0503c-05ff-425b-893a-2b5b2d889bcb", "value": "12288:yDt6vSvIGmVujfMGTFXTktmgGak6H3lP3XJik0YhBhr60p:yDMVnGhIt876j0KDr60p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633304420, "uuid": "c918addc-6d9a-4e3b-bce5-82af577f0938", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633304420, "uuid": "fb2bf529-6dcd-4fe7-8621-72a30b4c95cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633304420, "uuid": "332f2e2f-365a-4a7b-b567-958b71f69aa8", "value": "34e36e640492423d55b80bd5ac3ddb77b6b9e87c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1ff8a7a-247b-11ec-843c-42010a9c0014", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1633287530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287530, "uuid": "f768b4c2-03c4-4d4c-874f-4b2a2351a4ff", "comment": "Malware payload (YellowCockatoo)", "value": "6a1572c7ebabc7a1aac4eb7b1f0cde1a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287530, "uuid": "505b9f59-eee4-4912-915a-bc3b7482b223", "comment": "Malware payload (YellowCockatoo)", "value": "d10b7a077a506f76cc14ff96f348f3cf114a8ea3e311f7061e60cce2f2cc5550", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287530, "uuid": "9f517b11-7a7d-423e-bacd-b46ed9c464c8", "comment": "Malware payload (YellowCockatoo)", "value": "a1b3767949e8fa5b2690e0b69f1f4746840d2562", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287530, "uuid": "1c895834-1e19-457f-aa64-48185b797791", "comment": "Malware payload (YellowCockatoo)", "value": "a80d86820b84fac61de81c0618ea3b96b9110c8a0f1961de838074e374f46c0db3810c241ab39caa665bb00124007641", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633287530, "uuid": "4a33d20b-31b5-4a47-979d-1090837be6e3", "value": "T10653D70A2AD742A2CCDCFCFA4931E616D738E113DB17EB9C2FA998655D56D418CEC00B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633287530, "uuid": "bd4d8f3c-a911-4e8b-8b72-4e439c71e941", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633287530, "uuid": "8416393a-d77f-4c97-a287-c1e6820dfd56", "value": "768:swaHnlOmRJ/L6Miuco+JYk9GHgqICjjyv0v4F1t0T9V5C6H:swakaO+R0YKJqICX04W1g9/xH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633287530, "uuid": "33cec2f5-f6fd-4439-8319-48461f549c3c", "value": 60928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633287530, "uuid": "5e3249c1-bc03-43a3-8b8f-c1e29290f1f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633287530, "uuid": "6352ed91-10a4-4890-8549-aee007858802", "value": "79c5cb6e-2f65-4910-af43-7d7b07de69e3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9340cd37-241c-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633246568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246568, "uuid": "a56e2bcb-9b8a-4509-b37e-1d7c91b20a1e", "comment": "Malware payload (DanaBot)", "value": "c70150d4634ccf7bb7733ebdb4072f0f", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246568, "uuid": "c09353e7-dd77-4b29-b14a-cd90d5a4ce1a", "comment": "Malware payload (DanaBot)", "value": "d23fdbd760b506644824da200eb06eb927e1c007098b2bf356c025f7b527b5e3", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246568, "uuid": "20ffe55d-477f-426b-9c22-c8f1499aea57", "comment": "Malware payload (DanaBot)", "value": "3f7c3eaf46bf63aaa8562ebbfcea2d7aae2a495c", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246568, "uuid": "a76d5ed9-3594-45da-8120-5bbc9deeb5f9", "comment": "Malware payload (DanaBot)", "value": "3784f06ce4581922af2ffde54c63029c010eaef6c2166619bca0c7823d3dbcd3fa6ca1fb3900a4444aa09e7094de4b5d", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246568, "uuid": "1adaaab0-ad18-46a0-b8cf-5a0d73753ba1", "value": "T104263351EDF3E73CC9828BB6C593643939F5201DB962DE1B1301C8CE7754882AE8677A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246568, "uuid": "8e2add42-ef03-4d4c-98be-80d0e6158d1c", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246568, "uuid": "d9627e76-5eeb-4cda-b240-9f3ad73e1307", "value": "98304:YZNbJZWu98KyknVQXIg+mK8aLks8Ssevxb9yTl1Jeg3V43qOLSdKw:YL6qdff8aLvNZv6TnIg3Ld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633246568, "uuid": "082c50a2-28fb-421c-b9e2-7070ffb1acdb", "value": 4489026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633246568, "uuid": "843bc447-994d-47ee-adae-cc66074fd411", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246568, "uuid": "0401d1fc-262e-4508-82d9-d8ef01731174", "value": "c70150d4634ccf7bb7733ebdb4072f0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a536c9f7-249d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633302004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633302004, "uuid": "95d535c0-8c33-4597-bdb1-807366748019", "comment": "Malware payload (Mirai)", "value": "57607034f363b102e1ae1d1415e93704", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633302004, "uuid": "d4108770-667c-4eaf-bee9-512faa199459", "comment": "Malware payload (Mirai)", "value": "d3ce74c85da0af316f37597c70cb76383796059fad266c0038e67a78fed0401d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633302004, "uuid": "8576154c-35b3-43eb-8004-f0889685a427", "comment": "Malware payload (Mirai)", "value": "79ffe2d02bab85cb67e24b94fefa4c8a46cc0565", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633302004, "uuid": "184f74c9-39c3-48c6-b6bc-a0bdc6e68400", "comment": "Malware payload (Mirai)", "value": "49ab97010051ff945df7058e6fabeed1d27741d0c7660d4c65def37836cf7c90953e18c2e792bb87e33189b3652657bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633302004, "uuid": "26bc73bb-0944-4bf3-84f2-f0228a97b46c", "value": "T108539FB7C4A89D98DE255578F21088399723E008A5A73DF6EA46C656D05BEECF00C7F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633302004, "uuid": "ca70ab7c-288f-47c8-8fa7-f86db2ffcf16", "value": "1536:I/xN6GOJeaUV7Y3bQIf2sOqBqX4sUEfs3C+/sMDr3d3C0KXa:IJNsYjY3bQIgqBqXlf+/Lrt3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633302004, "uuid": "d07fa2b4-1321-4a28-af27-9ea0e3c9d107", "value": 64344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633302004, "uuid": "3e066e8a-5d71-43b0-bc78-9190273a0a29", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633302004, "uuid": "89d73305-29e1-4cf6-9f5e-d6f82279c7ea", "value": "57607034f363b102e1ae1d1415e93704", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02c185b-241e-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633247449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247449, "uuid": "e002dcf9-6e5b-45b2-9199-5aa436d307e8", "comment": "Malware payload (RaccoonStealer)", "value": "24a29ecc0f75b1fc80035f0a98de09ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247449, "uuid": "c7dff4b3-b342-433e-8549-88ec7e3c4dee", "comment": "Malware payload (RaccoonStealer)", "value": "d44745936180b61269e1914fe91dd2a42d5d9178ddba9ab5fe66362c459a7e45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247449, "uuid": "e001783c-cddb-40c1-a803-1d7eb03e3bbf", "comment": "Malware payload (RaccoonStealer)", "value": "1be342a8cf27c0c9caf713fd7d84760f962f914f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633247449, "uuid": "6869661a-83ac-42cb-81b2-d896eddb9733", "comment": "Malware payload (RaccoonStealer)", "value": "abfcf1e5761cb9967cce8514de5b608ec3b4b4b7ec82f83f44e25fc72356a597cf1086f36c3474251229e8882ac9e3bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247449, "uuid": "fad93a32-75ae-4663-b7ae-582ea49e8aea", "value": "T1E1D4F10935A2EEF2D67506F06B2AC7E4556DBD28491A728F37D8372E7E3D381E612201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247449, "uuid": "f83131a2-fb2a-4aaf-ad13-9cb7fb76ae92", "value": "f37786a16a90f8f3f38c22c48ff5cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247449, "uuid": "8892582f-de0d-4579-92d4-69b7b327df7e", "value": "12288:SBz1uluKP0qGRsazRNGkSvqmbL31ENdhvbL6xizxd6L:CkluKPLGRsM3GRiYLmN7jrL6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633247449, "uuid": "459617c2-18e2-46c2-b394-ce164dc48aa6", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633247449, "uuid": "6474a5ea-0e31-4c5e-9f82-ae7c1e0a4cd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633247449, "uuid": "ee0ea65a-c470-484d-8030-ab30a0af759e", "value": "24a29ecc0f75b1fc80035f0a98de09ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da7b4f98-2430-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1633255278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633255278, "uuid": "a90090b7-867d-49ec-816b-111c2bd6302c", "comment": "Malware