{ "Event": { "published": true, "date": "2023-05-04", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-05-04", "timestamp": 1683244982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "79ed41ee-4ef4-4493-a9a6-dcd0a206d4ed", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36972f6e-eac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683238544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683238544, "uuid": "2712eb47-28ee-4b8a-84fb-52470d89b120", "comment": "Malware payload (RedLineStealer)", "value": "9854b1f96e06d95299e6cb8b0a098b66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683238544, "uuid": "6290d936-968d-4eaa-b21e-a1c92c163bea", "comment": "Malware payload (RedLineStealer)", "value": "00144e315a67190100f864353614854cfff08482986c5a1da6b1edbf9f6912d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683238544, "uuid": "da184b64-60bf-46da-9d74-1440e4b16f65", "comment": "Malware payload (RedLineStealer)", "value": "f26cb50ca28fe914de91343d56cfa8780597a601", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683238544, "uuid": "7bc88044-f19d-4c5c-aee8-f9f80dd51023", "comment": "Malware payload (RedLineStealer)", "value": "3a423350e89efd720dd3e08791bfa562d6c96dbc568e17bd6fa038b40eeb691d3f4e31e831f2faa29e5b4c121d830586", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683238544, "uuid": "aeb541fa-6e63-489a-b0f2-d4b7c97e96a3", "value": "T18084F153E2E84432DDB51BB01DFB17C31A36BCA16DB4876B6781B91E4CB26C5A43132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683238544, "uuid": "305f189e-2f33-46b3-94c3-2dd301264664", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683238544, "uuid": "d36a1bf7-e6a3-4c44-9313-9a23955b1124", "value": "6144:KWy+bnr+9p0yN90QEQLIll1YMIqB/78TixIrYo0S34vHGJVlHRDcls2fAcK:GMrdy90qIRMqFAu9N/GlRAlLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683238544, "uuid": "faa3537d-6847-4226-9fd7-b664f8a5f4d1", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683238544, "uuid": "fb1f297a-20a2-4707-8f48-13725b21bdce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683238544, "uuid": "fa0614a3-c818-4727-81f4-d3510e8ef8a4", "value": "9854b1f96e06d95299e6cb8b0a098b66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f85bfd6-ea7e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683206454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206454, "uuid": "0d7730cd-1080-4bff-8100-76156b800214", "comment": "Malware payload (RedLineStealer)", "value": "c6326212f846c43fd017ae3ecd6e7f4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206454, "uuid": "3356a781-64cb-4746-a322-958ec0dd0470", "comment": "Malware payload (RedLineStealer)", "value": "00f0216950a0e1670937a7e76d2328226792363edc980aedda2de8722ace0896", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206454, "uuid": "8b51f3b1-6034-43a5-90e0-a19b588a71de", "comment": "Malware payload (RedLineStealer)", "value": "c92d9d6a4df83cd701ab170209a3af9d381ca928", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206454, "uuid": "d6b0fb10-4b39-4e31-a87e-d186218c995a", "comment": "Malware payload (RedLineStealer)", "value": "762bc90b4d3ecf8e3ee5961b87c2596c631fc37389a16f20156340546423dc8a7ea6a379f700a6467153d368c40062e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206454, "uuid": "cef93fe6-500d-4663-a5bf-1e190f2b575f", "value": "T1DD552317FAEDD626F9659B7164FB12930634BD614CB44AAB23617E9F0872790323033B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206454, "uuid": "7d10654a-b672-492d-9b75-f13fb4fcca5f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206454, "uuid": "bb129f02-cbfd-4ab7-821a-9ce3c3e0fae7", "value": "24576:1yV1s8yRxwV7JGccW9Uan8Ax+dAuQ52W0oIw0A8IZ:Q3s8yRUJGccYUa/yV8x0oIwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683206454, "uuid": "547a0430-5904-4532-b758-f0a4516517e9", "value": 1333760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683206454, "uuid": "7415a1a1-8258-498c-9dbf-85a39c70076a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206454, "uuid": "a7125f19-3742-40fb-959b-748102a5f62b", "value": "c6326212f846c43fd017ae3ecd6e7f4d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50337dee-ea40-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683179746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683179746, "uuid": "54cfabc3-48f6-4334-b2ba-d122b79028f8", "comment": "Malware payload (SnakeKeylogger)", "value": "fcb3de59a505a00b9a91b904432fa89b", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683179746, "uuid": "bda73f40-f354-4625-930a-95095ad538f7", "comment": "Malware payload (SnakeKeylogger)", "value": "01eb643788de725e0bbb0c7b50bf7be03ae9234d8fb5f7ade43fa9974f47841e", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683179746, "uuid": "1e8ae4be-6a9d-4216-9b69-0ab454a2f01b", "comment": "Malware payload (SnakeKeylogger)", "value": "36b0c081a1ae3716493059ecba5fbf9ac865318c", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683179746, "uuid": "6ad95df7-cf5a-4170-82f9-cd506f882aec", "comment": "Malware payload (SnakeKeylogger)", "value": "d2b82fce6bfb11e4abbd142913494a14a38d116a3974170812503ed821187f8d21edd8f39fb572a0906e82b9d311bad0", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683179746, "uuid": "93a6a0a0-4ea6-48c0-bca1-6ae2b24bf1ad", "value": "T109C423432C54E8F55769FFF00AE4B0B5EEC0D5B2588EB7974E987209AAD16CD02E811F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683179746, "uuid": "0abf3787-2276-4202-bfd8-1c1a79dc23e9", "value": "12288:y0UhmuXbo64aU83RX1vU4yOOZqut1P/k5lnQdVok0SrKh4H:ygDMX1MTmut1Pc5ROezeI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683179746, "uuid": "74de5b8b-ee1a-40b6-8713-dbe2d10a4222", "value": 550232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683179746, "uuid": "510320b5-2ab2-45e8-9c3a-32488a74bad2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683179746, "uuid": "82efe08d-08ea-4c92-aa7c-9a5117787961", "value": "payment copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea32f027-ea42-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683180863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180863, "uuid": "09474977-84e1-4ffa-86ed-fe55cef9d9a7", "comment": "Malware payload (AgentTesla)", "value": "498a3e02a14af9543c918e93b0f9e9da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180863, "uuid": "5efb2c3e-05c5-462d-87f4-6b1d0377585e", "comment": "Malware payload (AgentTesla)", "value": "0276c4e5558a9efceff121f87c071ecbc5ebba665c850973b9bd5793d5e91fec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180863, "uuid": "2f95587c-8410-412e-a185-29555b5fc01c", "comment": "Malware payload (AgentTesla)", "value": "d337820fcfc0d92b5c65b24a0e843181369878f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180863, "uuid": "322b2073-eabe-4879-9c5b-5530ea128e92", "comment": "Malware payload (AgentTesla)", "value": "9818dd286151c8bf704af51b1da84985f471624b0972d9ac1a0d789fe575439e5edbae52b48ae17cf0b1818c44510712", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180863, "uuid": "056dd266-b9ed-4f36-8c85-d84bc4b41a9e", "value": "T17AF4E19421AA8B92E03F87F01078B95413F57D6B65EBDE120F9670C94E7AF102D89B4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180863, "uuid": "49655927-43ed-428d-9558-1961f9013cde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180863, "uuid": "fcece65e-4f87-4120-8cbb-1484697b7e9e", "value": "12288:Vgni4IyrZdpdyHzqSr/JK7T2C4Re5zDbjdnu+jDnhtehpibzcCPmbr4eQU7:Vgd+wBCeZD1uEW0YKm34eZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683180863, "uuid": "1ce74afb-35ab-42eb-b182-d0835aae4660", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683180863, "uuid": "428fc463-3e51-4082-be9c-19d9f7700102", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180863, "uuid": "bad9a8a6-a580-44b8-9f6e-f65eddd07815", "value": "INQUIRY LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4e2533-ea49-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683183689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183689, "uuid": "efcc0ffc-56ac-4cec-8808-d73b40615e48", "comment": "Malware payload (AsyncRAT)", "value": "ac1b84d88f1ac41a6b792aeb869875b1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183689, "uuid": "f846e246-e8d7-4076-b3b2-87585758f054", "comment": "Malware payload (AsyncRAT)", "value": "02e2aea18985a4628a0886c990c8ad77612029cb1a7c5f8df08025833bf0f17a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183689, "uuid": "e8bdc5e3-b047-46f1-bfb1-ee76c991bd0c", "comment": "Malware payload (AsyncRAT)", "value": "8420f366a760e0a2daf6f44d4efbc4a939251e05", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183689, "uuid": "f4f328a0-53bf-4488-93a7-6ae278cf0630", "comment": "Malware payload (AsyncRAT)", "value": "1f492df5632ae421d19e78870aad0f1d90ad922c32b46145b3f5fe0570f9f197fc4432864e0c26b1b7b30832c3982077", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183689, "uuid": "a0d78a79-aeea-4bb4-8c56-4a5780604cc8", "value": "T1043533FECDB28562A9631C1D0BEEEB356789004DD159B0CA8A5D80FF3CF851399A51EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183689, "uuid": "ccd65055-c374-4763-8887-44a6b1828930", "value": "24576:egfQlBtNWJ/JAOB2uReoNdeS7lgWYA5YPNZbNVFYNJ6n:lQdNuVVpdR7lgWkFXYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683183689, "uuid": "6ad9c6ed-ff10-4536-9f09-a60771894c2c", "value": 1140784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683183689, "uuid": "a549ee7b-8d4c-46b4-a7c5-c02a3fee82ff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183689, "uuid": "7846dd84-c706-4f8b-bc63-6a6b003cc67b", "value": "532023_1.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c875674-ea66-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683195953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195953, "uuid": "523cc5bc-6f11-4428-a567-f992fd0ec6e3", "comment": "Malware payload", "value": "73daa5bb600c5f6472dbd3a50e291032", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195953, "uuid": "544fa2e8-8842-4d95-aa72-5e5de2bcc417", "comment": "Malware payload", "value": "0351069209f52fc99ba163f0a735c3421296257f5534a06d48387f830521cc9d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195953, "uuid": "2ce688df-9273-464f-bfb0-9e7c0222e60f", "comment": "Malware payload", "value": "ac25aaf994a30367cc0d9942db57b71d718bd400", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195953, "uuid": "a06b3f5b-ad30-4df1-a58b-ae91d4a10aad", "comment": "Malware payload", "value": "b32a45a6ee756f40186b225e72303a8cd8fc45b25d966eaa6119cb14243ffd1e3a83422b00b98bc09a2dd237bd638b33", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195953, "uuid": "bc583d4c-fa72-46b1-b8fb-704110ed8697", "value": "T1C3E633F426D64F69EDD4FC074683B1138FD65680E212399D869BB8FCE7A7488F49810E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195953, "uuid": "7473e61a-99c4-4248-bfaf-2bd47b4c4085", "value": "393216:c+jHmWcdb5pyw9tjg2VD4nFYNNmOcI7PI3oecTL:FHmWaVhsAmOnw3Jcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683195953, "uuid": "238e482f-879f-4b33-ac16-b46b976c57d4", "value": 14610820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683195953, "uuid": "2d4de5b5-87b1-43e9-942e-25d8d7f4ab2f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195953, "uuid": "86483401-ee54-4139-bc78-65f253962886", "value": "idm.6.41.11.Silent.kuyhAa.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df45a56-ea72-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683201351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683201351, "uuid": "3b35cfff-edb2-4c2e-800e-f7508ae58e98", "comment": "Malware payload (Amadey)", "value": "349c66b321cad099a26b7fa8687cf4c5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683201351, "uuid": "d3572ce0-d974-4de3-ad8b-6077ce07d10f", "comment": "Malware payload (Amadey)", "value": "039ae773fbf94903e75085587a4bd241092596b7b7c2918f15c13294ab8f827a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683201351, "uuid": "1a549031-3db5-4444-88ba-106b63406816", "comment": "Malware payload (Amadey)", "value": "825bfef37c1a164c9e23e56e4a07dac5290bad10", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683201351, "uuid": "2dff1f5e-0c86-4c74-9205-dfcff4bc6b99", "comment": "Malware payload (Amadey)", "value": "269227a35ff275b59495ef0049bbf377803a38199a25805c62f24a090a4acc3e8287c3e47743b73174e751dba841b904", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683201351, "uuid": "dd899f9c-8bd7-4035-9efb-2e523ad825b8", "value": "T186F42306BADC4573D8BD5BB46DFB13C30A35BCA25979826B3709994B08736D8A43433B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683201351, "uuid": "9b7215b9-5358-441c-a616-8fa238f683e0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683201351, "uuid": "713a4280-8806-43a7-8233-b68d0a3e1b0e", "value": "12288:BMrPy90xvOmRJA27cF++a/g3VR/pUljdi34ttCc+/GpD9pPQEhcmPtnyzo+/NBAl:mymLnAXF++a/Unxuj64ttCyfhcG+vtB6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683201351, "uuid": "5ae59b8b-156a-4e91-b3a8-740bd980d5de", "value": 726528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683201351, "uuid": "121ee47a-5a54-412a-ba63-f9435a0abcf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683201351, "uuid": "4cb895a5-37dd-48c1-af5f-d9e5ab6da9e6", "value": "349c66b321cad099a26b7fa8687cf4c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb2688e0-ea59-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683190743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190743, "uuid": "fdf22c5c-4428-4aae-8dd8-38f4589dc31e", "comment": "Malware payload (AsyncRAT)", "value": "6d136d94c1a14c65ba3a6b2b09a491a9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190743, "uuid": "91a7f410-67c8-4a41-8a4f-e9e8c0f4deee", "comment": "Malware payload (AsyncRAT)", "value": "042ece478eb57f80509a6b318e33830ccd144ff187197a91cb5e9451a4918ec1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190743, "uuid": "12afc156-8bb1-45a5-92a4-c0c1d43013a3", "comment": "Malware payload (AsyncRAT)", "value": "3ee0979ad276b54311ba24cff4b73cf5de8711e2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190743, "uuid": "dd08f76f-df9a-45ce-8867-aa3b36066b14", "comment": "Malware payload (AsyncRAT)", "value": "a7b0cf347d8ef98d9a5700ba6ea5f37e157dfdd7bb91f2b591579e1d6a3cd22c45e29ad99b05950b97558f7cf8702eda", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190743, "uuid": "2cff6815-c13f-4bf5-9787-9b63cafa52f8", "value": "T1E1C51322F8653294F41DC8F54AF019A507D57C395A2B2BC82236B22F4327FB9AE7543D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190743, "uuid": "6369da06-311b-4314-a655-64a361258df0", "value": "12288:KklVV+u9dWbjVpGNGGzsJvVnMal6h84q1B/CC:Kk3VCfVeFKtMawaBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683190743, "uuid": "a40c78aa-38c6-4486-a1a5-9472f49719e0", "value": 2524887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683190743, "uuid": "25cd1e3c-d4e4-46ac-a785-67ed8f392e1d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190743, "uuid": "e88f4e40-3be7-458d-b0fb-9c943569b620", "value": "transfer.sh_17thKg_Ta.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b26c38b-ea49-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683183683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183683, "uuid": "c1275c8a-b1ac-4926-b80d-3b7f8c0a62f6", "comment": "Malware payload (AgentTesla)", "value": "92ff1700aff817894be524aeeb3f801e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183683, "uuid": "bb738735-0bf1-46b5-964f-d8c39d5de4e5", "comment": "Malware payload (AgentTesla)", "value": "04ef3d5a26ad149fa0158024f42dfba860e23608cc9970626e028f982885613c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183683, "uuid": "370c23d8-4f9f-4200-a5a3-cabbccfa8891", "comment": "Malware payload (AgentTesla)", "value": "e01aedfbe4af28478c5d7f9baa76cfb7c6e27d20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183683, "uuid": "be04bd80-c441-42be-9afe-518d63b1eeba", "comment": "Malware payload (AgentTesla)", "value": "189776dac837975a432835bc83b157a6ea7c1bedaf4ed7b3d508d8423d1193621d7cdd544d0f7bc168a1c5be65442d54", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183683, "uuid": "18ccd03c-3e50-4e2f-b50b-22629f9acf65", "value": "T1EEA42358CDE9A87C8CEB7084D9FC99BC5633D1B538D459D9CCAAA246E49B7C04E4F803", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183683, "uuid": "5b844b59-2752-48d9-85e4-6b7bcfc0ab98", "value": "12288:TTxeh2RajKdn8vWTHknhOFwKYJyUHSrN7Q/eK0Lh:TTxeiaGmINKLJhSrNM/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683183683, "uuid": "59cde7f6-826b-45ce-b66f-cf794d98c919", "value": 491495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683183683, "uuid": "3827f33b-54ee-438f-aa5e-4757a9240624", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183683, "uuid": "ad7dd35e-8a2e-493c-be7c-eb1ef56cea35", "value": "00382562524253626_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90dda9f2-ea42-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683180713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180713, "uuid": "8be8f92f-a19b-434a-8ae6-ef91b5b621ff", "comment": "Malware payload (SnakeKeylogger)", "value": "e274cec19cf1b0ea6c42ecefef00f043", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180713, "uuid": "359133e1-a53e-4b2f-9206-b6f91dba4332", "comment": "Malware payload (SnakeKeylogger)", "value": "05d5959859302af9ef3ca1d463ea227f4e5d74a7bb100c7425db3d9e61e0b257", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180713, "uuid": "c9ca72bc-3a19-4c13-9099-5a698d047108", "comment": "Malware payload (SnakeKeylogger)", "value": "33162f1a9e2dc6a42364bf003c78d71daeca7758", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180713, "uuid": "b6e58927-6c62-4e55-bb44-057588a16db9", "comment": "Malware payload (SnakeKeylogger)", "value": "fbc803818b6d2b6d0971a21cbe2cc0835b866121aebe2418806f5f0b145a3474c4f5548a8060677bd562ae935b4c21b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180713, "uuid": "d341c902-cd27-4bc6-9f6c-7d9e84a31a99", "value": "T12EE4D09521BA8B92E03B87F00078B45413F6746BA5EFEF110F9670D95E6AF402D89B4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180713, "uuid": "6caacaee-2d35-44cd-a10c-f49a34ba2466", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180713, "uuid": "e7272b48-f723-47b7-b8c1-1a525305b84b", "value": "12288:VYRni4IySbnYfQoQ+K+zLeSVffE0bVu9rUHwtxOLtkbIJO79HWousu10bLS1cp3Z:VKmmBQ+V6CE0bw6Q+t8IJC2G0061crr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683180713, "uuid": "2495bae3-89b3-41a6-8df6-2740ec1506ed", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683180713, "uuid": "4103ecfa-a9d4-46b2-b265-23fe9fc2ee10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180713, "uuid": "3a2720c3-5f9d-4ffd-860f-632885eab060", "value": "Shipping Documents.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49fc3c4e-ea82-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683208082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208082, "uuid": "41e7492a-ee9c-4112-a430-2af6bd2c2245", "comment": "Malware payload (Formbook)", "value": "1398a4342735cbe1a5cf5e40641c1a2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208082, "uuid": "85f6e26d-83f2-4bb4-bdd0-604a8a3c93e3", "comment": "Malware payload (Formbook)", "value": "06453105c0c0b1f09b66c08106db9121c09989da309d151ed7342dc7bcab62c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208082, "uuid": "6c882d43-3bbc-4736-8493-010cc4d16a89", "comment": "Malware payload (Formbook)", "value": "f95f4fc4f4f7c6380ddab7c2b0b5dc75b76265af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208082, "uuid": "b62164c3-6bf8-42e4-89f5-c8c01365d49d", "comment": "Malware payload (Formbook)", "value": "92709c601588c55af220fb78bacb0c32531802d3724359a0cd9c77d4217e06b3c05ae8a2f71a1594bba32de773ba3756", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208082, "uuid": "445e35dd-4842-47d5-981a-55d0e9ef5b48", "value": "T1D00412A0D37D201AF97662B2917C183E751F4409E8DB0BC68ABD27ADB55E5F4B0D4F02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208082, "uuid": "8b76db3d-45d1-4f45-b311-2a77f201cd0d", "value": "3072:wvpeRg/KXOmcxPS4kuJhZslKGvrul4x+INiZiL3F/58vxvoZA7W6FYZJ30AZYb1I:wvKXQS1IhZtLlMiZijFWvoZA7WAetiCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683208082, "uuid": "aa3318d5-a954-4357-b439-a30bd01f44cf", "value": 187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683208082, "uuid": "80faa070-7433-4b32-8bcd-2de1038a99bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208082, "uuid": "066e932b-3d5f-4e3a-ad11-c2f92ef430c2", "value": "06453105c0c0b1f09b66c08106db9121c09989da309d151ed7342dc7bcab62c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671d81e6-ea6a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683197823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197823, "uuid": "824dd9f7-56e4-4026-9628-6ab5755db8dd", "comment": "Malware payload (AgentTesla)", "value": "0b4ba47af1e6344479bc6e7a3ea05377", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197823, "uuid": "33e5454f-e0a7-44df-bb6d-b31a17a70885", "comment": "Malware payload (AgentTesla)", "value": "0769c4bf125251b748677d2478b6afe130b621505975f7e25e991852be56d0a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197823, "uuid": "8f8e1b71-4974-429d-99e3-4550beb8ed76", "comment": "Malware payload (AgentTesla)", "value": "2e8ae4d590e01df6ad8c1301ae711f440f176b16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197823, "uuid": "a614cc85-69e3-46b3-b065-c4d72e9d429e", "comment": "Malware payload (AgentTesla)", "value": "28b4c68b7359e7b54669f79f84ae38e8a1242635ed8f8677941ce59aa3e16ec1259a968d736f857d3b326e726f3814ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197823, "uuid": "c16501e3-02df-42f4-a125-883bba349684", "value": "T113642B7DAB88B902F17D0DB691E2122012F1D4834D12C35F6EC46BFDBF597C92A493A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197823, "uuid": "ec89a524-004a-4a85-a97b-2c37086ccfeb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197823, "uuid": "f5285e17-a47f-4cce-a9ae-6460803f55cb", "value": "6144:BpfTPNUJy6VchcKaNSNnozBbN4jvy89eAlmc7Fb:/PSncjNoRqa80A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683197823, "uuid": "71a9f7e5-7a10-4bcc-97c9-24dcc8762f62", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683197823, "uuid": "79eec097-aa66-481e-9a84-c26ae8f8da78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197823, "uuid": "2ed29962-d092-4323-90c6-846b7b37a303", "value": "0769c4bf125251b748677d2478b6afe130b621505975f7e25e991852be56d0a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38c34f2-ea66-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683196233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196233, "uuid": "ac636a43-5d04-4ed9-8644-28b92cb26c73", "comment": "Malware payload (RedLineStealer)", "value": "6323326c06a3dda8d6602bd6c6430519", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196233, "uuid": "336f2cef-c42f-4cf9-b63f-38cf6ee31798", "comment": "Malware payload (RedLineStealer)", "value": "07948e012c754e8abcdd5ec0a1c120c8d502a16a89330ff552e7b78d6b4769d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196233, "uuid": "d67a30dd-c973-4670-b292-2eb407bd49ba", "comment": "Malware payload (RedLineStealer)", "value": "a9fbc3d4b1b85178971a2ffaa721a02c92dd96f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196233, "uuid": "0896ed5c-7495-4a9e-b45d-9c2fc280c108", "comment": "Malware payload (RedLineStealer)", "value": "d0689ff281539e9731ed6eec4d5ed31ecf1f3cf1835cd77511c9a68b493abbe123e997465fd71a54d3c8079179e05fb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196233, "uuid": "b7933cf6-f65d-4dc4-9112-5065667d924c", "value": "T13BC41211EBE88173E5B517B148FB02C30F36BC925D7982AB2791995E1C73690B83937B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196233, "uuid": "c33888bd-c159-44e3-a388-fb47e60e493b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196233, "uuid": "f7e1a1fb-97af-4cbf-b281-731e9b8b0be8", "value": "12288:nMr7y90z/38qXd6q9JXGSBEtImAMmN0N5LpMWJPcAHH6d:8yc8qt6q9Yk75+LNwAn6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683196233, "uuid": "3cd8fc00-74e3-454b-9870-6e5c9e410ede", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683196233, "uuid": "b2c7f81a-e0b6-4b6c-903b-9c35351b3054", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196233, "uuid": "d9e514d9-e0cf-4f53-a8ef-8fb7bd50a63a", "value": "6323326c06a3dda8d6602bd6c6430519.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa9f63b-ea53-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683188174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188174, "uuid": "f1c11d65-41b8-4ef7-a373-56a907dd35a1", "comment": "Malware payload (Formbook)", "value": "79ac7b7624cbab492eb2444876e0fc7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188174, "uuid": "8950fe89-65bd-4895-a50a-7b3008cd4b79", "comment": "Malware payload (Formbook)", "value": "08fc30191cdb3900aad985dd7203f002dd7ac1176acd1ae7861021cc641b6a40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188174, "uuid": "8ec07290-e85b-4de2-9020-f2af16caf124", "comment": "Malware payload (Formbook)", "value": "8f59ff54e030341dd66debe13ccf3a80c630201e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188174, "uuid": "117ee87f-64a5-44ba-97af-b80139826c79", "comment": "Malware payload (Formbook)", "value": "3af68a46fadbade843d77115273713053a1762e356eac8bad782c70e0af6cfb24e3b82f005a390371212ff57fe59cda9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188174, "uuid": "06f368e2-2449-464a-8e55-5fe3c3f18042", "value": "T11CE459392EB91663D8B5CE7687DC4533B1579D1B3011FDA9E4E233A64382AC325D322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188174, "uuid": "187c958b-0b7e-492b-846b-6eec28b6a04d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188174, "uuid": "224ac6af-c679-4e59-a4a0-eb551150b74f", "value": "12288:2qKqnAoLzp6iEZrm4RQMIUa6ijcswvP5IwZ7poXduuW:9n38M4a4Li/0GwuXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683188174, "uuid": "6581cc40-bc8c-4c55-8bb0-e9d43161c881", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683188174, "uuid": "c610e961-7936-4924-a5b6-04ca61076a0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188174, "uuid": "b6f4a881-bbb3-4f16-b604-1b5fccaca0e8", "value": "quotation orda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8634988-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683194174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194174, "uuid": "06a5dc8c-cc91-49c7-abbc-435bda4b9300", "comment": "Malware payload", "value": "c68cdcf6aa4552260cd661b0ebebfa3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194174, "uuid": "bcf99ac9-1067-4cec-82e9-21b13bddd4a7", "comment": "Malware payload", "value": "0a52ec1d2a6cdd787228a347a8b194507a501e4bd046810763e49505324b101c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194174, "uuid": "1b5e8cf7-c7a9-4108-9021-b740aaaf2edc", "comment": "Malware payload", "value": "7fc8af6019883ab14706c68f20aa158a6036d5b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194174, "uuid": "444c741a-651f-4f22-9799-7546d68ef13b", "comment": "Malware payload", "value": "67e0cf8d131013e7a9b768e3fae41425c9a17bb0bb6cbcbb5256c28bd610b0c07d5a91e6c1ce2b9cf64df2b040b38190", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194174, "uuid": "605a2313-5db0-421a-93ba-55d2344587e0", "value": "T17D427C5AB324DCA5F1B166B4CF17EAE82A00AE321D062F43BD84B75F793D3430A08525", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194174, "uuid": "a92ca1e9-b83a-4243-93e9-aefe626c4c1c", "value": "0bdee55e36a2748726541b7d97d717c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194174, "uuid": "42779487-bb40-4d54-8541-b02093cff3fe", "value": "192:Sx3NjEU57+EUdYgawAk/cvPP1PVYnJswjCE7UNLmBwcXnRqPK75s:2jEU5qmgaZQcvPdtOGE7Uw+iRqS1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194174, "uuid": "84bbb0a0-ec5a-469f-956d-d7ee02f8113a", "value": 12307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194174, "uuid": "690802c9-88fd-4177-99c9-7357ce2b2ad4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194174, "uuid": "2f12acc2-fb81-4fcc-9a06-35dac2b137cc", "value": "SecuriteInfo.com.Trojan.Generic.2582994.4864.2548", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e760450-ea57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683189541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189541, "uuid": "ea79527a-cc11-4c99-8720-a5cb50fee9eb", "comment": "Malware payload (Mirai)", "value": "3369acc01660b74efc9774aa78f721cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189541, "uuid": "a7a3bcdd-2528-42d1-ac61-c12cb490fec9", "comment": "Malware payload (Mirai)", "value": "0b0614254f3a570fe40d3621b4bc09fa08e5710173747a56f9c316f0fa2dbde7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189541, "uuid": "16b59c21-d17d-406c-8fe3-40736fa3ce28", "comment": "Malware payload (Mirai)", "value": "9ab21dd7a9f32677baa08fd0055ce3f9fceb7c6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189541, "uuid": "f5a576e3-e632-43a5-bfa3-420f3ebcc110", "comment": "Malware payload (Mirai)", "value": "d8d4c4fbf5a37f147a019a4284a3c40b2790d046468480347beb5faec3f982e3f94a912527a0ba3049c5213a35dfad84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189541, "uuid": "aa1534d9-94fa-4407-a4ea-68b8b0fe6b2d", "value": "T1D9E2F19CAAC428E2C9BF0CBD501A0FB65948F490B14F9F8962104D8CBE0AF4B599487F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189541, "uuid": "b0224006-4de7-4b8e-a476-e86d7c14ced0", "value": "384:/n6Ppdqf3I54hJulN7s1kNYTA/fKiFs4V9B6f8Oj0bCwFtNKpugmZ2aVoCzTRWG0:P4YuDs1kNJ/fKiFUf8OGCgG5qogdW3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683189541, "uuid": "203c183c-3639-42c5-bf61-0862509dc66e", "value": 32028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683189541, "uuid": "1bab1a54-c6eb-4a65-928c-c7e62085bc6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189541, "uuid": "2ac59098-5814-4011-b27f-c46baa869370", "value": "3369acc01660b74efc9774aa78f721cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cb48fde-eacb-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683239467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683239467, "uuid": "d0d3298b-329d-40de-9f73-db9b7044f458", "comment": "Malware payload", "value": "d03da16f7c360a1d9339a10845244afa", "object_relation": "md5", "Tag": [ { "name": "BR", "colour": "#21F89D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683239467, "uuid": "fea7401c-f10b-4e67-849a-76614e91322f", "comment": "Malware payload", "value": "0b41bc918e928e6ed454af143153e560583526998e7868e755bba152aacc37e8", "object_relation": "sha256", "Tag": [ { "name": "BR", "colour": "#21F89D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683239467, "uuid": "5c3bde67-168f-4723-ba34-b729234953c1", "comment": "Malware payload", "value": "ac85ae0c4f7ad4e796421339e7b135f388c0e12d", "object_relation": "sha1", "Tag": [ { "name": "BR", "colour": "#21F89D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683239467, "uuid": "d5e87f9c-d1f8-4c62-affb-e9f01da3ea5d", "comment": "Malware payload", "value": "89828259a90ad936c22eaa5f8caa93261adce3d664b9dfb3bfe166c4271bbbeb2e0a744189cf1dfe97aa2793b66ef97b", "object_relation": "sha3-384", "Tag": [ { "name": "BR", "colour": "#21F89D", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683239467, "uuid": "5a55cdc9-597c-4dd9-b119-20968e1d6a58", "value": "T14C7533E2A5EAF4BC2C621A1DF02B419D624F43BEF337EA1148EF1669A35D902D136534", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683239467, "uuid": "b10959d3-5292-4d2c-b0aa-965adb9997ea", "value": "49152:nHsRpXZKcQc23VjVuf3lbbbWR/bP8GMBFjoyp:n2JKcQcAVuZWtnM7jHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683239467, "uuid": "1129f920-41d8-4924-ab0f-59d7ff3bd4f4", "value": 1627078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683239467, "uuid": "0e1bf05f-3221-4cd6-8d68-76c6e7354b8d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683239467, "uuid": "ee6c8aad-8a75-4ac1-9a9f-a6b4f3b8c9f6", "value": "TNWPE63351BNNLJ.