payload (Dridex)", "value": "d989670d0deede1db598a0b26642f01e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633255278, "uuid": "7683f643-a7c7-45e4-90fb-8df8b64a1011", "comment": "Malware payload (Dridex)", "value": "d506f18f771ec417c27a6528c17f08ee9d180d40a0a9c6b6ef93b7a39304b96a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633255278, "uuid": "604fdf98-c5c1-4c9f-83ef-6e185740f4e4", "comment": "Malware payload (Dridex)", "value": "dd3d5e91833a8a4005f0ee1fd09be2c3f364cb6a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633255278, "uuid": "04dadd5f-952d-4005-832f-1279a24452f5", "comment": "Malware payload (Dridex)", "value": "26b33687b2c038cc84c7e3ea2e19f76e48606c3301894f2159a8bdf5bccf47f30522bbe77378c0a25c75edbcbef9585b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633255278, "uuid": "c435575f-6994-4fb4-a724-abeb868908d3", "value": "T1F224024160DBACBBEF27E331E561958D688012B35C14FA3EDBF131C99942CBD46FA216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633255278, "uuid": "87957443-12a4-4767-bebd-fdf942189fb8", "value": "cb7d72b1965cb54ea4e455b434651b4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633255278, "uuid": "95e9dede-6691-4d95-b1d3-c9fa98bfc333", "value": "6144:j2mCAJ7HMLDzVZtm4lGqxkQVXWcEPuASN29BS0:zCAiLBoqxkqEPurM7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633255278, "uuid": "f49d8ec5-c9f3-46e3-816c-dfcc2af7acee", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633255278, "uuid": "81aef5a9-8769-4b07-a3ba-df75e68c4de9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633255278, "uuid": "bb63bc14-ed38-4a3c-be37-8a682f8c7a85", "value": "d506f18f771ec417c27a6528c17f08ee9d180d40a0a9c6b6ef93b7a39304b96a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b764f5-23fe-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633233798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633233798, "uuid": "4fce6937-417a-4138-b835-f6473fd3304b", "comment": "Malware payload", "value": "5ee822ea8496e387e66995ea6e96e114", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633233798, "uuid": "a4942561-4f1f-4e7c-a807-99d704b12f1f", "comment": "Malware payload", "value": "d539871164550b514a0950a377e4a18acc94b7282a2ac76daf563a7b84ce5db6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633233798, "uuid": "f4088759-fb0d-4463-b506-6019709d8995", "comment": "Malware payload", "value": "77e6ea26b7b3097c205109b2365b4a024dba72e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633233798, "uuid": "6e3dc111-5a34-49d7-9144-dc2d79827d54", "comment": "Malware payload", "value": "470c2b90e3cc2b234baa411eac6e6a55d38ded84ab8a9850b1033b48445afc52c6b1868eade08593915c0b52568fa0b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633233798, "uuid": "92748128-38aa-4090-84ad-131f3faee293", "value": "T16E84CF093291CFF2D6B615B1AB16C7E04A3DBD681D17B24E77943B1EBE3D3D19620242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633233798, "uuid": "07f166ff-1303-4bc3-8f0b-fe3c9a2cf1e4", "value": "f37786a16a90f8f3f38c22c48ff5cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633233798, "uuid": "1b69a737-8793-45dd-a9e5-91c452c56b72", "value": "6144:v5ZLNDRTzwL6VzKi/Mp0qSOFSf6adft90LeqJL6CyOOhxxdeTr/ekI:vlymzKgffXtO/L6Xzxd6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633233798, "uuid": "e7487b0f-00d7-4a20-97c1-cbdd314ff7b3", "value": 381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633233798, "uuid": "f181b6e3-740e-4eea-9d41-b250b518f75f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633233798, "uuid": "e415b69d-1022-4691-83a7-662ecc7c485b", "value": "5ee822ea8496e387e66995ea6e96e114", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c6e397-23ec-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633225979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633225979, "uuid": "71c51cde-5b15-47a2-8b8d-97342d6800fa", "comment": "Malware payload", "value": "b9b9e9368cdbdbe7d4d467609050d070", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633225979, "uuid": "3a830468-9dd2-4960-9a86-52eefa92f20b", "comment": "Malware payload", "value": "d5921a3d5c1991a430ebd2f14161cb976a95e9a7a97bd9a549277abada074b61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633225979, "uuid": "6a2778dd-5e99-4d51-8de9-df4fe58c65e1", "comment": "Malware payload", "value": "1ab6106c4cee0c784e09a826ced7323c42d9b3fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633225979, "uuid": "adc12cfe-805d-45f9-a429-c179360c9ba7", "comment": "Malware payload", "value": "a3efd7b253cfcb7dac6b20f03e8ff3349c8c614774811dcb7c781d4874b69180545cbe34eb3f37efdae55349869780c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633225979, "uuid": "9549c817-5997-49ed-8aab-5ba36f612dad", "value": "T16EA2D0FC150250C9D91EC0FE47D683E13E6A0F26F143FCC269D9FA4ACA921A474972E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633225979, "uuid": "4c49cd34-d978-442d-b927-988241360cb5", "value": "384:XGESeb9/UaL6DfaVmwZuiXW6YMTUfsruH7AntkU6JgGlzDpH7uNj1JQ:d99PLif45u0Rssm8j6JgGlzDpbuR1JQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633225979, "uuid": "8ba7b070-0ef1-4fbe-84f6-66e20a57baab", "value": 21836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633225979, "uuid": "6ac1a54f-cbf7-4e87-ad3f-1adfd2306860", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633225979, "uuid": "e6f0f8fd-a0f7-4cc2-a8b4-97243bc224fc", "value": "SecuriteInfo.com.Linux.Gafgyt.BEE.25546.2955", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "641f03c2-246b-11ec-843c-42010a9c0014", "comment": "Malware payload (Pony)", "timestamp": 1633280420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280420, "uuid": "268cf705-3b97-47d1-b793-d62fa5a3ddbd", "comment": "Malware payload (Pony)", "value": "c43892f84efa37a82745700d11fd3b8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280420, "uuid": "10097690-96bc-4185-b909-1a871bf162a2", "comment": "Malware payload (Pony)", "value": "d6f128c8cc5257acccffb5e6c1fccb4eedf7c4f01247bf6287baa1f39570e444", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280420, "uuid": "22dcfbfe-0af2-409c-aeeb-d445e6c9c4d5", "comment": "Malware payload (Pony)", "value": "fe7a06bccdde60e1b1f44259b242eb99a948da2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280420, "uuid": "cec79720-0387-47a2-ba77-cbe48e26842b", "comment": "Malware payload (Pony)", "value": "cbe5961a1c5a3d2739282a9455996d6f7493f33749a12e166d51f8b3e85af48db19fbd5e0d2f55f843f1c0ecadc2cf18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633280420, "uuid": "7629c813-88af-42cd-95e8-290b0fd3cd27", "value": "T1B374F111EA43A8B6E114FC3B85A099A30DD0AF126743D71BA8953D16CDF53B24D93F3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633280420, "uuid": "4cf7ed40-1d10-406e-9faa-a7b66560c890", "value": "7fb04575d992e3910146b10cede0eaa8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633280420, "uuid": "ccaccc19-6c30-4656-b2e4-5ce10c944f2f", "value": "6144:Jc8pqU8Lp+pVuFSdsURz/nvDLDtaF3KMrboVRcWxrV90ALa:JpqUip74J/nvDLZg6Mr8VK+cA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633280420, "uuid": "dd345575-2508-42bd-a3c9-2e908c89deda", "value": 348160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633280420, "uuid": "93e4feb3-c761-411b-955f-568ecbefc3a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633280420, "uuid": "2b25f0ae-28ad-47a6-b0c1-ad32d7886300", "value": "D6F128C8CC5257ACCCFFB5E6C1FCCB4EEDF7C4F01247B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2048dc8b-23f6-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633230055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633230055, "uuid": "7dd8fef4-1826-43f5-a7d9-a73055f25a8f", "comment": "Malware