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e12a6c94-ea1a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1683163668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163668, "uuid": "50246b18-f1d9-403d-a012-edd8a3f5157d", "comment": "Malware payload (Stop)", "value": "230929eed2623b93b1c42ef6d49f8850", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163668, "uuid": "037261f1-9d78-42e9-940f-954f75fc8805", "comment": "Malware payload (Stop)", "value": "0d921e0a059ef5aa8f7dcc0c75c2db6bd0f12a3d55b54aa5800b7df635ef4c2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163668, "uuid": "8ab4f921-c1a4-4b77-942f-ea6ab43f2b09", "comment": "Malware payload (Stop)", "value": "d7d371f25328ff3f60fded2b48282844ca7e55c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163668, "uuid": "438548e2-68be-4a8d-bacd-38abe28aae75", "comment": "Malware payload (Stop)", "value": "ce7eb73f027c0174340504402f428ebb60f5d06846a0160076b98bd0d686cdef5e4a70875e59c47805ac3931921214d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163668, "uuid": "e36f3e56-604e-43b7-8577-c41cabfc3d28", "value": "T1EAF4024372F49C27E716DA324E1AC6F46A2EFD918F1566EF27587A1F09701E2C172322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163668, "uuid": "63a93845-dc27-450b-88f0-586b585455fd", "value": "2d39bee49f300ea90fe79768115a52cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163668, "uuid": "34c8f9bc-c2a6-4f7a-b618-7fa058d7e490", "value": "12288:ENpU9Py1D8eniVWZZdBh+rEZl6c5itms13M/IyuoShcU51iyOpGc0:gO9krYWZX7+Wl6oi3xLc+V1tOgc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683163668, "uuid": "a78de7dd-5e6b-4637-a3d6-f72d0f5e9ac0", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683163668, "uuid": "7f4f87e1-8a9f-4729-b7a5-c769bb380943", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163668, "uuid": "7d9b78a8-60af-4384-924b-9bbbd7b16506", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180a6c05-ea4b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683184376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184376, "uuid": "e654244e-fcc1-46db-8c13-2efaaa952c22", "comment": "Malware payload", "value": "50848ced6454756b6d2b792625cb9702", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184376, "uuid": "b13b2f72-a833-4da7-a4a2-1db22394ec59", "comment": "Malware payload", "value": "0e27a2be0ef3011976967a50907fe785b4bda0d55ffa6a787cf364022aeae815", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184376, "uuid": "cddc9c9b-8559-40d2-a0ad-5dfc66c7ddf5", "comment": "Malware payload", "value": "ce50a800d6bee46b22b9da479c591d9ee1a0f462", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184376, "uuid": "1d0e2a50-8252-4bdc-9085-2d8c1530c69a", "comment": "Malware payload", "value": "0bab319f0b456646957fee844b219c2fa3cc25121687a6af0287ff787d9386a9017f41756b854fdba95d2fe6d7b4f96c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184376, "uuid": "fe4eeec1-1a80-47ef-90b7-2243207a2320", "value": "T1C992094ADA83E6F1F95B00F90467E71F6B35E43BF441EE0AD7563036E826A02532768D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184376, "uuid": "7bfb2ad1-7321-4b27-b963-41903dc736a7", "value": "384:fuOA6fKzg0F9Z7aVJ/8WZ5wIzG4o4kKUDnw9nP1265g90uFLyhz0jhVZx:2d6fKzg4996dbrzG4DpRnPTtcyhIjhV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683184376, "uuid": "45578a3a-8464-443e-ad2a-f3579239faee", "value": 21076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683184376, "uuid": "5e099f3b-d719-4a7b-a74f-c00cb38cef9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184376, "uuid": "46657fe0-a30b-465c-9e83-234a8da9819a", "value": "boat.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe11636-ea5d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683192335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683192335, "uuid": "d173a233-44b1-4b25-8f48-52e9242b360a", "comment": "Malware payload (RedLineStealer)", "value": "4aeb5d425612c667af1cc8762cbe375f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683192335, "uuid": "a05862cd-2412-4ab9-af17-2cdf3ac3def0", "comment": "Malware payload (RedLineStealer)", "value": "0ea8e17239c64fef607c3fc913ea3f606696c4824b8d890fdc20396b65c89a0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683192335, "uuid": "5847419a-2cc7-48a7-bb46-b8e5edad347b", "comment": "Malware payload (RedLineStealer)", "value": "ec2dc83aca25b25c17a50a21abcaf61b29a47cc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683192335, "uuid": "02df503c-9144-477e-be9b-c21d5ad01ece", "comment": "Malware payload (RedLineStealer)", "value": "0f4b2a1bacf2144ebae872a2bea47379d96d52446cabf4bdb1f12b1f2c5d65c1b5e4e5ca8bed0c263739a3d50c064255", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683192335, "uuid": "3251e027-268d-45bc-ae35-bf2d4adf2244", "value": "T16CA40213F7D98072CDB517B04DF612C31E3ABCA26EB8522E3791584A4DB3688A47177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683192335, "uuid": "0e9c5e3f-a500-4480-b8ac-ae5904f2e2ab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683192335, "uuid": "277f2228-d563-4c1d-bc08-3561486a633b", "value": "12288:KMrcy90/HQuZWizU4rfocJNUGZPm1kjp:KynUzU4rAh1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683192335, "uuid": "67251d5f-fb21-46ee-a888-388488ee131a", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683192335, "uuid": "a54726e6-14ab-40fd-9b7d-05530b0c00a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683192335, "uuid": "047cd09f-ec27-44f4-8720-29c4ff7833c7", "value": "4aeb5d425612c667af1cc8762cbe375f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8450eedc-ea49-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683183699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183699, "uuid": "3b6f06b8-d374-42c2-974f-7bab955eb4e3", "comment": "Malware payload (AgentTesla)", "value": "43678482751038f9a87f50b0dc8e2f15", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183699, "uuid": "d03fb61e-4274-4f0f-8114-f91fbd31b4bb", "comment": "Malware payload (AgentTesla)", "value": "109ef5c322e2f5b9624f14914d4e4db3cd2ee7883f9c718c913616eb69277091", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183699, "uuid": "cad2a967-346e-4c12-9042-cd3113dbc56c", "comment": "Malware payload (AgentTesla)", "value": "2735a27a9ba8de920eca46637c974b686bc2d20b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183699, "uuid": "baa5abae-b04c-4ed1-994a-473c4b2a7963", "comment": "Malware payload (AgentTesla)", "value": "758ab997946eb6f73d060e411cff7a290df42016f3421de2704031c2dad9d1505d3732da971d83f421d1694fe4eaa258", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183699, "uuid": "0a0913de-2be1-407e-a238-caef0c13dd5c", "value": "T1A1E4D09522BA8792E03B87F00078B86413F670BB65FADF150F9270D95D99F402D9AB4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183699, "uuid": "c1982cb1-9cd9-430c-97e4-f40dc405932a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183699, "uuid": "cf878259-49fa-411a-977a-d383db2f38b5", "value": "12288:1BAni4Iyett3RbH/ZvlydI1tWHURMcSRV9ZUasth5KwQyX:1aWtxH/ZttRq9ZSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683183699, "uuid": "1d87f842-fd43-47f6-a5b5-de36797f11a1", "value": 715264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683183699, "uuid": "ab43965f-0b23-4fd8-bf6a-2b9146f91348", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183699, "uuid": "322eb79a-1eb0-4ec0-aa71-353f93383480", "value": "P30OwbdhQCNt5HS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652b34fc-ea77-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683203403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683203403, "uuid": "47edab37-e872-45a7-ab7c-643194ae6dd6", "comment": "Malware payload", "value": "3c9b898099ab1295cfcb60e87ebe1e77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683203403, "uuid": "8f2924a9-79af-4c49-b49c-898c7a9b6631", "comment": "Malware payload", "value": "112466c6694ff308605d790a0c91b702d949a635a4f8a3e8129f65d6fbcb58df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683203403, "uuid": "1f991b9a-fe44-4131-af8a-8229d58f53e3", "comment": "Malware payload", "value": "f121014b0acdd7dd0b0233d62d5b10bfc92d7c3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683203403, "uuid": "ed0b8026-c081-4b08-b631-1f1cbe1d94f1", "comment": "Malware payload", "value": "f82798ca5b14aac899437bc4d77a3c2c8c5da76127017627a68bc3ae53885223942a0a8c4a5db6923db7306b66255814", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683203403, "uuid": "6ced7940-f639-4ee9-b96f-c928cc46333a", "value": "T14BB502327A62FEEDC66F9D74E88215440DA8D8BB519481E8BCC5E8C7A4B9300DDF1C79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683203403, "uuid": "9a4ba06c-905e-4eb0-a2c8-5bb24e3705a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683203403, "uuid": "7c3a3ca9-2b21-40fc-ba70-d87f52ddbc5d", "value": "24576:CPZ68ufyDguIdelaByld4MBD5gxR9j66FdYeliA0iDLJriMqYvdN+KQn8/DFAhQK:1xcz4u5kRNtmiDsmXAMjEUmUh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683203403, "uuid": "bdce6569-c395-437b-8c2a-dbfb6a89baf4", "value": 2424832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683203403, "uuid": "81f136e8-7327-44b5-ac11-9f8d55933bbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683203403, "uuid": "5acb5cf9-4570-494c-b2d9-680fff4d2a5a", "value": "112466c6694ff308605d790a0c91b702d949a635a4f8a3e8129f65d6fbcb58df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e70da9ef-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683194172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194172, "uuid": "8737d46d-9bec-4b74-a1ab-26545e82a756", "comment": "Malware payload", "value": "4fd0da738015cc2dfb0cb6a07bf3247a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194172, "uuid": "ddaf9ff3-c372-497b-b2c7-c509bef381d1", "comment": "Malware payload", "value": "11978f186a3b592b67f4db9f5293d293d2408b843fa7a444240a17c502ff9062", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194172, "uuid": "9a49a406-d374-4df5-a0d9-23911736f55a", "comment": "Malware payload", "value": "9fcb22d31390c9be842841b03c3970fa1b6539c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194172, "uuid": "d9b5eddd-dc45-4dae-8fef-17e57908a726", "comment": "Malware payload", "value": "32a84ebb2abd436a8876cb7692bdc4bf0a872b93688ce22f65a59f13895e4eec66d7428622db6ac742336b2569961da6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194172, "uuid": "d5e2aba8-faac-4cf6-ade9-6f444d0fdeee", "value": "T148E2D018C16258AACF5854B315DAA929172CFE5705930E4337EDFD461F36AC2EFC3241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194172, "uuid": "5865fb29-84f4-4066-98ed-9c3daef3c49b", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194172, "uuid": "f06efaf6-242b-452b-aa0e-76336fac947e", "value": "768:0XGncllzh+AB4U8R/QDc8vWzXb/7H1PBjyumoWE0j0jlyXqm8OXEZVE:0XuOvlQac8Wn5B+k2+xm8O0Z+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194172, "uuid": "2dc6730a-4730-415d-9ce9-cae58a0cc654", "value": 32334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194172, "uuid": "92216dc1-d90d-4ee9-a533-9b17640f6d94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194172, "uuid": "98a513d1-bd5f-41a4-8b9f-81806be30458", "value": "SecuriteInfo.com.Trojan.Generic.113291.23046.19778", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "035b2f05-ea52-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683187348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187348, "uuid": "c2d4caef-1ccd-45e6-a13d-3bc04e246e89", "comment": "Malware payload (Gafgyt)", "value": "04629c08af0bf5b519a1c1942e43e547", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187348, "uuid": "59226e80-c249-4be7-bb09-d20be3c0f0ff", "comment": "Malware payload (Gafgyt)", "value": "11ca65dfdef9d3ff7c669af00959057e7b15adcd87bc21d4a3d74a48f35872e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187348, "uuid": "9d914e12-1b99-4457-807d-7eab6d67ecca", "comment": "Malware payload (Gafgyt)", "value": "23c92c458372d5e90b374f8f1d32bed908239ac8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187348, "uuid": "59bcbe56-732c-49fd-9f05-e440dfea61af", "comment": "Malware payload (Gafgyt)", "value": "6d2e20761730f2081f3bd47a0f7f6af44ed585e0f0cbb05bf96c973fc4c849cd1272efeb336137269012b1236e2b6156", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187348, "uuid": "634cab42-dbcf-44ac-a7af-443ffcc36090", "value": "T174933A277B230E23C0CA557112E30331B7B5D74938FA4797BAD16EAC2F16A8439167E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187348, "uuid": "ef837ad4-bc48-463a-af07-cdf224eeb4d0", "value": "1536:jW6Jk7jWNEqi+thy5ct1lNcdj333mX0Gq4/cOf3Tj:CwNzi+7C+lqdj33mX0Gq4EOf3Tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187348, "uuid": "98e43d7d-3666-447b-b932-610f507d0c64", "value": 90411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187348, "uuid": "3546f07b-f7a2-4b67-bce4-23a0e28abb98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187348, "uuid": "d4ab7429-43b1-41c8-b4e2-15041562e987", "value": "04629c08af0bf5b519a1c1942e43e547", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c57b8410-ea51-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683187244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187244, "uuid": "f59f413d-6952-4673-a91e-b02f07a2e7cc", "comment": "Malware payload (Mirai)", "value": "3ac9feb7bc5dd1acdd2f444a9f6874b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187244, "uuid": "af5c1513-96aa-41d6-9684-696085eedfdd", "comment": "Malware payload (Mirai)", "value": "1213cfaac8894eb28d63fc974cd61396c6bf017a1aa642b5e275c2ef4dd098c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187244, "uuid": "f5fca70e-4221-4c5f-bd08-39b3b0603523", "comment": "Malware payload (Mirai)", "value": "554c03942552e6de81fd0e5b264e7e30b7076317", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187244, "uuid": "2bc8cf24-26a2-458f-b292-279d4b340968", "comment": "Malware payload (Mirai)", "value": "bd5225fcc22889dc0c19880d48730bdd645fe51e5004042e021a73703b149231a51a991b8b94c271c3d6f9e15df326f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187244, "uuid": "dfbd680a-e1e8-44b3-b430-ba0f906c053f", "value": "T147D2E1ADDB55274CE422573244AFC12F74E7ECB3926F42C587DC8902283894D6B79EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187244, "uuid": "ce5bb9e1-29e4-4973-b307-cd6d91b5af9b", "value": "384:MpGclfUDwDsOAFImUQSAAHCj9TKcSLJY7eoayfsqxRFpDU7/2LDVokNyqN:PcmROmIIAiNKpLJY7Pa6tpI7/SoB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187244, "uuid": "5a34baf5-522e-4784-bb6b-f786eccf204a", "value": 30008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187244, "uuid": "eb081b87-73ad-48be-b06b-f76b45a91afa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187244, "uuid": "6bc925d0-9036-4ed8-bf8e-93f9ffa26a82", "value": "xd.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d8adb7-ea99-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683217866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683217866, "uuid": "bce70040-16da-4100-824d-946417bec465", "comment": "Malware payload (RedLineStealer)", "value": "2f7153d6c74ec1a11679aa67cf42c52a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683217866, "uuid": "fccaf8ce-2204-48e6-8ef0-57ea92b769e3", "comment": "Malware payload (RedLineStealer)", "value": "121c452418772be07136bd8d273006783bc52db49c317a962901cce0ee3818a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683217866, "uuid": "a3d49790-a0d9-4fc9-adab-cdfac214e87d", "comment": "Malware payload (RedLineStealer)", "value": "7430430cb805cfa98d63fdfe5b2e96fcda919094", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683217866, "uuid": "ae0a0584-8343-4c2f-b1c0-2cc0d117a8f5", "comment": "Malware payload (RedLineStealer)", "value": "08aad5bae96e6ce71ecc06cf047a57f494819458b49e268be793f069fc657e18d979facee213bba8c490ef78f6b67ddf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683217866, "uuid": "60d421bf-8873-4dae-b063-74f875f4fd72", "value": "T138552313E7E8E063DAF60B3078B707970929BE614914C3DEB295DA0E4EB22D450B17B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683217866, "uuid": "ab38b873-e3e9-4562-8711-6768801ed557", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683217866, "uuid": "1f601377-b340-46d6-8408-d98043814dfb", "value": "24576:qyPKQMMneGvWw6k0S+T+S1wyy2bpj+qjvX6lqCB+Kv7mOlJ+endR6w1:xPbeGOk0v1t/+OvpCB+KyOiedM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683217866, "uuid": "78865a07-2e14-4c75-a1fb-27a2e3e32188", "value": 1333248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683217866, "uuid": "963574e3-5932-42e9-a4a8-31857e241900", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683217866, "uuid": "e858319b-e758-46ff-988b-04cf5da12a3c", "value": "2f7153d6c74ec1a11679aa67cf42c52a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35018321-ea71-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683200745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683200745, "uuid": "93366357-d888-43b8-a760-e8b8b25910c2", "comment": "Malware payload (Formbook)", "value": "1a0086a00df652df7cb717ef0c5a140a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683200745, "uuid": "74c639b1-1cfe-41c1-b611-3b9c33dfed18", "comment": "Malware payload (Formbook)", "value": "13787d324c97537e5d73a1a3a0c72cdd35c2fac0c89b95589cc0fd275329a3a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683200745, "uuid": "03f6fc85-c8ab-4d99-98e2-5e0822277837", "comment": "Malware payload (Formbook)", "value": "3b86400c8bcebd72b7e8c0c238a91ff357308a27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683200745, "uuid": "7d2f60fa-339e-4ae2-9398-c0a002f1bf59", "comment": "Malware payload (Formbook)", "value": "2778cdb041a864c21fa53dfe60a49e6e634978f658dc14d3a51c3e4e6c2d573dd981dad6cfc63760323c3c25f3dd7dcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683200745, "uuid": "1151cf01-0cd7-49dc-a328-a9c33fd59ae5", "value": "T19B04125A7611C175CD36F638057BEB63EF267A2C2E102A63FF346170A4B24F4AF18519", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683200745, "uuid": "bfa554d0-9bf7-4003-88e9-11bad0384608", "value": "3072:h2WpF6B24DWVSjcWTvswqAVVLBn1BGfpp3n7ijiqv2XhvrFw:IBflAGEwRLB1BGfpp3nGfvIhw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683200745, "uuid": "db7a9299-f946-4d83-9496-bf847fb3dbc9", "value": 187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683200745, "uuid": "be610799-45ac-44b3-931f-22af0472dde5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683200745, "uuid": "9ec64d9a-288e-4c3d-b76f-c31a9348e6ed", "value": "13787d324c97537e5d73a1a3a0c72cdd35c2fac0c89b95589cc0fd275329a3a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9c72b5-ea35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683175074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683175074, "uuid": "6518f355-c08a-4957-a12c-2eb39c88464d", "comment": "Malware payload (Amadey)", "value": "7654b7b139d02caf594e3bb76024b436", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683175074, "uuid": "b2664ef7-85ff-4dbf-9678-a20d087cbf2a", "comment": "Malware payload (Amadey)", "value": "1503129c1499aee0902cfcfa2d78d909e0f5117d9f7091134309eb05564a2e8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683175074, "uuid": "b2da4f6c-794d-4d1c-831c-821a5e7ab00f", "comment": "Malware payload (Amadey)", "value": "9ab0d7bc3a1e5f69dc0c15074f4ba85a7a907144", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683175074, "uuid": "99e256dc-54aa-4fb2-8f75-26b41c7b4556", "comment": "Malware payload (Amadey)", "value": "8bd4b69ca7fd5a86e423c7d42b06ecab5fbce1c973b58f563d488b4e258affb352f356208c0db6f0ff7de929c60b7848", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683175074, "uuid": "86976dc2-c5f8-470f-91d5-4309f561a1c3", "value": "T15CA40247ABD55073DCB427B018FA07D31B367CA299B8831B2791A85E2C73285D436B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683175074, "uuid": "e5a46c03-3bef-46bf-bde0-91da78a6546c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683175074, "uuid": "8dc367f9-3305-443d-ab04-2985c697452c", "value": "12288:WMruy90sAoIpon4xyFZaP5xW5VYY2vrARptcjsVmC58pIr3:MyrIon4xynAsd48Rzrb+Or3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683175074, "uuid": "ee360b36-c47c-455e-b3fc-a450e1c719b0", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683175074, "uuid": "840df001-e6d3-4c02-848e-2b60f55708e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683175074, "uuid": "f0efec02-b1f2-41eb-a574-74ac7f90fad0", "value": "7654b7b139d02caf594e3bb76024b436", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2419f7c4-ea6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683198570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198570, "uuid": "0f5437d5-f762-45ef-b78b-ac5bd9c45d95", "comment": "Malware payload (RedLineStealer)", "value": "2f654b370330b37d971f4bf2bcda59da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198570, "uuid": "b2160733-8d66-4389-a43c-8d75147af53b", "comment": "Malware payload (RedLineStealer)", "value": "151d20c23d21ac2aedd5015e1cbc69f6e39bd81f35f5dd4ff4d8ce810aead0a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198570, "uuid": "1b0cb695-b401-485e-9e39-68c3449b3f65", "comment": "Malware payload (RedLineStealer)", "value": "686e143695e6ad4c607c8c266f82dbc8720a7c1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198570, "uuid": "98573359-3eb0-4759-afcf-c90a2b7a8d35", "comment": "Malware payload (RedLineStealer)", "value": "0d3798c49a84fd463352c605802ef2607c1ccd3da06eb9ce10e5c5110f6cd3aa77a55a00d90449d8400b026a89b6b4ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198570, "uuid": "0b8d71cd-9c4e-4793-a0ab-e28002feb975", "value": "T14C265BE77792A16BD22591B9A00074BED70FF9728661B17388F3367AB63BC523214F05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198570, "uuid": "a54b07b5-5f1e-4c68-8177-471433ededb5", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198570, "uuid": "5071bd4a-b3bd-4166-9ba7-496f365da123", "value": "49152:Y+dV4FTqVizuoGC9ZBcFLRLuimM0CYwMJiDixNv/O2FprKn7QZGx8Jh:Y+ovaooFLRywM0DO/O2/rk7QZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683198570, "uuid": "044f9fe7-bc28-4ebb-8b58-d9f961b8edcf", "value": 4536152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683198570, "uuid": "8c1005d6-e116-4b63-a942-1ce9bf7d4382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198570, "uuid": "12d318c7-3229-48f8-932f-7fb1769f836a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc30d83-ea79-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683204329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683204329, "uuid": "533b5963-c234-43f2-b69b-03f0e2ced41a", "comment": "Malware payload", "value": "f38c7588e750a54d157285de9f853920", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683204329, "uuid": "f30e5fd7-cf46-49d9-a1f3-48ec94045da7", "comment": "Malware payload", "value": "152253fb69131728a3b1527f55dc7997b5f19b5aa8dfe6e00a275557baf4c07d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683204329, "uuid": "e4a48ea6-ccef-449d-819d-97f2c06f9023", "comment": "Malware payload", "value": "e7cce0be71256d229cc07d5fb0ca9a9926045e35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683204329, "uuid": "667c8b8b-65e2-45e1-98b2-f9f8c4e2f35c", "comment": "Malware payload", "value": "b3567ae395819621b177c0263710e5e32affacb6682f86f04d8949398e5af922d1b3be0917bfd6f7ae104c6c2a886ca8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683204329, "uuid": "628f4be4-5fd0-4c8b-96ee-b71d0a014209", "value": "T13D443A6FE09EF14AFD558C706AD8BAA1CB973824CBF6D9E1ECD661203910353CC65C1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683204329, "uuid": "2f6db08d-d8b1-448d-9d24-dece47882e16", "value": "071307373db47402e881a4d65e0a19ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683204329, "uuid": "a1eef53c-209a-4d71-bc07-8b2c9886456c", "value": "3072:tWMXeMqWX075saqOWj9925OUIV9cNBz5otsSJaeLESUaHUoEZQRsaj8wQWLYh+cJ:tzLbOIVpFgZQYy8WoTGvhyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683204329, "uuid": "78018d46-9d3d-4971-a8d9-d7e1400717fc", "value": 264544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683204329, "uuid": "5df18183-c8d0-4065-acc8-7028be21486a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683204329, "uuid": "cee79174-05bb-44c5-886f-2a4c871f56e9", "value": "152253fb69131728a3b1527f55dc7997b5f19b5aa8dfe6e00a275557baf4c07d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c82f69b2-eaca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1683239218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683239218, "uuid": "8a6cdc30-da42-4a2c-a2b1-a39355d40e3f", "comment": "Malware payload (GCleaner)", "value": "ea621f299a4f094b933e1f69850295c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683239218, "uuid": "77f1b6b7-1fe1-4be6-b6be-9dd637dd0852", "comment": "Malware payload (GCleaner)", "value": "15d6bf017cea7a3c15d078cc48fe69e579fe6ae3dfc170fb0dd4a9f27926e19e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683239218, "uuid": "bc99c4ca-cb76-4950-bf85-a548a82e21a1", "comment": "Malware payload (GCleaner)", "value": "38e7d51ad7ce0fa24394523b2bea20e3a278d725", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683239218, "uuid": "11d83036-428a-415d-8cc8-f1adcfa36b25", "comment": "Malware payload (GCleaner)", "value": "5cfc705f9d9ae8b8c75614daae95f6a96d211c1f00e3e2742c35a693255b4c7a09848421bae08cf5f616f787593b6641", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683239218, "uuid": "6d9e502f-9486-4152-92dd-0036a7d04693", "value": "T14C9533A79AE755F8D0AAFEB64FB7C8551E6A762158B4110D430C0EA35B220B3061F7F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683239218, "uuid": "653a62d1-8167-4225-80aa-e5d3ebfc43e7", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683239218, "uuid": "b81462fc-04ec-4b98-9c0f-d28fd8c0049d", "value": "49152:Qdn1PKdcOXJIGwwVSu78v80S3kusbFYEzIHp0sIf5k+8el4AG5c3:Qd1PK+OXJIGjL78pnYO1Nk+jaXc3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683239218, "uuid": "6941fa9a-5907-4bb6-ad82-04e3aa53d5d6", "value": 2015497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683239218, "uuid": "9cb81a5c-f058-4d30-87a2-2a59d630899e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683239218, "uuid": "fc03e88b-1477-431d-8060-6a4ed6b937cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e5823d-ea86-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683210042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683210042, "uuid": "86d0e37b-270a-4f2e-9a3e-53c81134e913", "comment": "Malware payload (RedLineStealer)", "value": "67076f2b9f7cc7b4892d743f2df82bde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683210042, "uuid": "42687d3c-6ccc-4873-befb-bd5829375cb3", "comment": "Malware payload (RedLineStealer)", "value": "15f5bf9aa1380726403d8cf31e4d06684417273e99ac6b7446251912c5dc2ca7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683210042, "uuid": "b330eb8a-fea3-40b0-8fbf-3843f82b6d29", "comment": "Malware payload (RedLineStealer)", "value": "1fbf0fd2ca51e826e006e6ba84221f370794e8f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683210042, "uuid": "8a6279a0-2dd7-43b9-840b-770f5ada0979", "comment": "Malware payload (RedLineStealer)", "value": "0698d2b6ebc4272a4ba6f8eabe083fefc30d0bf5a22ab5f34eb5ae8d996aadeba2c79e0a7ef3af1df51469ab85415876", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683210042, "uuid": "f3e9664e-616a-43c0-831b-9f18d7490b0c", "value": "T123D4121397EC8432D8F513B455F602C31779BC826E78A36B2796985E4CB2BC4A07673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683210042, "uuid": "52452cff-59a5-4855-a034-65176c4cbb19", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683210042, "uuid": "a3c9e5f4-0053-45a1-9108-6af61206074d", "value": "12288:uMrMy90Zp34e/CksvdnHGjlzwUsTorCNl8GC5TpZNU0e+u:ey9kyBGjVsT/3jC5TXNe/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683210042, "uuid": "6110638d-19a6-4d30-80e2-0cb49b3d604c", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683210042, "uuid": "9f1b7b6b-db5e-4f97-9f26-9e7042b30fa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683210042, "uuid": "305bb063-420e-4272-a6df-ea5b2687a6ef", "value": "67076f2b9f7cc7b4892d743f2df82bde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eeab9cb-ea85-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683209352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683209352, "uuid": "bc0ce530-d6d1-4594-81c1-e7fcb754435f", "comment": "Malware payload", "value": "366133934cbe5f25052ae51c48d2396d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683209352, "uuid": "80a5cb13-faa2-45d8-bbf4-a880e4c09b0e", "comment": "Malware payload", "value": "164ce7789b555a5f30a3ddca3aa2d3c91f1b7003f0a969007032ffeefc6c91ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683209352, "uuid": "248137e2-5340-4347-afd6-5e4e4c5e8008", "comment": "Malware payload", "value": "d9a2210f7f93d2f34a40f237c9ac19373918fe17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683209352, "uuid": "71b078f1-b5ef-4a76-952c-b7fcc1fa0959", "comment": "Malware payload", "value": "10fd86d29886d0c4545a119f9be9bd9b77f2fae9f5e6f328b60c331d8b0f3f90428384a9369ec9b29f66855a013392e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683209352, "uuid": "cb1be7ac-3369-49e9-89c7-d9160570b7c1", "value": "T1BFD63323627421C6E5E58D329933BDB231F3157F8AC1ECB9319E19C71DA61A5AA03F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683209352, "uuid": "719d2286-02b8-45c2-a6b3-0bbfa08b5a2d", "value": "36e133d2e4b3eab9be975e6d64d2f3df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683209352, "uuid": "b147dfc4-c6b1-4891-a041-21979a0aa073", "value": "393216:w6tZmdypN4G/tdXs9lQb+F39qnbcE7xeaYP9pjfQXzTV9r9D4:NmMsOVMQg9UbcE7xeaqTfQDZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683209352, "uuid": "e52490ac-3176-4804-80f1-66613b55a707", "value": 13350912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683209352, "uuid": "047dee91-9a51-4463-9583-61afa0168acb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683209352, "uuid": "f406d9d3-d88d-47b2-aee1-99eb1ee0ad28", "value": "164ce7789b555a5f30a3ddca3aa2d3c91f1b7003f0a969007032ffeefc6c91ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ee82ed-ea38-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683176338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683176338, "uuid": "507e75dd-a705-448c-8667-0d50af369773", "comment": "Malware