payload (RaccoonStealer)", "value": "ca05d5c9d10cab5d37a38622ef977d1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633230055, "uuid": "643b9f70-5be4-45e0-8c7d-3577b0bc9482", "comment": "Malware payload (RaccoonStealer)", "value": "d71146b3ded09f0b0160e990d6952d5feea4d6d682b1d8854ecfee5e865dd0ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633230055, "uuid": "db56a545-7100-4050-9cf4-5449ba032bdc", "comment": "Malware payload (RaccoonStealer)", "value": "07244fe7a7c93d8adb1a8ba5f65c8ab91e60c231", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633230055, "uuid": "5f86c11e-52e9-4115-bb24-300739164f0a", "comment": "Malware payload (RaccoonStealer)", "value": "ff175c48089e452fdb99cea5d4d727146a2f7cf77a516aef20539d0495a5a0fdb7c79181656c1a8aaa5031755d4f0985", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633230055, "uuid": "35e9f8a2-06be-4f1e-a08c-b30eecff0082", "value": "T1D0B4E13073E0C031F1BB02F949B98379A92DBEB16B3491CB63D526EA16746E49D30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633230055, "uuid": "0b3009ae-d8c0-4c85-a360-45a0b2b30854", "value": "a9424a96bcb9e21c7e2701c8df603c55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633230055, "uuid": "4b19dcb0-91e4-4dcb-ab1f-441e024d49d0", "value": "12288:46XJYCRnt9WhKk1qv26NvdPXjwB4cgYiCg/zgJI:dLt031qvFRXsBECGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633230055, "uuid": "80dfd856-ebbf-4d77-b7ed-081c65e11d11", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633230055, "uuid": "162be731-8d99-417f-b859-24bd91fa286d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633230055, "uuid": "aa2554c2-f965-4f59-9fca-f938c52b48f3", "value": "ca05d5c9d10cab5d37a38622ef977d1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "717c230b-246b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633280442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280442, "uuid": "dfedbd4f-98d9-472b-bcf2-757849eda1fd", "comment": "Malware payload (Mirai)", "value": "92ff97410e2ae9a51edb521b8a345315", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280442, "uuid": "6c122c69-dfe4-42f3-a5d7-6c428ea8a477", "comment": "Malware payload (Mirai)", "value": "dc55e5e9a07c0b22f58efc56d7f720583fefeb1ad5f8ceabc5ade1429043bb69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280442, "uuid": "96404bf8-cf37-4032-96fc-13159927b9ea", "comment": "Malware payload (Mirai)", "value": "a05e7710434ccddc1b603d990a5e8876c7e1c595", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633280442, "uuid": "0042f780-a26c-48d8-9b98-f0f7e7a736f3", "comment": "Malware payload (Mirai)", "value": "50526b0d91aea903dc1c96de845c2d1d5fd5e7334a4fd8b883660fe89da9348ecf2404cd656aef31df0cf472cbc421bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633280442, "uuid": "45b584ec-6d3d-4083-9473-8ae1dd7e199b", "value": "T11DE2D0BC6782099DC84BD1BB94E70FA11FF8439AE5039C53A62FC9429A665723C43ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633280442, "uuid": "6784d676-2d1e-4aa4-960e-a0e453e6b89b", "value": "768:ogc55zJGcave3k7PAadA4oTqzx85z1egux7PmjJgGlzDpbuR1Jm:ogcbJce07P1zCz1e/x7PmZVJus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633280442, "uuid": "54a69551-ef8e-48ec-acac-16e135696719", "value": 33372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633280442, "uuid": "d406e520-06f0-4b94-a935-3bcc6bdff1fe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633280442, "uuid": "d419696f-bce9-428d-a267-1bae5c5b07fc", "value": "92ff97410e2ae9a51edb521b8a345315", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a141269b-23ec-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633225976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633225976, "uuid": "f301aa77-6a8e-4b0a-868d-6d398ecc170f", "comment": "Malware payload", "value": "6636a5d5f9bbe97727f9965ff9523504", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633225976, "uuid": "62b9b925-d313-48d0-a0ea-8ed95b44087b", "comment": "Malware payload", "value": "dd66aea806b127188cb6dc5402b1a12fa35a16600d8fa5e73c4bc173278310e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633225976, "uuid": "7bddb34f-7ec4-4ba5-a774-05ff55288b91", "comment": "Malware payload", "value": "b38335141c903de0c44411e65a50915d1cfaffc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633225976, "uuid": "a0420d9a-71ec-417a-a950-969e8ebfda11", "comment": "Malware payload", "value": "296964bf932af1acd7fecb2876956ba207b095e66d1db5761dc431d1bef2324bd9dfe058ba200fb4e01e825f93a86be1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633225976, "uuid": "a8cb9d00-eee1-49f8-9bd8-e6de121138ae", "value": "T192A2C06DFBAEA707CD8D4878904C07338DA422D0278D5AD677015DC4B23384BB98E84E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633225976, "uuid": "58809859-2785-4efb-88be-754d638627c6", "value": "384:Z8i/J26qAQzdlfTdQs+fpOFZfpCS2rtQJRWGVCz0Nvgv:Z8ixqj6s+hmp8mHWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633225976, "uuid": "60268b51-b5f4-48cf-9d37-33d784d0aa10", "value": 21980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633225976, "uuid": "807f92e0-38d5-4f14-90fe-35a9063b7aa8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633225976, "uuid": "f732c6f7-8c33-48db-937e-e7cf0303d0f5", "value": "SecuriteInfo.com.Linux.Gafgyt.BEE.6395.3145", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99558096-2445-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633264188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264188, "uuid": "bb466bb9-d8a5-4ea0-b896-02412ab9aaca", "comment": "Malware payload (RedLineStealer)", "value": "cf2788629959d897c9579e973b15a5d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264188, "uuid": "c814eff9-9d1d-426d-a69e-f1617a4e889c", "comment": "Malware payload (RedLineStealer)", "value": "de1f0fd799400e19b3861700ccbf709ca7f4868571a211ddaae754420ce8a128", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264188, "uuid": "4161218a-582c-4fe8-be1f-c6eb269e6e7c", "comment": "Malware payload (RedLineStealer)", "value": "e87acf073ff2dc8b046ac2ae8a2496af1d6fc98a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264188, "uuid": "349a03d2-96cd-4d3d-ac21-bc8d5afb921e", "comment": "Malware payload (RedLineStealer)", "value": "f275fb090cf00781ffbd91ec15cc6387ff496850b6e0c449b1f3aa733c3f3c4d7a991e702c3548d728845990c53ae08b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264188, "uuid": "ae105c11-fe67-4616-a673-e2c44cf15ddd", "value": "T16063B4B7406154A6C5492334E4B10F0B7ABCD6351980B698F44FF2EAEC1D69D9EF83B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264188, "uuid": "1baeb571-228c-45ef-8610-caf02fa9fd20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264188, "uuid": "c61fbddb-81c1-4906-b709-e6c3b160ab1b", "value": "1536:7ubtvCRNrIdViwWXvTMmQ5tZGCotMKOH+:7ovCRNrIVW7MmQHEPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633264188, "uuid": "2b72210d-9603-4ef4-9a4a-31b00532004d", "value": 70656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633264188, "uuid": "ea21350c-3217-4e70-af6e-543827ff5736", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264188, "uuid": "8d0da43f-2dc3-476b-898f-0a711887db42", "value": "cf2788629959d897c9579e973b15a5d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b498a5-2438-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633258541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258541, "uuid": "795bdd75-d2af-4c0b-b73b-1d1b16c0d51f", "comment": "Malware payload (Mirai)", "value": "89ea4f5be6187e7ad36c60d22f949b2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258541, "uuid": "d200a903-87d8-4a0b-9558-e868ee65f210", "comment": "Malware payload (Mirai)", "value": "dfe339786bb272606bd240b6ef3be0e295c46d4926198736eed317d0de75073f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258541, "uuid": "7e533924-5168-403b-9b51-b81f59084c98", "comment": "Malware payload (Mirai)", "value": "453f1b84e5fe2a4ff6185ff482555e594e616b1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633258541, "uuid": "52d5deaa-0910-4c10-be52-ea89fce92f35", "comment": "Malware payload (Mirai)", "value": "6e83d3fcf72c632389482664396e8bb7e64342d999faa9d3789bac5af511f3d886c146249a601f0c2cf23fdc68656dbb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258541, "uuid": "fc047ec9-af2d-46d4-9706-08f85b300be7", "value": "T1B1C2D022D2B6DFE2C5B05930B6349B4273154674CD2D32A276088A34FE8D65B1FFA487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258541, "uuid": "182c24cf-cd61-4b25-9aca-4e252272f43c", "value": "768:F6rNqWr3afcQOA5tZ2v0apMRxWjjxpzs3UozLD:2n82v0tRxqpezP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633258541, "uuid": "c3edd398-6bb6-4629-9199-67582799f2e0", "value": 26948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633258541, "uuid": "910b7f79-212f-4bee-921a-336152ee3bd5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633258541, "uuid": "312451f2-63fb-4a81-a4ff-51aa930ae3ad", "value": "89ea4f5be6187e7ad36c60d22f949b2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2edde638-240f-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633240817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633240817, "uuid": "dbbf9420-dbfd-4f27-8155-4e8db22852c8", "comment": "Malware payload (RaccoonStealer)", "value": "af210b2702605c9cab20ac393ccde2a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633240817, "uuid": "6cb594b1-091f-452a-814f-610b1d957d79", "comment": "Malware payload (RaccoonStealer)", "value": "e0b642c24bbaa80348a1a52973bdf57a8b92762fd61df82ca3f175a091495524", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633240817, "uuid": "823d4abd-1fb7-48e8-a636-fcbf72bdb3d9", "comment": "Malware payload (RaccoonStealer)", "value": "c8584835cdfba1ef7bb3d1d3f6be6114c0534088", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633240817, "uuid": "add3c62c-b9a4-49a6-844d-8c3d68b58f61", "comment": "Malware payload (RaccoonStealer)", "value": "7fec69864df4bc6398f312603bee16ccaf779ad3936ad3797a396d58b119474b0c45f5b3a31bd6f55898750212261fbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633240817, "uuid": "9e821022-e980-481d-860d-7a5c57441ddb", "value": "T185549D193182CFF2D67601F1AB96C7F0092DBD694E27368B3B98375E7E3D3918621252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633240817, "uuid": "ea1f0df6-64ac-4a11-9863-88e264671600", "value": "f37786a16a90f8f3f38c22c48ff5cfc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633240817, "uuid": "d36e3b90-3bec-4e66-99a5-d7c3e54d1a9e", "value": "6144:E/9cSPf0NLeK5PzX+tdE8vgg2Mn0qJL6tOOhxxdeTr/ekI:Ex8TzX+c4gg7xL6Jzxd6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633240817, "uuid": "35476cd1-421a-466b-8dca-23d9787718b3", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633240817, "uuid": "522b2845-56a0-4385-b85f-e4ada0a7514f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633240817, "uuid": "bda53a88-f71f-4686-8ad0-f6624ef32ee7", "value": "af210b2702605c9cab20ac393ccde2a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9782dad-247a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633287005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287005, "uuid": "4d7b4ce2-1de5-4eef-8e91-49b3f82418c1", "comment": "Malware payload (Mirai)", "value": "c1a985c6e951e3c7b7a716c7fdea6d54", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287005, "uuid": "727d364f-2a93-4b06-baae-130f8ea77a1b", "comment": "Malware payload (Mirai)", "value": "e1c18efac6142bd6040812b6ca363a46c061ef37a2de587d82acff227bb9178f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287005, "uuid": "d7ab20b5-a060-4a0e-bd1c-91b4e5b4dd59", "comment": "Malware payload (Mirai)", "value": "27de9636c1d5a4ab5e4a54e49f24bd8b207200fb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633287005, "uuid": "cd348274-9efe-4350-9bbe-c1edb6146739", "comment": "Malware payload (Mirai)", "value": "dbdff8f2d30317808733e5d55b71c60d6d9857aaa3a286e60e793674f5f516fd284fe402493590b3f1df61e2d55cea1c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633287005, "uuid": "44695c54-7a4f-4898-8d03-c551456698b4", "value": "T1C3C30805FC404B27C7E22BBAF79E438D773666586BD733116A295EF02BC5B882D39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633287005, "uuid": "8a5862f0-f345-4368-a45d-ea51a3f3a709", "value": "3072:EJDZ+6lJQTnoo3YKdLrLmkx7Wy5hLXcuXE674eoC9DQlD6ObAF5R:LXmQKy5hLXcuNVoC9DQlD6ObAF5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633287005, "uuid": "73272f2f-909c-4d60-9335-72efd19666ef", "value": 120771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633287005, "uuid": "064ab8b8-81a6-4d4f-9f34-f14f898d5e70", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633287005, "uuid": "789b88cb-3836-47df-be65-bcbdc9487a22", "value": "assailant.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167a6d7f-241b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633245930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245930, "uuid": "5011e318-60fe-4dc6-96cb-ca23c03212ab", "comment": "Malware payload (AgentTesla)", "value": "155562952379775f1f3f563d0e70c507", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245930, "uuid": "750b57f6-5b8b-4205-9421-7294ee736268", "comment": "Malware payload (AgentTesla)", "value": "e3e139bf613e0813cfd1c3c82643986985d1ce57ce772450c196cdcce367380d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245930, "uuid": "7ba6995d-b99a-442f-9bf6-0f9a55c08dcf", "comment": "Malware payload (AgentTesla)", "value": "db7cc38a6626a3455a7b5ae78c8d751722e4545a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245930, "uuid": "9c2198f2-9a7e-47e3-8060-c4bbd4fce447", "comment": "Malware payload (AgentTesla)", "value": "09af14a9c4061b6f3e2734698e8c10bbe5803c2ed64d73469e92b9079132986a3c53099d5701555c6062efee5d2c3925", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633245930, "uuid": "b0b3e6bb-e5b9-47ea-987b-51720dc0a8ac", "value": "T13FB4E09D321771AFCC67CAB1C9682C90E76075AB521FC213A01B129C695E6FBDF106B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633245930, "uuid": "17edf8c3-5155-43dc-858c-887b7fc8c847", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633245930, "uuid": "0896e313-b0f9-4199-b2b8-41ef6c7075a5", "value": "12288:ldc7gXdeg2kBdM1DSzCmDpnnrGSUqaH5RP3NVoI2g2:LBXEg2kBdM2RlrG0iR/T2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633245930, "uuid": "ef6e2c11-0485-4df4-a5ae-d1bfcb84fb66", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633245930, "uuid": "08b6845d-197d-4bf0-aec9-6b2346ec5298", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633245930, "uuid": "f4b87d29-ce7c-42fd-8bea-d8e5dc382cdf", "value": "DHL Shipment Invoice NO - INV8425487-80228.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "521bef3f-241a-11ec-843c-42010a9c0014", "comment": "Malware payload (Matiex)", "timestamp": 1633245600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245600, "uuid": "eaff554d-ff03-40b5-ba51-d981a633650d", "comment": "Malware payload (Matiex)", "value": "8a534412d79af46791253752c3f81917", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245600, "uuid": "a1457596-6189-4a35-8e8a-c4b3ebc3a629", "comment": "Malware payload (Matiex)", "value": "e3f3ed02da22278148950fd72bda0a410d5fd60e56975507da774f392ff099a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245600, "uuid": "b578bb4f-b901-4dbf-9f43-3a5440672082", "comment": "Malware payload (Matiex)", "value": "6efde4c9d582b110b1cc342b2ba18df4c637acd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245600, "uuid": "dbcc5eb0-7e36-4dc3-8f90-114cfd341b15", "comment": "Malware payload (Matiex)", "value": "f4067cc527c076c603790dd4dbb81555f12daa38308c9547b1cd41327a7edee1df260d660d400b6e6a29869ce259487c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633245600, "uuid": "641d652e-b8cd-49d6-99a5-86e3261c9ff4", "value": "T1CAA4C0379F8BA910F5D8C6BDE4A143FDE1B2886DCDA37785BF925B412806244EB354C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633245600, "uuid": "3a71ad9b-7a51-4521-89a6-8647af829d13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633245600, "uuid": "ada68f8f-3108-4a22-8e63-e059fc9ab339", "value": "3072:scwqrmzQ5UF25TzkioZ7MczKJgs80CEZbPRDjWmooHWMJW9vMhSVA:s4IQ5UFATzkiyMmKJgfsVWmjHWcW9v4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633245600, "uuid": "ce6d511a-d3f6-4096-98ac-d36b0c096405", "value": 449744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633245600, "uuid": "1f6408e8-c051-4677-b73d-dc3d385d26da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633245600, "uuid": "81bde87a-6955-4e9c-b19c-a5abf30201c0", "value": "8a534412d79af46791253752c3f81917.