payload (Gafgyt)", "value": "80a4079d807b5d30f8345e60d86c2dcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683176338, "uuid": "cc22a5e2-4e16-456b-9c46-69905d8812e7", "comment": "Malware payload (Gafgyt)", "value": "1662219ef1f89fd2450d0e2a4e9d3ade855c0ece1ac551500653939be2a17e3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683176338, "uuid": "d9972cc6-3965-43a4-889a-7ef0c1a12526", "comment": "Malware payload (Gafgyt)", "value": "5d5cd7e3ee3594147f6f686ddab9d87b58266136", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683176338, "uuid": "611dfc11-dce9-4753-a0ec-1edcab152ca1", "comment": "Malware payload (Gafgyt)", "value": "cb9b3ca0619dfc94d087122f8094dddd04296d933ca13f90168fda2982bc8fe0ac7e7cf6d7993ee1de2198f0259ef5ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683176338, "uuid": "a79bb325-abd1-4ba0-85a4-1c6428cb897e", "value": "T118B31813B7B1DABEC08252B12BDB92F19423FD7D0732622B33957DA51B388D96D59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683176338, "uuid": "68de7864-84dc-4430-b8b1-9355d376dc1a", "value": "3072:Ld0wlSAewzi+Xn+8Uhw6W+aPgJmDk1c8xF6KjW:jfO8IBpJmDk1c8xF6KjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683176338, "uuid": "e24ffa74-6428-4063-b0e9-aa24a97dfe60", "value": 114825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683176338, "uuid": "6cdb8928-ee2a-424f-b094-b0c25b644a7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683176338, "uuid": "3fc3e388-58f3-4788-a47d-f60dfdf5df8c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84755dd7-ea63-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683194866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194866, "uuid": "a0895291-dd05-4e68-9100-f98828b0deac", "comment": "Malware payload (Mirai)", "value": "86ecb27371bdc715b14e45d8443a7ae8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194866, "uuid": "c1dbfb1a-bb7a-4405-8d61-5111f23a7331", "comment": "Malware payload (Mirai)", "value": "174559e78a38ca557c62cf0a617d5520cffef84cfa45cfac042e9c9134f3ad0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194866, "uuid": "17cf042a-b738-4baf-bfe2-690165280f18", "comment": "Malware payload (Mirai)", "value": "b96952de562d1e73234e0fc7ada17082d57a0e95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194866, "uuid": "addb49d8-d1bc-4aeb-80aa-1a59bd6e28e4", "comment": "Malware payload (Mirai)", "value": "abdd0ba7dc36c8959a23261d4cc374275633efa1fe4ffae76b8e507dddaab9b19a5d7f9dc925bfc69d47e0dc8e83ecf0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194866, "uuid": "9b240f05-18ec-467a-88bc-3f5a2cdc828a", "value": "T15D33490272180A47D1675EF0293F1BE097BFEE9121F0B689690F9B468275E73108AF9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194866, "uuid": "85b6745e-c83a-4557-84e8-48eba6fcda9f", "value": "768:EwzzruShlvjRTaKZ4jgtnuxUMDnh1uU22An7OHlxhm2:9zXuY77tn2USiU6SHvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194866, "uuid": "e52ad8ad-54c3-4589-989b-68389917a529", "value": 54304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194866, "uuid": "2cbfc7f2-7372-48ad-9e32-769384c74e6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194866, "uuid": "35572d45-1003-46d9-be40-3e0bf316810e", "value": "86ecb27371bdc715b14e45d8443a7ae8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd9a932-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683194157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194157, "uuid": "64440644-9c75-4cc5-a992-55807eeee29a", "comment": "Malware payload", "value": "b691f964d5e2205adcdab2482ff2607c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194157, "uuid": "2e577e0d-02b0-4cbd-86f0-ac76eb898675", "comment": "Malware payload", "value": "18147c7631b042ad07509500b82402ec50397a6b7df26d24c0e5caf59347b12a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194157, "uuid": "24d6e8a9-b613-41c2-8555-ffd2b14d5208", "comment": "Malware payload", "value": "b7c6d4fb91336e7e9a71a429f376c91609629688", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194157, "uuid": "5ba1e8b1-2668-4bfd-9669-dc8ab3c00e78", "comment": "Malware payload", "value": "d4ef5ac52e75121a2179436cd2e776d6f219fd6e6715c4c46e443b57b8e10ff90404de5be36eb70db76a96686ef70031", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194157, "uuid": "c9d75fa2-fa5c-4cfe-bb55-f2f283dd8d77", "value": "T1F6C33A23F2D488B2D1B51A788C1A92B8A43BFD303F39752A76E9590D8D3D380657D7D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194157, "uuid": "557796cd-6191-45ce-a99f-86aad4da6906", "value": "3072:fVtVOiOEZKvZixP/DIWC9TbQEw3MdA/oW00QfBL:f7wiBWOkKca/oWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194157, "uuid": "413c2e4f-1f4d-4abd-afb9-914c2dca9234", "value": 128000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194157, "uuid": "3a4ba7fc-0135-4544-a5b9-005633d8755d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194157, "uuid": "883e4e5e-e463-4719-a619-48dc850006fc", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.12888.12882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f2c0ce-ea65-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683195534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195534, "uuid": "167aa9b1-8d78-4b69-a595-42dc3112e12b", "comment": "Malware payload (Mirai)", "value": "0530e3fe75b5976949f66d4339f00b96", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195534, "uuid": "7c246ea7-f983-49ae-ab47-f49b9512b482", "comment": "Malware payload (Mirai)", "value": "18ae70fc58d7231f537e18a3c13916785778fb5f22b73b8c5e0ccf4f053976c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195534, "uuid": "0c25189a-fd39-4468-8f93-c6628ba42d2b", "comment": "Malware payload (Mirai)", "value": "be25517de2a174f11349abce66f52ea81ac9dabb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195534, "uuid": "39961c1a-41e3-439e-b449-f69b1a4d8da8", "comment": "Malware payload (Mirai)", "value": "933af62f1a93761753dab69d9ea9ea8cedadcf5fb23273240311a5c2a1565a0f7970210b458223a98bc016aede3538f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195534, "uuid": "86282893-c692-4d7f-9785-dee087dc029b", "value": "T1A4331981BC925A6BCAD06376FA6F518E3321B3E9D2CF3217CC140B10768966F4DB7A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195534, "uuid": "3807583a-24ab-49db-a9ab-84ef61ae27d9", "value": "768:mxWJlnbza5NLCjwbZNzpbpwvlMyYJkNJCs+YmouEDlhi2bPEzC5aNoPCuBNJwc:lla5Nmjqp6vlMmnDRDEz8aN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683195534, "uuid": "4997595d-dc47-41b6-b38a-d8512c158565", "value": 53088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683195534, "uuid": "45e5be7c-2e2d-49c8-b6b9-aa5c17521e29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195534, "uuid": "e233323d-1010-4aa6-a8a2-883f08d394b8", "value": "0530e3fe75b5976949f66d4339f00b96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f66ce4-ea75-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683202541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202541, "uuid": "79b77e71-81c5-4f64-8d51-3e4f5dfa5ab7", "comment": "Malware payload (RedLineStealer)", "value": "517961288036e2c0ee6259142a1c225b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202541, "uuid": "4b48366e-3bea-4800-90e8-1a1c0fb78239", "comment": "Malware payload (RedLineStealer)", "value": "18e60045ed98eefc494f9c77e777f1d5596bd1a6229ab53380aa52631d06b79b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202541, "uuid": "1ae7af4d-c2d8-40ee-a365-55afe8883352", "comment": "Malware payload (RedLineStealer)", "value": "88bf154fc3219de6e05a2ef1a3590f9663a8bbd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202541, "uuid": "c6b535cf-95a4-407b-a1da-1ca90e5fc467", "comment": "Malware payload (RedLineStealer)", "value": "3afd3d447ac3e9bcfe0834d5eeae789261d9b6a394fb5e65de6207cb6ff2e06dc1447e0453484a62a20055d53b55c946", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202541, "uuid": "47025667-5d8d-473e-b819-3839dcc074ab", "value": "T126D41252ABE94076DCB52BF018F702930B397C925DB893673B59989E4DB22C0A53073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202541, "uuid": "b6003914-7d0c-4bf1-badf-865201c28e15", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202541, "uuid": "5de07368-690b-4f8c-9e6b-d4e76b7d9e79", "value": "12288:UMriy90YzwRPSVtWpbgoeT0oMwiLg68SO43t/6I+JRpYjTTC:ey90RPSVtWFGoNLg/gkIepOTTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683202541, "uuid": "c4e6a000-65bd-426a-8d77-e424069a17ff", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683202541, "uuid": "a41e212e-ffe6-4c9e-9f24-6bfc5f6519f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202541, "uuid": "64fa3c07-021d-46ac-b6d8-ddfdc7251fc6", "value": "517961288036e2c0ee6259142a1c225b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ebc754-eaba-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683232234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683232234, "uuid": "31841493-a55e-4c4c-99b9-3e1126f691da", "comment": "Malware payload (Amadey)", "value": "3085e36e88d57189856769e024ed70fe", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683232234, "uuid": "55170493-277e-4636-a9ef-0e837cdc28c9", "comment": "Malware payload (Amadey)", "value": "1959ee6d6e9bcc393646c9a64340b7df08c66969781a777236d424323a678df9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683232234, "uuid": "bba1072e-8556-43d1-8b4d-220d5e8bee90", "comment": "Malware payload (Amadey)", "value": "76d59fb06f547c49348150a6f9d53e362720d7c0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683232234, "uuid": "2b494958-1526-45cb-9459-0c456a3c67bb", "comment": "Malware payload (Amadey)", "value": "3a1c0f5b935d974858399dae8cc8b6a3496c3fb20cb62dd87d9537086fc213e446d240510562c4f320afcdfd3b7695cc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683232234, "uuid": "63618f74-ded4-4699-b077-601eb85a2114", "value": "T136840112BBE94072DCB227B058F707E31A327DA14D3453672759AD5E2C73684A83A73B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683232234, "uuid": "4a9c4fbc-c90f-4138-9511-f75fb9c3c7a7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683232234, "uuid": "51898fe7-d695-413e-b559-a1b828c17086", "value": "6144:KWy+bnr+rp0yN90QEvkCopKXdSJVzg1ID1kDSZqRywR5pXoqJkGoxeB:yMrjy90pnteVzg1G1koda5VVs0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683232234, "uuid": "2c3392bc-0887-4b63-a095-a9a924048e23", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683232234, "uuid": "00b40603-8b93-497a-b15f-4f7bfdabb484", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683232234, "uuid": "62f3f2c4-3d42-49ca-9fb7-69dd39315598", "value": "1959ee6d6e9bcc393646c9a64340b7df08c66969781a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2184fcde-ea53-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683187828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187828, "uuid": "43fca062-6cbc-4d02-ac5d-2190efeee228", "comment": "Malware payload (Loki)", "value": "4611965d6a267d9d868bab2690f0a533", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187828, "uuid": "326f7a56-5ac9-4614-ae7e-cac289338fd2", "comment": "Malware payload (Loki)", "value": "19af5e15b1e1e9b6eb90f2a93f290ae53cb2ebdee29f972cfb3bf9e9dc38444e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187828, "uuid": "c858145d-4608-4cda-8baa-461cda7cfeaf", "comment": "Malware payload (Loki)", "value": "ef3102bbd4566aac1aaca456c9e8b8189f85f372", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187828, "uuid": "3303c06c-d9a3-43eb-839a-2ddf1fb59f49", "comment": "Malware payload (Loki)", "value": "179c949db3e90b96901e5c3b69df5d2f4d126df1f43f99f6dfba5a3851f205e35a6f4948d7b16e4f9f5ecfd2a7d3b583", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187828, "uuid": "a42b4a97-2da5-42a8-a8ef-2802baf9ffa7", "value": "T129E4016710AAC390E02F87F07869BD7426A331CBE8E3AE35076A79C54D59B113C9D19F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187828, "uuid": "a1ffb360-4247-4391-a22c-8225b5581675", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187828, "uuid": "fe54bb02-fcec-4f75-9134-a18eef37b79c", "value": "12288:FbkcdXHwni4IyS+zWexwpY7F3qHZzjpZTNvkIk+ECk0Haz:FbJNwLTxwlzFpxwHCk06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187828, "uuid": "8e8df27e-a194-4372-ae34-64bdcad0fe3a", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187828, "uuid": "5ec19868-301b-4e92-85f0-c46160616879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187828, "uuid": "aeabe9f2-a5ca-4368-bf89-ed45bad3f7b3", "value": "4611965d6a267d9d868bab2690f0a533.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e30d7a-ea60-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683193533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683193533, "uuid": "ddaafc2d-ded8-4b8d-ac33-4fb1f71dbcb3", "comment": "Malware payload (RedLineStealer)", "value": "0789837beeb6941fe2f9919fad5d6cce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683193533, "uuid": "63a60c9f-e7cc-4078-bbd9-7620a146b618", "comment": "Malware payload (RedLineStealer)", "value": "19f392a08f214c34acb374613826fbfe762a4eb638965f7bbba321835f3b705a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683193533, "uuid": "174fc951-ba5e-4f65-abf9-f0ad12d1bf60", "comment": "Malware payload (RedLineStealer)", "value": "6f1644d6aee8cce6165c4081f88b0e5876692311", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683193533, "uuid": "f6089c9a-31ee-4c98-b302-072d1c81a132", "comment": "Malware payload (RedLineStealer)", "value": "0f027b45b8dfbc5e9959ba5ea41be26b1dcca556bb6a1be1241a0f9452778a9e6f498f1bbc325c64daa29c1b40fff32d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683193533, "uuid": "4f3587ae-a14e-4dc7-95bc-47b5275e0097", "value": "T1E8752343FBD18472DE79177158F253830E313D991BAC9B6E2B0A6E4A4CF21E4A53173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683193533, "uuid": "8abf7750-a613-413c-b3bc-4401e31aafec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683193533, "uuid": "6d298c1a-390e-45e6-9e6c-b5a23a92264e", "value": "24576:gy46Xt/THAeNcpSlFmKdnCMWJBGKn8EgNXOaRPwO+AGqz6:n40AU/s7G0arj+AGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683193533, "uuid": "1eff470a-fe32-42fd-a8af-871f00ea7142", "value": 1622528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683193533, "uuid": "fe625da1-7408-4ec6-8420-cbc39ef59425", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683193533, "uuid": "223073b9-d1b5-4cbb-9998-9691f2085b39", "value": "0789837beeb6941fe2f9919fad5d6cce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63ac4b6-ea63-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683195030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195030, "uuid": "39864a79-769f-4399-9f27-1342894b74d4", "comment": "Malware payload (RedLineStealer)", "value": "0a8178e25c7979885d7ed60f57c84fcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195030, "uuid": "7899acf5-a186-4253-9e14-96354dbfe49a", "comment": "Malware payload (RedLineStealer)", "value": "1a16160e143ac4e3c39d58ecefd09ea79f1b950140a6535dc31d1c374eedbf00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195030, "uuid": "71f459f5-cccf-4769-bd23-ebb2be0b74fb", "comment": "Malware payload (RedLineStealer)", "value": "3a03fe988f0a8ab0089433e659968453c76a267a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195030, "uuid": "b91b6ef7-f48d-40eb-81d0-c0500483f054", "comment": "Malware payload (RedLineStealer)", "value": "6170fc197c34fd13fa3894cab4bb1b2b1a049a9d74add8b3681f366d0ec6b2a183110421f3067d1ccac75cccaff8fe8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195030, "uuid": "a7d34cb1-862e-4228-8fb3-d61969d515a4", "value": "T1DC652347A3EE9433E5B01374BD7A33C31A39BDA65D7C52673381D98A0C71A80A87536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195030, "uuid": "0da5bbab-e2be-45aa-b84c-1692b0dab02e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195030, "uuid": "25ea44f1-fe17-4745-8ea0-2ae812984f13", "value": "24576:yyw4xBsbAXKRlKKSdNePcMG06+kPrL6/5A/ev/moALUqltJZRkHwariupxf6y2Lg:Zw4fswKSdNKC06+mLE2/eGoyUKZRkQwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683195030, "uuid": "5e43f126-0b40-4efe-a39d-c010e05bab44", "value": 1523712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683195030, "uuid": "212a8fc9-3a92-4584-854f-02e9ee9c3e34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195030, "uuid": "c7c3ee7e-c9b8-4c45-8dfe-324ab4c216cc", "value": "0a8178e25c7979885d7ed60f57c84fcd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d7fcb0-ea6f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683199838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199838, "uuid": "7018027f-f5ee-46a9-89dd-7fb2694c6ed4", "comment": "Malware payload (Amadey)", "value": "5c929b99c543804f2bbd89e67b9cf901", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199838, "uuid": "12b4645f-17ba-4161-9cbc-411a395614e4", "comment": "Malware payload (Amadey)", "value": "1a2dced8f6d1043519958a49faf5ef5afb5ec61a70e77fa53ac3f220bbeb195d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199838, "uuid": "7dffb8e6-57f1-4069-bb23-5d088dab18c7", "comment": "Malware payload (Amadey)", "value": "dfc97966cabaedb0b1c7eb07550bddf739a648ca", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199838, "uuid": "68a9cebf-cde9-42bf-b53f-59f30a7fcf8a", "comment": "Malware payload (Amadey)", "value": "050cec3ba161dbb48d61e6473fc3742daa50a3d04f7fe101eec74acd52981e821eb05c4954b269fc99e64ac10df70cf3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199838, "uuid": "8b1f1bda-1238-47ec-87db-37cce4bdcc05", "value": "T10CD41216BBE84472E9F51BB01DF603830B36BDA14E78975F2B86285A1CB35C0747176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199838, "uuid": "aebcf66c-9ce9-4bdc-ad24-711a7fc6742f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199838, "uuid": "fe048d81-64d9-4acc-a73b-c86fcba02faa", "value": "12288:SMr5y90bhRh4ZJOaIV84oukFD7bw2wEGA+ggP6UzHJU:fyQ6caIV7oukB7bw2w/ANCzHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683199838, "uuid": "c07ac1b0-8126-439b-b9d6-6fdd5ecd1c29", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683199838, "uuid": "2c9ade57-3ea4-4734-8e5a-b4b7ac117bc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199838, "uuid": "9fd53513-67b1-49d4-9079-ffe4f3e68c8d", "value": "5c929b99c543804f2bbd89e67b9cf901.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f45c5a0-eace-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683240706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683240706, "uuid": "b6710038-0a2c-4a20-b2d7-198a70d635a7", "comment": "Malware payload", "value": "6e18a1ec53d190cc1d5c52908c7c54aa", "object_relation": "md5", "Tag": [ { "name": "embedded_MSI", "colour": "#3C9741", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683240706, "uuid": "67272544-fdd6-4684-8d65-820b8faf1016", "comment": "Malware payload", "value": "1ad3662bd1d6f59db2c6875873efb388980359e1af16c355bc5eee190704456c", "object_relation": "sha256", "Tag": [ { "name": "embedded_MSI", "colour": "#3C9741", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683240706, "uuid": "c37d3cfb-d07f-419e-83b9-0bdbf9f8c109", "comment": "Malware payload", "value": "9bdebaf83ef113a4187221884c826202cc3cc3b4", "object_relation": "sha1", "Tag": [ { "name": "embedded_MSI", "colour": "#3C9741", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683240706, "uuid": "6040f96f-dc13-4e39-a243-74a11df263ff", "comment": "Malware payload", "value": "416c60fce41de1ec7cecd8956ee56fd029f9f832c9111c1aa003468c76d946652984bffb84f30402c7848032541c2b9f", "object_relation": "sha3-384", "Tag": [ { "name": "embedded_MSI", "colour": "#3C9741", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683240706, "uuid": "7809b357-ac8a-4604-b332-0150574ecc98", "value": "T122F556D17784C223DA5309324EAB93D91769FCA0AE31B0877761B71E5B78ED3AD21342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683240706, "uuid": "53f3876d-4b1e-4ac9-b60d-5c8d611cf69a", "value": "49152:ZpdSlZmy0YGrxnwhzGMPuD3CNfIXuDvN9/vNeWjSc/eMn5WcPP:Zp2rynwh6MPuD3CNweDv/v1jSJMnwcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683240706, "uuid": "d8057809-5670-4a1b-b0a2-53e98797b8aa", "value": 3361760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683240706, "uuid": "65f9d9e4-d613-4cef-bc27-6fd9a42fb820", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683240706, "uuid": "a4ae5a7e-5772-4483-9fd4-9bb46d4fc551", "value": "review.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b3bb0e-ea4a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683183919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183919, "uuid": "a46e1380-4303-4cf7-97a7-a6b051a4604c", "comment": "Malware payload (Loki)", "value": "15442249cc969c31c934f6dc3d36e088", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183919, "uuid": "ceff4a9f-1313-4fa9-8295-a056ed697964", "comment": "Malware payload (Loki)", "value": "1b0e7b89d2ffa10bd99d75c31e4b06c5a05e978e8b601bf6b6bb29294a27a3b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183919, "uuid": "26094c8a-4e0f-499c-9e69-dc2246f22c38", "comment": "Malware payload (Loki)", "value": "73156f0b52ed7edbaa39b8addb65bafe4b5a0649", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183919, "uuid": "2201d2d2-788f-44f5-8c00-7d0390e45f69", "comment": "Malware payload (Loki)", "value": "e609db0004fdfd93d7740faaed5a4e4e374b7ca837864324c7dce84d165ff563eb0a469335419f443085510b5c1ccb6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183919, "uuid": "63725020-db3e-4f69-9faa-da17d6fa7007", "value": "T1D7B4CF1661A5CF1AFD7A87F15474FF8463F0B07760E4E1242FBA60C6DAA6F110A4C61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183919, "uuid": "214b6784-588b-4fc0-8746-cf0229f54f05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183919, "uuid": "5a5200ba-ad06-4ecb-bb73-157f460f815c", "value": "12288:F+0IQx//Zj3B0Qv/auZXJuS2ViqAvhiZMR:sMZLB0E/auZXJxBvhKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683183919, "uuid": "8c9cc356-1acd-45c6-b117-f446437ef297", "value": 521728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683183919, "uuid": "1f1360b8-b38f-4c8b-8a99-132fe45f9c5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183919, "uuid": "5489e117-d491-47df-8b02-790633dec9de", "value": "15442249cc969c31c934f6dc3d36e088.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d519e8-ea50-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683186567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186567, "uuid": "fe193e98-f159-4128-9adb-c485543c22d8", "comment": "Malware payload", "value": "ad660c2c234187c8f7934e19ba948531", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186567, "uuid": "c99e42a7-5107-4776-a8c7-98068ec0eb96", "comment": "Malware payload", "value": "1c0525dfc59937b6bf51b9cc081b37bf09f361b8f324fc67599c774999eecb45", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186567, "uuid": "7b554bcd-3ae1-43f1-8974-b87806a7fec0", "comment": "Malware payload", "value": "66c800f6fc7dedef5411d72410aad9b3819f14a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186567, "uuid": "20b5c8ce-275b-46d5-9a29-5dccb9853858", "comment": "Malware payload", "value": "a70c3591c7a8b6473d72ac3f7c4a407d1ca5b5ff4ce17ea04472aabfc515b2d2303258ad335e72b4e08dd661f1364b58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186567, "uuid": "dfe17ec9-b670-4594-bccd-b6fcf432ff18", "value": "T199A3942A3E21EFFFE568863107F35E7093D5629226A19386F25CEB181F6128C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186567, "uuid": "fbf9628a-c173-4558-a969-b6cb66766df6", "value": "1536:S7j+1TfCq+LzIfK2rKIfmaHy6rfV2D3nek2bS1jxlrimW+zWBSirHzai:VR/fymd2D3t2bS19pimW+zWBSgHzai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683186567, "uuid": "9e14391a-8561-48b2-ab71-5c3ab72b9e1b", "value": 104712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683186567, "uuid": "121f06aa-7829-4b3e-860f-3f7c1011ef42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186567, "uuid": "c74b0dc7-a199-4fe4-a467-16d798bc78c3", "value": "ad660c2c234187c8f7934e19ba948531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07d35b8-ea1d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1683164955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683164955, "uuid": "e37addf7-5635-4a5f-af81-c4ea258d2566", "comment": "Malware payload (Smoke Loader)", "value": "eb08adb802457a9fe7a364da758ac764", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683164955, "uuid": "10cbfc29-9de1-4542-bf65-0b02cf510734", "comment": "Malware payload (Smoke Loader)", "value": "1d94b2f754fc421be9bacadd360061a685f2faf3595b7f453e4227a0fd07a8a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683164955, "uuid": "30c3d8a2-aa2f-415a-888e-3a7bb4cd59b2", "comment": "Malware payload (Smoke Loader)", "value": "3c176ecf1661c9146d17f12ee19c9d1b14d92643", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683164955, "uuid": "8f730c28-7ef0-4faa-86bd-0e31635af5e6", "comment": "Malware payload (Smoke Loader)", "value": "075c1440813c846571bc622c579159d261e5edf7e411484483a9cf0cb68a0a2272082539ef61baa3595e7d76d03b77b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683164955, "uuid": "5f9fa11e-725c-4446-850f-fcfe51e5d299", "value": "T144445C1272D36834F6168A364E1ACAE4761EFF618F177BEF36146A2F09711E2C572312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683164955, "uuid": "df8ffde2-7560-4162-9481-ecaf82fe028b", "value": "2d39bee49f300ea90fe79768115a52cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683164955, "uuid": "0569e849-ffcb-45fd-bdfc-e01744bd0c7a", "value": "3072:Hl42iGxUvzLMfsYjO7FNhgqVVMa6fmq2QNHoLzSoKmEY0E0/QuZ:+9NbQfsSOxgqzMF/fuXV0Iu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683164955, "uuid": "2bb9dffb-4358-47e1-9578-99753f1c9f62", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683164955, "uuid": "b225628a-5901-4bac-b71e-934e311ca8bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683164955, "uuid": "4e3a918f-c6b9-41e9-972b-a501157d2758", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adef9ff0-ea58-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683190211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190211, "uuid": "46247ecf-c50f-4c03-8c63-9aaf1f664721", "comment": "Malware payload (Mirai)", "value": "e71b7559af90ba233e230064e7e3dc32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190211, "uuid": "33d7ac04-4fad-4199-afe0-3320bf76abd8", "comment": "Malware payload (Mirai)", "value": "1de8182cf04e8dcbf324ce477a9bba0ad5c72162f82a48a5942ec8d060c85517", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190211, "uuid": "0fd0e760-c675-4e7b-a6ee-f3092be36c10", "comment": "Malware payload (Mirai)", "value": "19db20a847b9ced79857d34f71acb20196c195c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190211, "uuid": "c8852a60-8978-416c-a64c-d15df8310a89", "comment": "Malware payload (Mirai)", "value": "5a2ab1669d20ac88aea9a95e7e81d2afcc11bd272019eeedefb3b1288927527f1b18cd2023755ed863824a32d1ebbaa0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190211, "uuid": "94db94b7-c324-414d-9567-e86c57677f19", "value": "T1FF83185AF9816B11D4D926BEFE0E1189335357BCE3EE7212DE204B2037CA66B0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190211, "uuid": "9bf996cc-819b-49e5-a746-267320b4bbd6", "value": "1536:HUn7/fgAKGKVKZKMK/KiiDUdo9Qj4H+SaaZCjnMSzdl9uir+XP8BY79d8:gjKGKVKZKMK/KiiD39Qj4+SaaZCjn37b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683190211, "uuid": "aaf54e38-1046-4071-b4f5-0cc8e3e01d75", "value": 87568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683190211, "uuid": "7bdcc487-c31c-45f1-ac0b-9cd836ec5aa5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190211, "uuid": "17030201-1fdb-40d5-9f02-18dffd0f01fe", "value": "e71b7559af90ba233e230064e7e3dc32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8533af94-ea49-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683183700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183700, "uuid": "d9594062-0352-451e-ab36-27824ad6addf", "comment": "Malware payload (Loki)", "value": "b4e8d27505183f3dea2f67d532451af2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183700, "uuid": "58d2190a-c387-4c95-82f9-1fe328e41ca9", "comment": "Malware payload (Loki)", "value": "1ea825f3f0e0d5763da992b6f42ba33f5a475c30ce282ce24939017168bbe53a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183700, "uuid": "f2a77bac-41d6-4759-b544-9612deeb025f", "comment": "Malware payload (Loki)", "value": "5b629d30ee3d6fde349ade9b80129ac288642265", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183700, "uuid": "78974500-255d-4e46-974b-0c4c578ba95f", "comment": "Malware payload (Loki)", "value": "980fe5b9066dfca79d234fd75b6930bac863928f6803b37ab800a245f0296a36a37db658678d7836353fc7b1351caeca", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183700, "uuid": "7d5ec5b5-d36c-4ffa-9f0e-f8aad0cd68e0", "value": "T122D2C65EE79B03788B520271272E0EC99B7DB13E73519071386C837433A987A42B66FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183700, "uuid": "ed945d61-3afc-45ca-af24-2ff8fbfd2bc9", "value": "768:oFx0XaIsnPRIa4fwJMbxFZWbHP50W762N5MZHpm:of0Xvx3EMbPZWbHaM5OHw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683183700, "uuid": "548b6956-6f90-4eb9-a5d8-27d3d0ee873a", "value": 30466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683183700, "uuid": "8aa48117-d1e8-44c2-b79d-b6e343533ce7", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183700, "uuid": "5bc9b710-197e-4799-974b-68ffd6c824f6", "value": "PAYMENT SLIP_1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d17f4bac-ea4c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683185117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683185117, "uuid": "70d8e338-e7fe-4f41-af5f-a89bdcc0ba70", "comment": "Malware payload (Amadey)", "value": "f2f0e6f5ab1c08006475ad964f9dbb0a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683185117, "uuid": "07079993-307a-4c85-b7ae-4c78972d0775", "comment": "Malware payload (Amadey)", "value": "1eb21199cac62b830a78915ddb790eb2063a6755713715a5c8117bbb50f19079", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683185117, "uuid": "a7dbe734-a749-4149-9f23-c811f02fa098", "comment": "Malware payload (Amadey)", "value": "ef7a5b6c3a33585ac8cd9b226b8ed9aa53b16d49", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683185117, "uuid": "60816960-9979-4ad0-87cb-bbecfc39bd86", "comment": "Malware payload (Amadey)", "value": "c89ca42365981f6d81c003986ccca2b91c3fdbd322dd88f8bedb60db03e1a010d73a05910801dcb8c1de3a4b7362012f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683185117, "uuid": "bc49a88a-e69e-4925-b2ad-f5955491cca0", "value": "T18DA40256A7D88572DCB21B704CFA03830B36BCA15D78976B7B45AD690C72AC0B53273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683185117, "uuid": "0a86f8b6-4c6c-4a2f-a6df-7af8e18d6fca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683185117, "uuid": "64c641c8-a935-4dac-b6c5-572e89c3d1cb", "value": "12288:gMrpy90sE6GnzGxmtrKE9+gl9by+A63ZGbP:ZyU6GzOqv+g3DA68bP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683185117, "uuid": "26c63373-a576-43cf-abcd-d3072073ada1", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683185117, "uuid": "5e15dcb8-d220-4ab8-9fc6-55c0aa0e3a28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683185117, "uuid": "c3f8aba2-6935-41b4-9dcf-dd02eded9264", "value": "f2f0e6f5ab1c08006475ad964f9dbb0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c13fb135-ea30-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683173063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683173063, "uuid": "fe994901-e928-4e1b-a097-e6f5d0cd862b", "comment": "Malware payload (AgentTesla)", "value": "9fe535a2512484cbf82fdb18f50fd740", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683173063, "uuid": "7cb1cd33-0d61-48a9-8792-5eec389b5130", "comment": "Malware payload (AgentTesla)", "value": "1f9e0b90bc4d0816267977ba20fb2d704c9859177bcc4759d89cdcc57918d12f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683173063, "uuid": "3b3d742c-30bf-458c-b1d1-55a5541df623", "comment": "Malware payload (AgentTesla)", "value": "c542acd1c32b26980663d041d65aa8207c624166", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683173063, "uuid": "2a8c382a-eb77-42ef-9b5f-964744b0d6a9", "comment": "Malware payload (AgentTesla)", "value": "ae020815a0367168ca23fee8ce04f90be1564c17f813b2ba2e3a39e187e5edaeac543840dbcac2bae2b6e9690463c86b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683173063, "uuid": "bdcc8039-6662-4a35-900a-e92aa7a36e5f", "value": "T1F2B3F7207786D81FC8A117348EBBDBB16671BE60ADA28F2A36C17F1F3C72524C915751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683173063, "uuid": "e8a7fc7c-5f78-4f74-ba5a-902dc933a244", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683173063, "uuid": "8d18a6ff-c113-47ed-9efc-dd626470ebc6", "value": "384:t1OWSVEuSKUlHPidFQ6cne97nOl0OfNe0mI4zpXJe1KLgP+a8zRCxjU2:9SV2v66SOlRII4xBt8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683173063, "uuid": "369d9ec7-8259-4acd-a2b0-2facb99b2d0b", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683173063, "uuid": "a9ede0f2-e319-41c2-9756-bedf8ebfa5be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683173063, "uuid": "c22210a1-9119-4000-8624-c43ca9d4beff", "value": "9fe535a2512484cbf82fdb18f50fd740", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a9328f3-ea8f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683213640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683213640, "uuid": "12348507-c851-4fbd-b181-81bdfe549a14", "comment": "Malware payload (Amadey)", "value": "88278f2baf7f6aea6e331bd379a2465e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683213640, "uuid": "525f7383-2cb7-4df8-9d2d-9ec5b4724454", "comment": "Malware payload (Amadey)", "value": "2015fd992788da74c68562fb9abcbab30827a2c4194a555fa3b7b82c917683d3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683213640, "uuid": "801c3a7c-cd95-453c-b509-fdee52ad9600", "comment": "Malware payload (Amadey)", "value": "e18d1c6c07c84757a57c2c17d242dd608f0db5d7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683213640, "uuid": "ad974438-2d64-4665-8d8b-f728a0fa63b6", "comment": "Malware payload (Amadey)", "value": "bd90c7bd330d57014ce281a152cc4785cefa7c921249ea37290ff58b2d13c0418d35964041a6489b51ea457cb13ce5eb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683213640, "uuid": "d1f52064-77b6-49df-b18c-c0ae3480f67b", "value": "T169D41202EAE85073DDB52BB05DFE03831B3ABC919A3493AA27865D8D1C736D06536737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683213640, "uuid": "f4152224-aa65-4603-9e40-56078c66029d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683213640, "uuid": "34a5831a-e9c8-4e88-afec-798d5f953329", "value": "12288:PMrYy90RxgZiEbJIrI6HK5w+oHhGSpaDoJjWrbNznymxiIkB2X1:Xy68LaqO+o8SQDoJjW/N7jxvLX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683213640, "uuid": "f6a2d7e5-5f35-43fa-8fc6-9d2e3b2aa0ff", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683213640, "uuid": "56310dcc-eacd-444f-97f5-466da48423f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683213640, "uuid": "f5dfbc6c-fa77-45b9-8f11-ca423f1c4d46", "value": "88278f2baf7f6aea6e331bd379a2465e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfdb63de-ead1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683242264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683242264, "uuid": "c167755d-6bc6-469b-8faa-959d3ba28d59", "comment": "Malware payload (AgentTesla)", "value": "114544ab1868f27ef24cb813406e06c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683242264, "uuid": "a436e6dd-86ec-46a2-bef5-9da98b98fcfd", "comment": "Malware payload (AgentTesla)", "value": "203c54db6ea49b332902effc5e4b8c9365f966bd744b00372da7baef4b45184e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683242264, "uuid": "8875fc96-8980-4e41-a86c-6321f2ad4aa9", "comment": "Malware payload (AgentTesla)", "value": "9f3329f0e442340ad2c7049bb7f7b488851dda64", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683242264, "uuid": "77436cd3-7117-434b-9e71-d37e38fd2cb2", "comment": "Malware payload (AgentTesla)", "value": "2ebc981dd3d8bc9c2035df9f47fd39e90c7896ea33d6a8775bf6dd9a214e8b9e47486eaa9279269a7d50ad887319db23", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683242264, "uuid": "c242c65c-4f9a-4ca6-921c-254573e632fe", "value": "T195D46B525065CE5FFE2ADBB08575FF85A7F1B07324E1D0201FB961C9CAA5F012E48A2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683242264, "uuid": "c55b50fe-ae02-42c3-ad6b-361a5c1a8837", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683242264, "uuid": "acbfdc80-bb08-4ec0-b410-9378950cfd55", "value": "12288:ZJPg/egQVt0pZgzVmcweMHrOM4/Nu1EpokkmEDe7CN57uS8mSLO:ZJPDVm+TMGN+EpokDol/p8mSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683242264, "uuid": "f07be391-3fca-4369-be05-22efe2b5ccf8", "value": 621568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683242264, "uuid": "3f72f455-bb7c-4006-90f1-118a075ba308", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683242264, "uuid": "429ada61-5516-448b-83e0-f3ba6e81f2c6", "value": "new order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3328db94-ea57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683189575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189575, "uuid": "9f5deb01-203c-41c8-9d1f-bcdc1a094388", "comment": "Malware payload (Amadey)", "value": "c9c3af8f1a8ba27decc736c1a937ff9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189575, "uuid": "cd34ad34-b7f4-45b0-a9c3-04cace2edbee", "comment": "Malware payload (Amadey)", "value": "20c6d3e4d542cbaa2b5fe6e26ddd4fae81de541f6f8f67a85b6a3ca4cc9effee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189575, "uuid": "3aba6a2e-a86c-4089-a1cd-c8fa98264e0b", "comment": "Malware payload (Amadey)", "value": "c9f937958809c653cf9d6278c047112c93405c6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189575, "uuid": "a056d35d-bbfa-414b-a844-ba1eadda4ba8", "comment": "Malware payload (Amadey)", "value": "c778a49e4e25ce99bbab845139e176ec2fe41d59fb41d0404f79be9baaacdfbe062e840be29f3319e74a0327a9882a3e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189575, "uuid": "34da1307-1134-49a5-879b-bd288cba00a8", "value": "T12BA41112A7E89072E9F463B064F612830F367DA04D78877B7749585E1CB3A84E93E727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189575, "uuid": "df04cbc6-7ad2-4762-a4ff-f4f329f745fb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189575, "uuid": "7fb25fcd-ceee-48a4-b3b9-858de2312125", "value": "12288:7MrGy90PD0OFGYusUWcdoQqYv5V4h5LvMbf+LF5NN:RyMGgUxX5Vi5wb8FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683189575, "uuid": "290eba3d-eaab-4595-be7f-4c29e0c59983", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683189575, "uuid": "52008b75-9bd9-4479-9fe9-9a83f3f09ed6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189575, "uuid": "60c0d7db-4aa4-40ad-bf3e-08c9769278c7", "value": "c9c3af8f1a8ba27decc736c1a937ff9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73596344-ea86-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683209870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683209870, "uuid": "2a0c5772-d61c-4a51-922a-b32ff6a8b458", "comment": "Malware payload (Formbook)", "value": "6ababfe9f98d833317f718c4d3d74145", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683209870, "uuid": "2e1dc09c-d0fe-490f-ab7c-b8af4a7b4d8f", "comment": "Malware payload (Formbook)", "value": "21037d3de36ca089fdc638c7a3a09a00568d5d56e16aebdc2f30398e4eabffa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683209870, "uuid": "5f70695d-d466-4c9f-ba1c-c4d4cb5afefe", "comment": "Malware payload (Formbook)", "value": "03e660fe8bd44ae1301ec24bd115ed9637d18ba8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683209870, "uuid": "1a28d3c5-a1e5-47af-9a6e-6283b168912f", "comment": "Malware payload (Formbook)", "value": "0bf6b3f5818f54755e95324a2ce1f5c1d59bcb1a265a48ea5502003af12bb357f35afb3d5ea51b4b0ec93c7ecb7aaacb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683209870, "uuid": "90543efb-b9c8-44f5-b423-706fffb6a3df", "value": "T19DD49D3C297A5623C1B5C379CBE09827F1509D6F7021EEA994D333A60753B9639C326E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683209870, "uuid": "697cf21d-56a2-498d-9126-0cc0b78860e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683209870, "uuid": "41941703-a852-4c96-a114-251890e17f27", "value": "12288:V0v9iQf9KqnAoDpcz/dJenAIQvNmpZiollSkz8+cZl5:VUNfbnHqz/+nAIDzl8NZl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683209870, "uuid": "bdb8fcb1-6c0a-4ad6-9f19-667bd5fc98a5", "value": 640512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683209870, "uuid": "d7ee2d73-9e54-4fba-88de-37b8b6ae4cd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683209870, "uuid": "f98e81bf-b138-4c10-ad09-2a370d387fb6", "value": "scan copy-001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e57f64-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683194165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194165, "uuid": "8db3e3c5-6fe7-4478-bb92-9bb717b1c3ee", "comment": "Malware payload", "value": "245093a383a1fcca566e739767711a22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194165, "uuid": "daec9cd7-a3ab-4915-bf80-959394d809c1", "comment": "Malware payload", "value": "229a98c79c906623ee3cc6816c1264f044b358605a16875dd6fc076de6e054b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194165, "uuid": "5a958a2b-e3cf-4264-8c70-78b952b913d8", "comment": "Malware payload", "value": "6d5747dcc656de02879dfd65d73a95e4dadcfa08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194165, "uuid": "d9750d1d-9130-48b2-a31d-21c84d953310", "comment": "Malware payload", "value": "d5bbb76a176b4eed4a504e71aed4935ad024a32c9d43a1ff41b012ef1d9ccb9caec3c4222884e5418670eaeba7b6c434", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194165, "uuid": "31dd7997-f4e6-4c4f-921e-901cb2a1db49", "value": "T16F813BF27E243633C3A7513942A1BD621E5DE530D3CFE94B9E854D03F8263A1190EE95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194165, "uuid": "29b91790-42c4-489b-89f6-ddb208b45084", "value": "48150c09e4e291e147a416f3401fdc4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194165, "uuid": "38bfa5e3-3f53-435b-bba9-c4d477872a6d", "value": "48:6pb+hgg/bOdtSuNKE9h4PglsvJ3NLyMv+yZbVZCLl5YlWSeJY8JTaETBhO:O+Kg/CdtSbEn42sB3JyPyJCL8aTHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194165, "uuid": "f637f186-f0c5-4879-9ce3-d190c939a979", "value": 4128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194165, "uuid": "5a1f3b31-b97e-45ad-bc75-3d6ec4bf2a70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194165, "uuid": "e9f143f7-35d2-438f-ae80-e7f9f5819bb4", "value": "SecuriteInfo.com.FileRepMalware.25834.12665", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93736b4-ea5f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683193236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683193236, "uuid": "c8235867-d869-44f9-8c14-d425a86cb677", "comment": "Malware payload (RedLineStealer)", "value": "abba8e33e2b5a97f0ebb4e55352bffaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683193236, "uuid": "4eec1c30-1abb-44f5-bd83-fe33cc7572a9", "comment": "Malware payload (RedLineStealer)", "value": "2304d9ab36c1ce75a2990636dde662986a6ec9e3e0368bc19a1d0574d89493fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683193236, "uuid": "2bddb9ea-aff0-48c7-b7b3-74f96f8c9e6e", "comment": "Malware payload (RedLineStealer)", "value": "4cf8558c706120100a39012bfa263f41d0ef6765", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683193236, "uuid": "ea4734a7-0fa0-4ca4-aa3f-75de921b3593", "comment": "Malware payload (RedLineStealer)", "value": "bea7fcfe3520679a302f4a362346574bf19403d90c5e3875d48411ff601e2490a431d425f673ae213647528089d79950", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683193236, "uuid": "387c0c61-3102-4902-ac3c-3d21704bf158", "value": "T12884DF1232D0BD70E7728A31BE6A86F0672EB9544F176AE793555A2F0A331D2CDF2341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683193236, "uuid": "57a7fd71-be37-45b7-992c-b03c0701ed0b", "value": "43b84a19b996f82f90acda908578a933", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683193236, "uuid": "59d8f08d-691d-44d1-87bd-9fec836eff93", "value": "6144:4mB7rUmNZoy8n9AhW9251L5G8CMxdq47K0iAPjNwvMS7Nlr6pvL:4mB/Umkyo3925m8CMxdRiAPpwESplr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683193236, "uuid": "26156dac-343f-4d0c-9c11-e88d50380da0", "value": 392192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683193236, "uuid": "3e94efe6-9841-43ab-bb62-f03f99a736ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683193236, "uuid": "cfb870f7-b6bd-44e4-ad53-014d00a2f027", "value": "abba8e33e2b5a97f0ebb4e55352bffaf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15784dca-ea8e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683213148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683213148, "uuid": "07adfd35-2e25-49f4-b1f9-3e4e9c295eb5", "comment": "Malware payload (Mirai)", "value": "54bf1a7b32e65adc68ff5115f064c2d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683213148, "uuid": "3dcd7491-378b-4ba1-a570-43658035fbfe", "comment": "Malware payload (Mirai)", "value": "238797e42d07500b7fe889d249b5425ee454ce61bc77640e3ae62f691054f839", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683213148, "uuid": "aa0a4203-1b46-4dc8-88c3-20ec1b1b107a", "comment": "Malware payload (Mirai)", "value": "a22e41d8cef0d9e9d33eddf4707fd9cbaa91f05b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683213148, "uuid": "14c99b10-a35d-4784-a630-5ea8bde22aa0", "comment": "Malware payload (Mirai)", "value": "b94f666067c0c752006dfd4db10bb434945fa92e09526b9f39a5c54d1a4b4fcd8d07d902279ed606226e5787451bf45c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683213148, "uuid": "88ffa713-75c0-4717-b3b3-b917f1e171ac", "value": "T1E6E2E018D3B45F49EBE2DEF582CCCF80A7519695B7ABDACB3101BF010A64E1128B71D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683213148, "uuid": "51baadb6-5bce-472c-b960-d567690bb7cc", "value": "768:bMiV8w1XM5YHd1VSKcODtLao/rWnfm+8pi4uVcqgw0RKWXN:bMiV8wpMS9Q2GO+94u+qgw0UWXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683213148, "uuid": "98f27da4-6e06-4999-a1be-89006ce6ffdc", "value": 33692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683213148, "uuid": "fc16257d-8a51-46f5-9e30-c1f2cc7fd910", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683213148, "uuid": "b776e4ac-8906-476d-9262-19bcc32941c0", "value": "54bf1a7b32e65adc68ff5115f064c2d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "777ebcb9-ea81-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683207729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683207729, "uuid": "13b74ede-468c-42c8-8716-feadd86ea581", "comment": "Malware