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4472110c-2435-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633257174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633257174, "uuid": "842fee47-543a-4ee9-992c-80399d36ac6e", "comment": "Malware payload (Mirai)", "value": "e98327a989b7f6ce0f8d2f1d506c88c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633257174, "uuid": "6a4ff9b1-f33f-40aa-b45e-54e37f86f0a3", "comment": "Malware payload (Mirai)", "value": "e7c7c7d017cc78e06708a646479e5130bde12fe63370fc104763c3e993593a45", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633257174, "uuid": "ed041d9e-87e2-435b-bbf7-c4aacf1186dc", "comment": "Malware payload (Mirai)", "value": "e08a04be781e1f7e3593940668841df0b6ffdd77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633257174, "uuid": "b5f2d2d7-7b1e-43de-95ff-ddd397b445ff", "comment": "Malware payload (Mirai)", "value": "eb450a60ab4a585467047900dccd164e8a4d522b85c6989711ccd8675be833a56ef3b15a1d94f9e11c088d1cd1719d0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633257174, "uuid": "7553d4e3-643e-4afa-913b-97c1df71fb58", "value": "T11653AE66C178BDD8D15D4674AD288A3C9703E4004AA33EF6DBD98B95804BEECF4983F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633257174, "uuid": "0d9a8c1f-41df-4edf-a86c-f715a371bc72", "value": "1536:oZaNJwtbXseug0SaNxr4PpxkKfs3Y+P/0NXiLC9:oZIJBeuXS05g1f+YCgXiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633257174, "uuid": "ae93f542-c5c2-41b6-82eb-5448b5030173", "value": 65228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633257174, "uuid": "595136e8-7e64-44e7-a032-874b0e7a7458", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633257174, "uuid": "31d59eda-4c89-4a18-b8d5-3a934ca36efe", "value": "e98327a989b7f6ce0f8d2f1d506c88c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bcc6764-241b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633245939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245939, "uuid": "85a1f088-9a99-4e5b-b121-a3cfc7e3810f", "comment": "Malware payload", "value": "f1c445ab94bbb3a5deed52a280fb20bf", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245939, "uuid": "c0eec0dc-7880-4d6f-af29-09f00bbbb8d6", "comment": "Malware payload", "value": "ecbc58676db48ba5b1998cac8438c5e46522fef907f9df0c1335d94f0d1cf3bb", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245939, "uuid": "334a9ebe-f816-4e41-b0b6-fc833c101ff8", "comment": "Malware payload", "value": "b55f67bb34f863b46405d5f73065efded894d239", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245939, "uuid": "dadebfeb-55f2-4211-a014-db1f964b0276", "comment": "Malware payload", "value": "47696752cf5c1fdaaffaa4e9a2e8fbc023010fef8ca82f8b8b492afb46faf0dd4375ce7fab0f3ccdadd8c35a1cbd545d", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633245939, "uuid": "ff9d701b-1f55-4164-9242-e0d9713ee202", "value": "T15641E27AAA2710C71705B064C6A139A48C73FBB0F6B85CA83503B6CED86C4C30639D4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633245939, "uuid": "b667cf2f-3406-44e6-81c4-0bad20103f1a", "value": "48:vtrtQTTTTTTTTTj9HggggggggggggmRQdFhgggggD37YTTTTTTTTTj9HgggggggC:o9iGdL9iGdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633245939, "uuid": "4e996972-e930-49c9-9962-d4c8b2932e79", "value": 2165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633245939, "uuid": "60a28914-cde6-4c1d-8e9f-a1262dd781ff", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633245939, "uuid": "a919f5da-9f1b-4fdc-8c8c-effcbc3ae8c3", "value": "Paypal Confirm 46765.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c687ba-249e-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633302535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633302535, "uuid": "d4939659-762c-42da-b0d8-22c3a29b3f52", "comment": "Malware payload (Mirai)", "value": "15af45843515bb10fc387d8a79ae8def", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633302535, "uuid": "7c7a0933-4957-4060-857b-5dc972be1230", "comment": "Malware payload (Mirai)", "value": "ecca58224d2ee23b1da18d6b564255d062a7c09d2cd30a6b32d8854bab4919f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633302535, "uuid": "265b04c9-e6fe-44f4-9c7e-32a30f079f5c", "comment": "Malware payload (Mirai)", "value": "3b311981476d48944dd1f77c9e427a66404412df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633302535, "uuid": "5e780f8e-03e2-4233-baa1-4d72a05bac58", "comment": "Malware payload (Mirai)", "value": "e0b69c6df595309a98bb1df4e9d4cb7cdbd19aa0d608f9c538529b5dc33db240d05dc34c8e860064b706374b68766c45", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633302535, "uuid": "c25f82c5-1f16-4bfe-a27d-5174c429f721", "value": "T1AE735C34A97A2E26C1D0B13F22FB8761B2E5260E25B4865D7CB60F4FFF2065464172B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633302535, "uuid": "ebdecef3-dc79-4d10-ac83-8fde5aae133a", "value": "1536:Azvh+FNkgj5cXlkqFfjzYWcSrGhQxV6vVgFpqxfNFxm:LtIYWc+8vVfxfdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633302535, "uuid": "d30b48a7-b4c1-4fb3-97b5-090d92b9af9c", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633302535, "uuid": "79f1ce57-cb42-461d-8ecd-d2d04d07fbfb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633302535, "uuid": "03660434-216e-4531-920b-d929edf8f1b6", "value": "15af45843515bb10fc387d8a79ae8def", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a444d7-249c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633301364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301364, "uuid": "cb729d24-19b0-4fc9-88e1-7eefd950394a", "comment": "Malware payload", "value": "57b1b17174d53a05bfff57a9352618d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301364, "uuid": "c578bba9-a3ea-4950-99cd-0e499bbf0905", "comment": "Malware payload", "value": "f11fb3007b73a567d728472ef6a6a54fee3e23eef150687e452be1f69d90cfd0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301364, "uuid": "aea85e6f-93dc-4fa2-93d1-71f5bff0cb75", "comment": "Malware payload", "value": "19e4781a6123ccc21118a70beb4b25280c1d1644", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301364, "uuid": "c2797abc-9382-42d1-abfc-5d1ff361932e", "comment": "Malware payload", "value": "87e81f5fcc580e14dd3595d6716a03e774acc1f2864059e42328248cc785a5069a5a0182cefa2d291b5e7b164e413187", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301364, "uuid": "482364e9-4a6b-4032-bb46-04d27753bdd6", "value": "T1EAA32A05F9118757C1C327B6F78F47493B3167B997DB33026A34BEB02BC27991A2AA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301364, "uuid": "0daf3aa2-5cb0-4b06-80ea-cf1dfeff9dae", "value": "3072:7e9h9oZP5hvFfKufS2faYj0+rQ0Knm4XATe:y9wZP5hNfKfpYj0+rQ0Knm4XATe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633301364, "uuid": "4d8fce10-78b8-478f-a786-ff6b3ddda8c4", "value": 103862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633301364, "uuid": "5f7760f0-f8b7-4812-b6f0-8176d13d2825", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301364, "uuid": "4d1da84c-b342-4fd1-a457-28409ca4bef4", "value": "57b1b17174d53a05bfff57a9352618d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b148057-249e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633302282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633302282, "uuid": "68059f34-3d0a-40c3-bc02-d548e9106eda", "comment": "Malware payload", "value": "0f40753ea828276d2a1ffc5290767fcf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633302282, "uuid": "49e1e12c-9118-4be7-94fa-b07dfdb39352", "comment": "Malware payload", "value": "f24723275fef7c816ed025e24ff55657b5bbce2c0e8df3ffb59b8bec2890d405", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633302282, "uuid": "e021df79-8a7f-419c-b8cd-bea8df909c70", "comment": "Malware payload", "value": "3c7d50e58aa07269c25825c8821b7a9a710429b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633302282, "uuid": "5f8c8df4-71a4-4808-9b21-5dc6f712ff2c", "comment": "Malware payload", "value": "1b79313dd711b2e4f6aa84e88e8446562fca61d5a149f9348db431165c10f69570ced8bafdf6944a0ae5e98546b6721a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633302282, "uuid": "953d37a8-3c23-4a6d-8d37-b29c894cc22c", "value": "T18654BF183581CBF3D67201327B96F7F41A2DBC6D4D26564FAB982B1F5E3D3929A21203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633302282, "uuid": "565f88e8-74d2-416b-b6a0-1f20518b41c3", "value": "c15bb6cf111ec297d5d1e54944f0caf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633302282, "uuid": "7922a8bd-f24c-4fdf-ae8d-85669abbb238", "value": "6144:Z9vXkLCenXYIq7/WnuxE5b+xW8BWcROhxxpeTr/ekI:vv0ZnXB4unQ2byWZzxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633302282, "uuid": "19a53bbc-9638-4d29-90f1-9b5bf8170d60", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633302282, "uuid": "ba25f09d-20b2-4f85-9ecb-f33ec563cbe2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633302282, "uuid": "e2d96bb0-a70f-4174-b4ef-228e2e6408fb", "value": "0f40753ea828276d2a1ffc5290767fcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e783d7ad-2445-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633264319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264319, "uuid": "5895c249-45fc-4207-b504-7a0f5747ed57", "comment": "Malware payload (ArkeiStealer)", "value": "f4296e057438bc8fca5be982ded64abd", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264319, "uuid": "e4d0efe0-3f0e-4919-a16b-2b550abac72a", "comment": "Malware payload (ArkeiStealer)", "value": "f46473573c1bd9372cd44c830fc7cec27f4ea9b0d49164ce7fe1f38e58094153", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264319, "uuid": "d00cd341-7891-4549-8f4a-42378ee241ea", "comment": "Malware payload (ArkeiStealer)", "value": "a51e7899bd43c64d4be95ca46592b1be07401c21", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633264319, "uuid": "fab4720c-1280-49be-9531-f79247afc3ea", "comment": "Malware payload (ArkeiStealer)", "value": "6de647b85846cb4e4a7597966db95e1a03c2f4e8605e6b12ef24bb7d7af5a9baa4a49066c884066b0387d795af4dec00", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264319, "uuid": "0775d226-acdb-4888-97f0-1deebd479b45", "value": "T138F40125B9E1CFF2C7B500B0AB5ACBF0552DB8591926628F2B94F76EBE3C3C14711216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264319, "uuid": "1550a294-87cd-4d73-ac82-5896ca93bc3f", "value": "401c37f2bd821b3afe64e4a9a74e43f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264319, "uuid": "8d59e2fc-1a66-480e-8558-7393821db976", "value": "12288:0dS1IxClswYiol7KjlMJg22n/oD0FoiTHVuojqUIrJ5bQNHpjSgTElL6+zxF6L:bIAmiY7KjJ2W/oDa41r7ylSgTCJL6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633264319, "uuid": "99d2775f-f7d6-4881-bee1-a7c149aa1678", "value": 760320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633264319, "uuid": "2e363adf-e17a-46fc-9e11-f2c6d6f292eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633264319, "uuid": "609bb199-2e8d-4359-b24a-cda7240b360a", "value": "f4296e057438bc8fca5be982ded64abd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb6a447-23ec-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633225974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633225974, "uuid": "fb045108-65a2-4662-a780-587c44846132", "comment": "Malware payload (Mirai)", "value": "b696ef7887b82f1e847e5dbe16fe1c21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633225974, "uuid": "8573ca78-06a7-41c2-9fe2-81d97773319a", "comment": "Malware payload (Mirai)", "value": "f4f33604210603b05655063d516f95291c30f6d3e78dfe86b9372de07e7fd506", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633225974, "uuid": "6da36ea7-1fac-4afb-87f7-299300103a70", "comment": "Malware payload (Mirai)", "value": "871c4845905f67d0e24b235cfadb9c410cae65a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633225974, "uuid": "5b4fda97-6bef-4478-828a-61c3a1021838", "comment": "Malware payload (Mirai)", "value": "da1682b6c0a07650d57280507ff883422c864c6026179d5b83b1aebb330dcf04a7d2fb41d32f6321083c4999e4b4a2b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633225974, "uuid": "c3f8af0f-0530-4982-a120-a30afcf27e01", "value": "T14ED2D064197744D3D581BCB5E8E14F9AB40E0EBC66F575EB12340748BE0B0CBABE6381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633225974, "uuid": "699da361-3e86-40f1-b624-7c9a8384a282", "value": "768:D5uZLcCSZyIYjx/KN1t83xMFXy+6W4kmjU9q3UELl:luR0Zy5x/KN/mxqxUHLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633225974, "uuid": "d7c10803-4273-4e0a-a397-9c7a08d323c5", "value": 30556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633225974, "uuid": "58bd9ba2-8b66-4d48-b80e-e7091844d8ef", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633225974, "uuid": "bdf1aaf9-7106-4e20-a605-597a8e34f0c6", "value": "SecuriteInfo.com.Malware.ELF-Script.Save.5cd1e3ca.24043.31434", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c0582c-2403-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633235669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633235669, "uuid": "4075709b-ffd9-44e1-818a-1829c506df59", "comment": "Malware payload (Formbook)", "value": "0d0eb23c6bdb5657f2577b7be18fdc83", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633235669, "uuid": "393948f7-cc20-4739-8157-77335bbf25f8", "comment": "Malware payload (Formbook)", "value": "f6ca5176f67270da0b24a96184d0b6fb39d78819e3972add60d58480c9674842", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633235669, "uuid": "c489f924-6265-4f6a-bc54-b8537f7660e8", "comment": "Malware payload (Formbook)", "value": "d69e3ca3350ab43e96b486b4425262c2c64f81a3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633235669, "uuid": "2602f0ea-07eb-4d6a-b17b-96f44e37b1cc", "comment": "Malware payload (Formbook)", "value": "cc51fd4206db10760d66809e41a5cd8c3cc619050e5b5ef6c546cc266a24129105b88319763bb165b942ee5288b56fe7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633235669, "uuid": "f8cf0815-ee14-4c19-bc59-ca5e86a61fa1", "value": "T1B1C4237FB0924649A8DD58EE341B18F67C606DD74AFD58A87489F8A5EF42F3029BC007", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633235669, "uuid": "5afbd0a9-e332-44a4-94bf-8908c488b58b", "value": "12288:SNxc1NFchSvIN5H7Qdhq+GRvi1GqcvQURgTH/INg1ECyHxzrCcUuYE:2erFMbNghqc1GqcY6gL/IK1EBH5/U2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633235669, "uuid": "7c5a8602-ea0b-4224-9de7-d53e73f1a539", "value": 550368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633235669, "uuid": "2a0efe0c-6a8c-4c3c-908d-ec3129d38091", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633235669, "uuid": "fc3febce-e1f0-45fe-b0b1-df755d893b19", "value": "0d0eb23c6bdb5657f2577b7be18fdc83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d238ad-2483-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633290603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633290603, "uuid": "a3c1dc86-b360-4301-abc9-eb9989a0beb1", "comment": "Malware payload (Mirai)", "value": "4ae2c3c6f4d2ade74824b0685ec58e93", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633290603, "uuid": "5f45e3ab-5f97-4304-a9c6-3cd5dbc5ef00", "comment": "Malware payload (Mirai)", "value": "f70e74863cd0c7d497edd97e9aa50e8a87b561ef4b4c5d2480cf676a5168b2e8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633290603, "uuid": "9c088f38-68c4-4c98-9687-6b78b5cc4510", "comment": "Malware payload (Mirai)", "value": "970c9065b6c69abdec7235ca0834c5fcd4ed4128", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633290603, "uuid": "fd272850-8a76-4135-8914-183d53bfaaa4", "comment": "Malware payload (Mirai)", "value": "9a4b405756b5542cd107a3d2f130e0b17691267114fdc662c451d63967f7f9bc07f8f811f29a40491726c4f23723f559", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633290603, "uuid": "e2663965-399a-43be-b833-a23b17855da1", "value": "T1F933F139DE74EA81BB002DB5193B5A0FD2748BFD91FBF827326C80685350A7661DC683", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633290603, "uuid": "94792d21-4b76-4286-ad85-8322f667d883", "value": "1536:uPQoxMJ8WaEQ51TPvK4RZOeFwELyL0Z6ZnS+Qjh:aYJcTP9OeFwELGu6Y+Ql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633290603, "uuid": "fe188b33-63cd-4fb5-8a2c-95141917cafa", "value": 53756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633290603, "uuid": "a072da9a-2b41-4c19-9617-2e8712a0a2e7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633290603, "uuid": "80d2477f-f5bd-4c1b-b543-baf12947f79e", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d7aee0-241b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633246215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246215, "uuid": "06f794d4-4382-458e-9efc-04a9c874d357", "comment": "Malware payload (RedLineStealer)", "value": "67527daa3f2460f215aa2e8cc7fb31ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246215, "uuid": "de59b02d-be0f-4cc2-960c-44cbf20d7406", "comment": "Malware payload (RedLineStealer)", "value": "f769ea780719b11d09e16871d67e56a70626969507b9c638603f63ab37f6c3a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246215, "uuid": "c66e93e8-9089-4ea4-8be7-938587b2760c", "comment": "Malware payload (RedLineStealer)", "value": "2cfe43284bc6c546596fb1a6b50540e457fe719a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633246215, "uuid": "91cffa6e-1e33-4acb-97ff-9596e5269e59", "comment": "Malware payload (RedLineStealer)", "value": "b8b8f7ba4588511d07b417e4bfbe14c5b8ace6b55c971164ae67508c8cf37cdf0b0f819f5757215d30cc5994e58ff82e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246215, "uuid": "490f617c-f438-4e4e-b661-1b80c00e3f90", "value": "T122A4EF28687FC019C5E3EEB52DDCA8BAD99A55E3640C703701B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246215, "uuid": "fdc7a672-dc09-4230-a482-425c825b8d43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246215, "uuid": "90d9e3f1-fafa-4903-96e8-aa111451c0b0", "value": "12288:e8klT97igBMJM8Ajhq/dK98KGa4YR1HK53f8hit3hDyYhE:eD7jhm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633246215, "uuid": "017963ca-5535-4911-98e6-f3d59465fef5", "value": 449880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633246215, "uuid": "e836d695-e940-42e4-810a-80cae5b73da6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633246215, "uuid": "47ea1d97-c432-4f14-b14d-b44e1d016973", "value": "67527daa3f2460f215aa2e8cc7fb31ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2494dc2-249d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633301999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301999, "uuid": "6cd362fe-2f54-4210-ad5a-a54fa5597cf5", "comment": "Malware payload (Mirai)", "value": "b7fb2fc67e105c5f103fb9a681ac0fe4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301999, "uuid": "6d4920e3-aa73-4ce8-a829-1a9463f31082", "comment": "Malware payload (Mirai)", "value": "f85ece73e046371100a5851e84ea793468125f0d173a983573fc9935a3986939", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301999, "uuid": "2d68f5be-bb9d-4a60-829f-a5c665b26e49", "comment": "Malware payload (Mirai)", "value": "70f3fc29c45eff9f81917c09ea71c8f88b4b87ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301999, "uuid": "8a9fe985-2a79-45a4-8318-95f2ff6cc3a0", "comment": "Malware payload (Mirai)", "value": "ea7fffb8c9450a5a4afc1cbcd59a3b17f3d9b3948ee6453d0b0f34a07410e85316ba3f52fd46a073eb9d10e5ab7f3509", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301999, "uuid": "50cff4b1-4c35-466e-b7a4-27840ded9644", "value": "T189535C02B3684E0BF9E61AF5243F1BD483AEED8025E4B585A90FD7464235F33459AE8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301999, "uuid": "469db595-5f70-44fc-843a-be7f28e729c4", "value": "768:zipbi/131WUsTETbl1T9Q9n5pY5eEgGsllk5MDZH0a26lBHW2tdFsDMUQSDAYTgh:zT93Egl1wYAzk5a+8NbK1DV0Gg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633301999, "uuid": "d8f72305-7e99-49b9-930d-4ce0931e5976", "value": 64188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633301999, "uuid": "caf10f41-4229-4c3a-b364-fbeb7535955d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301999, "uuid": "96e4d1a9-485d-441d-92e2-f3ff445afb44", "value": "b7fb2fc67e105c5f103fb9a681ac0fe4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41956e95-249c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633301407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301407, "uuid": "74296b17-4846-41bb-83e3-41b366ee1f9e", "comment": "Malware payload (Mirai)", "value": "1ad4d7f2a1b218762c07e8a784b3a3b9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301407, "uuid": "10d9efe0-9528-4de0-8114-47d024eedd2e", "comment": "Malware payload (Mirai)", "value": "f8ee6bdb2d8836a69758a5b4d2c7310df5d634375d45b46e94b1e74c60458918", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301407, "uuid": "baaffa56-3e7c-4cd6-8332-0d0b52a7fc6e", "comment": "Malware payload (Mirai)", "value": "b21e9b6f1ce0fa6d4a8318f4ad9d5f0b72f1a478", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633301407, "uuid": "2d999626-b6f6-46c9-9346-f72712a95f4e", "comment": "Malware payload (Mirai)", "value": "072abc0c073e47a491e0474b668c27e62ab926f030572df70005f2506d2cc725710a01e8816d19e9ca93bf63d685bb9e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301407, "uuid": "dc5dcabb-8b67-48f4-88d3-598a1e2ec9ba", "value": "T17B532AC8E0E3E8F5EC14097D307A7F629EB3F13BB136E99BC7E95463A941602910625D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301407, "uuid": "4d39d47b-0990-4cef-b9bc-83215900ccd3", "value": "1536:1Uti+GXggf/bICZtbXYlaflSWD/aQfoT5aq3C3WR0:15Xggf/bICZtbXYlatSWD/XfoT4qSmR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633301407, "uuid": "8e15ffb0-2882-4547-b6d3-e4dfdf7a2326", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633301407, "uuid": "57c44f0f-3020-4880-b68f-051d0695fe3e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633301407, "uuid": "8c85bbfb-77c5-4aa9-b470-0031909d31d3", "value": "lessie.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e8c3d0-23f5-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633229735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229735, "uuid": "85c841ca-309c-408f-8697-372c83a667f7", "comment": "Malware payload (RedLineStealer)", "value": "b950c6f17474a2c7b859a55f9a4617c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229735, "uuid": "d1019900-abce-492d-8866-ba4e33d973f0", "comment": "Malware payload (RedLineStealer)", "value": "fa9e067be162eb6f3b3d29e04f65fd13e1e33210e153cce635f8092e64482f5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229735, "uuid": "90e99d0f-2438-4f20-8ce9-4b513c6e2c68", "comment": "Malware payload (RedLineStealer)", "value": "0f62564ed74c6db64e8ec9829ad5132c500653a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633229735, "uuid": "e7515674-5094-4cd1-862f-c39018086070", "comment": "Malware payload (RedLineStealer)", "value": "1be298be7cd0336c53bd475b90b902b7f4fa4ece4ddfd2e49c9acd733afce86fe3cc4c49422536ead12507129929faf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229735, "uuid": "6d359ec1-af83-4c8d-99c1-6a80d7dc8ced", "value": "T162448D30A7A0C034F5BB52F549B693B8A9297EB1AB3451CB63D02AEE57346E4DC30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229735, "uuid": "3d6bb158-ed60-4f27-9c13-650015cb2c8d", "value": "949cb2a875d86b476d185d15a2fa1cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229735, "uuid": "b815c02a-877d-49fb-9607-bbf2067d5ed9", "value": "6144:ovwtRGQZp3JtmX+MV/DT1lz2/DC2PtkSRksZAizU:oIrPZp3JAXNH1laOvsaC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633229735, "uuid": "9d4fb382-a712-4c3c-ad35-f3d392439a0d", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633229735, "uuid": "4a275445-ba6f-465a-9351-4bc17f3a0c26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633229735, "uuid": "8fe94b6b-65a3-4250-947f-50a320cc9cd4", "value": "b950c6f17474a2c7b859a55f9a4617c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a6d30d-2467-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633278538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278538, "uuid": "902df882-3ef9-414a-b432-47531ef5808a", "comment": "Malware