payload (AgentTesla)", "value": "b3687f8eddc5d1f3712839cb7230a889", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683207729, "uuid": "df3a1d95-0d84-4d5d-a4c0-d3b8ba4e6b35", "comment": "Malware payload (AgentTesla)", "value": "23f632d64e5af17d84d0abc54d8e7fbcae066f0679dc566f4498d8b87fa686f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683207729, "uuid": "dc47312c-a73f-4631-98c4-87f61dd0aa00", "comment": "Malware payload (AgentTesla)", "value": "dc547df56542f9408d47e043a0b57aa19e8fd923", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683207729, "uuid": "bf54f2b5-250e-41bc-b668-fd176ed037e8", "comment": "Malware payload (AgentTesla)", "value": "b231c660c9c76f1ff15388f8daf192e8c0a7d98c05a8c048b097d8736b4acab9d9005e7e759f2b9a7b8c99b5c9d76d52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683207729, "uuid": "a98827c1-1b2b-4844-bd9e-6280ceb2c1f5", "value": "T10D25DF6E7FD64B93C8A112BEB425479C2B7581CC9B979383E6E4E2692F433C4199D2C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683207729, "uuid": "2d42f117-4fe4-427c-8233-02834a3c00e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683207729, "uuid": "1b8b189a-0389-4f74-b33f-ac85bd7594db", "value": "12288:FhOnKHkqtgEbTjvjmO0Bzubm+e26+4ZaiiOlpS5ESS+3KHpfEp:Fwn+2o7mbzubq2J4ZaiX65QRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683207729, "uuid": "8e93c9a5-d5a1-4014-a124-aed40835a31a", "value": 967680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683207729, "uuid": "8c475638-2c34-4f0e-b820-a2161808cc04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683207729, "uuid": "305fe1cc-a0cb-4d0f-a6d3-e7ca4db1e925", "value": "23f632d64e5af17d84d0abc54d8e7fbcae066f0679dc566f4498d8b87fa686f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0103f16-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683194161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194161, "uuid": "c9251cf5-ac33-4b57-a706-ce6ec1215827", "comment": "Malware payload", "value": "a55ff34d5d2cdccdc178deaa13e862a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194161, "uuid": "90fcd9e6-655b-41cf-9274-84c023cd326f", "comment": "Malware payload", "value": "245cdf25d5633a8bfc5485db713f417818c936052cb72e10abbedc31354c275c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194161, "uuid": "9f1d21bb-5118-4bfa-aa2c-6bd0af3d2c06", "comment": "Malware payload", "value": "b8a1cfc4ddb1a797c2860fca399e2aa7556f243d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194161, "uuid": "d09513ca-9307-4956-9f02-ae0ba7c80d84", "comment": "Malware payload", "value": "3a5a35090dd9ad9e02676054fcc4666c90808d38bfa0a1ae7381b82ccba6522d88cfb34d844451aa5b1bcb4ca762aea5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194161, "uuid": "9d312944-2b34-4efe-a10b-6213e6217bd0", "value": "T1A303E1B88E4404E9DB6CE0B846B85FE12E360FE34C926D07BE41F69DAD9B1947D112E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194161, "uuid": "79f10c33-53f0-4c00-b503-505089743397", "value": "768:3OdGBGGMCpxyCwle8UCN8kSSEcWy5xdEkvKmJgGlzDpbuR1J/0tDYLr65jcK:3HBRNwk8U2EVsE7SVJu50tEvCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194161, "uuid": "41603223-85bb-48e7-9913-6b0232aaeb8a", "value": 39428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194161, "uuid": "1422ddd6-93f3-44d3-b45c-9ff7b7230748", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194161, "uuid": "d183163b-a4ca-4c13-9b1f-2ded7a913e2e", "value": "SecuriteInfo.com.Linux.DDoS.501.28437.3438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a39130e-ea65-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683195547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195547, "uuid": "8698ddfd-22c8-487e-83f8-dd085498a6d3", "comment": "Malware payload (Mirai)", "value": "d8b341ecddcb13df6f6887097118860c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195547, "uuid": "9244260a-38b7-415e-b2f7-8c7623b1e0fb", "comment": "Malware payload (Mirai)", "value": "24f441bdb7983efc4e5edcb910bea421ae6c726f26e439edee9564657f645d60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195547, "uuid": "211ef242-ea02-4918-819f-677424624bcb", "comment": "Malware payload (Mirai)", "value": "fa5c922ab4f85ade28984e2f5777098317c4edd9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195547, "uuid": "6a201f78-d876-40a8-8855-3f4be8abee28", "comment": "Malware payload (Mirai)", "value": "c7e296f81b30a1cee84fced4d3639f8786595cc81efead3fe643c010c767d63d923c932f64cd5afd5ebe111ca1fd3c64", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195547, "uuid": "feda0791-b0be-4cd9-821c-e2ab3c9a2dae", "value": "T14FA3D91D7E218FACFBA9923447B35A25975833D637E1CA84E19CD6012E7034E741FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195547, "uuid": "563a763a-4c7c-441a-8773-b5d646fe93cb", "value": "1536:WFPliusX+JYv5UAX6f7ZQT3YyyYh8xkYm//mSeS3pxoa:W1lXsX8Yvk7ZMfyYh8xDm//mIpx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683195547, "uuid": "be32b2fa-40c9-4303-9720-29008d453103", "value": 101296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683195547, "uuid": "74b3dc04-1a46-4c4e-ac02-4d91a58fac29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195547, "uuid": "2437475a-6d5e-41b3-b108-81f3be40a73c", "value": "d8b341ecddcb13df6f6887097118860c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de266a28-ea72-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1683201459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683201459, "uuid": "c5a33bde-dde9-439a-ac85-9fae406a3e42", "comment": "Malware payload (DarkCloud)", "value": "79d39625291cce5ab8ef74e0a1744b89", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683201459, "uuid": "a8762ad2-2d12-40d7-888f-1da5d44ce667", "comment": "Malware payload (DarkCloud)", "value": "24fa8cd501ba4f4fde04e1de20b2eedf2f899888965cc7e0c81960a37b5aff33", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683201459, "uuid": "6c6b0217-dc78-4ec4-abbf-0e5c7038d6d1", "comment": "Malware payload (DarkCloud)", "value": "5f4a0444b0f61e921c6ded119d5207a5dff0d934", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683201459, "uuid": "73b1599d-cbd2-4f41-a9e6-157aa7f4b05c", "comment": "Malware payload (DarkCloud)", "value": "892b6c599325e300c70b9f4830abe003e7c6f9e9b7cb1195be4fca5e7b3ce4d220f5b50e39a9eea1aa3ad607a1d1d668", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683201459, "uuid": "49cfa131-d4ee-4454-83ad-79aee734aad5", "value": "T17CA4292AFA10713AF863C8B17696A117A8146D371580AD2BFBA0DF4A35715D3D1F232F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683201459, "uuid": "4a2077d9-2692-4a8c-9bd7-04ee832d3862", "value": "d9a1f6f909aab0218d77df1dc0081f49", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683201459, "uuid": "cf391a6f-6ca0-4721-9e6a-a348f95bf0c8", "value": "12288:xr5qW3Z+k2ltOIQt+Ne4NHyg2jYKkJj6GmZU:xr5qOZ+kytOIQt+Ne4NHy3Yb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683201459, "uuid": "1c69e849-0b07-42c5-ad4b-0fc5ecbbadc7", "value": 477696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683201459, "uuid": "a7e944c7-b59e-4b22-a82a-62561f38c858", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683201459, "uuid": "3e67e59a-6540-40fd-8188-b779b802a48e", "value": "24fa8cd501ba4f4fde04e1de20b2eedf2f899888965cc7e0c81960a37b5aff33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45fa0c35-ea6e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683199485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199485, "uuid": "2f0ba9ba-9bab-4edf-b0e6-e29feaeffd69", "comment": "Malware payload", "value": "0505f8cc0b22d4bb60e7ac5c32a9a699", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199485, "uuid": "63754921-fe08-44c3-83f9-8193901c09a1", "comment": "Malware payload", "value": "25602fcedc578641e99eb96b67920bab6221be5e943fab2b55be16ae9e38e9f5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199485, "uuid": "563bc897-d289-44f4-b8e0-87fa2f1c1ff0", "comment": "Malware payload", "value": "5cb83c7d3924f8a579b8d0c32f196c334ba028c4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199485, "uuid": "ec762a3c-9f1d-495b-a035-b1e2e257a657", "comment": "Malware payload", "value": "08a7d02020934c239045de07f28f863c268f4801ebd479ae7ad73d7b2a4f9ad8c929bcb47661731ba35db02edf57bbae", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199485, "uuid": "ca1220d5-88eb-4371-bc5c-6711e3c1e9b2", "value": "T11B4101751E83D2B64D42CCFBE247BED0CE03901A745A141A63DEC25C896B970E57E8E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199485, "uuid": "1676c4f1-ab56-457b-b8e1-ff309d5eaa23", "value": "48:WES5ABNOKy9CWqL1vhhTF39VDC+RNzMwNCsN6LzR:aABE4We1ZFF37DRrp7g9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683199485, "uuid": "59e5a481-dda9-46cf-bac4-29d63889d814", "value": 2064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683199485, "uuid": "dc1d0ec4-8a39-4b0d-97f4-19b0d20e3d67", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199485, "uuid": "fad9f078-609d-4ab3-b928-5b979f03dd66", "value": "Final.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2041230-ea55-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683188956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188956, "uuid": "67e3bd20-fec3-4829-b9cc-2dacd634fc9b", "comment": "Malware payload (Mirai)", "value": "75f17375f4da4401f54bb6f5fe592384", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188956, "uuid": "8c899216-e880-4ff8-8a61-b5c8644a8a27", "comment": "Malware payload (Mirai)", "value": "260ad664c84faf52df3753627555d6e8f99aeabf7d58363e8a42af53ea131b4e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188956, "uuid": "d72f5842-bf46-4a0b-a0d2-0a899cc0ea2d", "comment": "Malware payload (Mirai)", "value": "ffff9576cd4346e342499110f83518aa6d293059", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188956, "uuid": "605ab655-2b52-47e1-bedf-3a87eecb8409", "comment": "Malware payload (Mirai)", "value": "64ea815eda26cdb1ecb1bcf14cfd6183e8a09288b54812d210b838dafd8bb5a4d706314859f27820aef0b78a983f1a3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188956, "uuid": "4947a342-2efd-451b-b33b-eb1b8bb70c50", "value": "T160633A02B3080D03D1A71EB0263F1BD1B7AAD9C123F4F685795FAB96C675E324585EE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188956, "uuid": "ba5b28d9-71c9-4413-8cf1-b9897548b0b1", "value": "1536:rgCqkCBN3xaF6gRiBNmyny9ENjg+nXqwbZnlRt:rqJBNbIwBy9ENjgEqwbZnlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683188956, "uuid": "90abb232-b7f7-4ff1-b643-2179042136dc", "value": 66972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683188956, "uuid": "f8fbeb91-f3b7-4225-99e1-7735ec960e83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188956, "uuid": "d5a222ab-0d01-4083-b1db-4fa4f6ec202e", "value": "75f17375f4da4401f54bb6f5fe592384", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b4ab8b-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683194135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194135, "uuid": "c678ff93-43fb-4139-bf6d-ce9476c8676f", "comment": "Malware payload (RedLineStealer)", "value": "75c970760139d52e33032802ff980c81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194135, "uuid": "f1174190-16d2-4b95-aa7b-472ce62d8e70", "comment": "Malware payload (RedLineStealer)", "value": "264be234fa8d132fe64911214df6d852d2453001d244f0c8ecd47a646cfb16e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194135, "uuid": "a91f18ea-37b5-43ee-adad-fea20d5f61e5", "comment": "Malware payload (RedLineStealer)", "value": "ed2514545bdd5ee938401481b80d8861c56491e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194135, "uuid": "14620e9a-a231-4a3d-8d54-75dcadf44521", "comment": "Malware payload (RedLineStealer)", "value": "351d3793e8c6555f8d02fdc350e080814d0633fc7586a2e06b91f2e6e3d1af8c451cf804e93292bff69d136c59bd81cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194135, "uuid": "3b19c4ac-38db-4aac-8ee5-158cc2a4247f", "value": "T158747C2AE304E1A6FA16913C2CC7616F5AAD787517AF50C33B44471B715FFB03AA03A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194135, "uuid": "bf678fc8-a3d3-4933-b77e-315866e6e08b", "value": "88ed05598d45c16a126d02464dd4684a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194135, "uuid": "87b1ee16-f741-4637-9bfb-c0b14e0ca708", "value": "6144:58iigkguUMJ/8flCFdr1vYRtAfJAF/hX73hw4n96Jp+nfofuG:uvgtpfflCvZvYIfJS1TS4tQfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194135, "uuid": "81a678ec-521a-424a-9766-35fdabf49147", "value": 356960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194135, "uuid": "14f0868c-3f46-4843-b60e-206bb01f2327", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194135, "uuid": "89ae5ae9-0497-495b-8e44-c0b2c358639a", "value": "75c970760139d52e33032802ff980c81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075ed2b2-ea52-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683187355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187355, "uuid": "b4566378-8b3c-490a-bcab-ba8e23a13b9a", "comment": "Malware payload", "value": "07577dc1201c2fe06eeec2090a3169fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187355, "uuid": "d798c2f6-965a-48d4-9164-b397eb4f2510", "comment": "Malware payload", "value": "26c0b3c7101d892d5cc662efaa5aad1aed6399cf95f7349022cdbd49478f4072", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187355, "uuid": "6f42fe68-178e-4461-8111-c053d5bebde1", "comment": "Malware payload", "value": "ba57eac7531d01caac681d65dca107254b1bce4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187355, "uuid": "d9e7e739-df72-4bb9-b064-0efbb7d05b15", "comment": "Malware payload", "value": "26bf0d6a9f64ee494ddcd5923094e6ae50aba2f7a8453581bcd2c4ab6260bfc8958a4f460be5de63c3e18dea7483a3c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187355, "uuid": "b44cb0de-6ffe-472b-8b1d-01823522550c", "value": "T17E63E2AB7A20DB29F65C9B3106F66D74834A13E736E5E64AD18FC2001E7132D4C4F6B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187355, "uuid": "bef34fd7-9d4b-4d1e-a36a-719c84190f2f", "value": "1536:KGfdTBkyvDPoB5m/grUR6wAMJjVrySoC3Fb1lXWPdl:KGVTLDPoB5m/grUJAMjVrp3Fb1lXWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187355, "uuid": "86af96f8-ab03-4d3f-b7dd-801ae208586c", "value": 71916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187355, "uuid": "434d1034-0e17-428e-939d-23995e7a931e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187355, "uuid": "99f03754-8867-4aa9-9b41-ebe1f91627cd", "value": "07577dc1201c2fe06eeec2090a3169fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e67a08-ea56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683189209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189209, "uuid": "869d4045-8a53-4587-8dff-ca35e58b0bdb", "comment": "Malware payload (AgentTesla)", "value": "48f7c90f9038debcfd1cc836118582af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189209, "uuid": "dccb29c7-3078-40e8-95a7-5063a9fd7f6b", "comment": "Malware payload (AgentTesla)", "value": "26ec84d86c07a621e86269544e8e4018d40bfe4c19a3ced4ee3749155bc4acc8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189209, "uuid": "112ad75a-5f46-4e67-80a9-ba66001a3568", "comment": "Malware payload (AgentTesla)", "value": "2d301b8c0305f44ad14d8ba4fddeda3ed30c791b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189209, "uuid": "c983f283-0f67-414b-b0a5-058a95f18e34