payload (RaccoonStealer)", "value": "e0a254596e55304fc2291912fc908595", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278538, "uuid": "dc02b932-8e20-4dcf-ab25-1fe56ca32103", "comment": "Malware payload (RaccoonStealer)", "value": "fb62620d6cea268fb5789faa0d1024b53c2a854f2d319be71998829890314a2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278538, "uuid": "1363c5f1-9d01-4487-a5a0-48d941c8a653", "comment": "Malware payload (RaccoonStealer)", "value": "aa04c53f2ed1568b2c9035bfe7bb8a3fa1890938", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633278538, "uuid": "bfdeaca5-3eaf-4ad1-98b8-44322efb328f", "comment": "Malware payload (RaccoonStealer)", "value": "b4cdfaf5e84458bb0265d05061af5c1173de240a4bfdcfde66ba53601053076455be2b36e016e538771da3029ee15ec2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278538, "uuid": "8af290e1-8110-4793-a8c6-6423f004b08b", "value": "T182C4F00835B1EFB2D67511F2B726C7E0496FBC684929468B77983B2E7E3C3919225207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278538, "uuid": "a42f8f2b-f80a-49b0-bc89-a1d512f3da63", "value": "e1dc734f9d3fd8ffe237c21274508ba5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278538, "uuid": "8dda12a0-80bf-413b-b0b1-2bbfe6456762", "value": "12288:6YJcJf3GkwsTSG+uluiMUC2oCexXucxg1nJnL6+zxF6L:6ew/G2eGz0UzovKhJL6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633278538, "uuid": "fdb1a6cd-8952-4f67-8a3c-d8d8e6fb47b7", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633278538, "uuid": "66535b9b-8297-44ff-87fb-d380170af8f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633278538, "uuid": "27126dfe-75c7-4f5b-b7bb-22ceef0bc8d0", "value": "e0a254596e55304fc2291912fc908595.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56a9600-2472-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633283670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283670, "uuid": "6b05dc33-d697-433d-a847-553d23627702", "comment": "Malware payload", "value": "321a5256a690499305e126ae4e7c4e9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283670, "uuid": "0500dd7b-e809-4a5e-9761-5f7fa408bed3", "comment": "Malware payload", "value": "fca161ffc9d087fba1c9ea3fe19e4dce67d3ce7db4156adbd756988e33fedcc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283670, "uuid": "da20e791-98d6-472b-aef1-c9075e85ee88", "comment": "Malware payload", "value": "14becf6ddd693a19ff17bab3658934ef5cc920ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633283670, "uuid": "e9343328-ef75-4e5f-90ee-47ced1464ac6", "comment": "Malware payload", "value": "8936afd9c749a3966270eb0c6da83b6f2738c791b96fa501042c10d642a1a644d4f2fc85601911d007a4bc8a1fe7267b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283670, "uuid": "53eb08d7-8686-4951-84bd-6d2b5ff9fe2b", "value": "T128924A92C8281F85E12D8530B190AA387763D929F6C75EB78276CA64C447DCDF94A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283670, "uuid": "e51b6ae8-7a16-4812-b889-cdfe3b995d40", "value": "384:xKP66fBIhHFULq55PE+FRJ1pvBPkT5i59Y0ehxQmMTV/ZZ/vqBhTG:xKyQu2Y++FRBBGYbY0Hv0G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633283670, "uuid": "91dbc3a2-29b6-47c8-8d8e-9c47fe3ea3e9", "value": 21036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633283670, "uuid": "ffba4072-78a2-4dd2-82b4-c2c926a7f542", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633283670, "uuid": "9b88c672-c176-46d3-a1fd-5a832a6c1820", "value": "321a5256a690499305e126ae4e7c4e9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "610ecaf4-2431-11ec-843c-42010a9c0014", "comment": "Malware payload (DCRat)", "timestamp": 1633255504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633255504, "uuid": "f08de5b5-c51b-4740-a031-753623ba9f89", "comment": "Malware payload (DCRat)", "value": "5386b04035633f75622920e5e8b8bf25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633255504, "uuid": "27dac4a0-82fe-471b-8c57-dd88b07a8eaa", "comment": "Malware payload (DCRat)", "value": "fd4d8a70a36460fb62abfbb47681b531b2b085456583e84918c2c3ab8603c6a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633255504, "uuid": "69bff68e-91b5-4510-b9aa-5c8b7cd62cc2", "comment": "Malware payload (DCRat)", "value": "4c12a00fc3d5af49f555668643308e15bd583563", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633255504, "uuid": "acedf5de-5610-44fe-aca7-d2e3725ce29e", "comment": "Malware payload (DCRat)", "value": "3455fcb7de0e691d9289c4e8b7b0cd7e2e1ff655ccf36d4700a270d74fe83c18010d7f7077ccce95df02db240fae3082", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633255504, "uuid": "3702632c-fedf-49ec-b4c3-a81859275a90", "value": "T15126330CCAB08561CE64D8337A65F271C6BDBCE2D87D868B6DC1B6750B78125E0B3369", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633255504, "uuid": "290f3680-6a5c-4024-990f-6dfd6c81c050", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633255504, "uuid": "212a8854-6d32-4ab3-befb-f27640eb694f", "value": "98304:+A9oWc1/CBfzprmBmBxyjDaff0wcKMIzbCtGgwmb:+A+/QqYxyjD1fKMIzbCtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633255504, "uuid": "1ab13612-7392-4706-a2fb-857eac218b79", "value": 4488192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633255504, "uuid": "230d33aa-eaa0-4383-957c-9ea889f878a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633255504, "uuid": "05374532-02cd-4f46-a077-f7bd0b714f62", "value": "5386b04035633f75622920e5e8b8bf25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f278c3b8-241a-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633245869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245869, "uuid": "ff25487e-272c-496e-8859-abf0ebb67c46", "comment": "Malware payload (Formbook)", "value": "7a29daa31a1ce60f705519b9e1b8648c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245869, "uuid": "3f8039df-ca38-490f-8f17-e71d8450fbbc", "comment": "Malware payload (Formbook)", "value": "fe17721930d311edb152dc90a891ae82cc45997b54ec77894f765d5efe259903", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245869, "uuid": "f25ebdb5-e087-4811-be59-048a1134007f", "comment": "Malware payload (Formbook)", "value": "7c48c3f1d13d5776ac8f492450fbfc5ed2f055ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633245869, "uuid": "11e986e8-233b-4935-aa7e-4e82815360dd", "comment": "Malware payload (Formbook)", "value": "b98a370058676c638baf954ddb705cb9321df7fbe562c7657d79fe750fad6853c4ff1cd300a33b4174ac0e10d4aa1b76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633245869, "uuid": "a2f1c98d-0ab5-4508-9785-190b4f33b601", "value": "T161940274236F075BDD39C3F8A86145C26BF6A126181AF3749DC9B4EA25A73384EE0D07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633245869, "uuid": "4378126e-6714-4b6b-827f-0e3f174ab778", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633245869, "uuid": "f86f8e61-09c4-4719-b165-208f69826852", "value": "6144:kfcPxXO/lGq3gU7aKtTowcrdoAACMJxyddOdWLQ8hFLrs/ilnDq1gSbWlMPVEnsq:k8PiXtTo9r2AeWQyXlDq1FGMPVEn5Pz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633245869, "uuid": "958e5eed-57c4-4676-ad7d-51ccd7b6742c", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633245869, "uuid": "37bec0b2-1e5a-4e4e-8717-832cd0b1455a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633245869, "uuid": "68fe55cc-7f77-4714-81a2-e7a2921f783c", "value": "7a29daa31a1ce60f705519b9e1b8648c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }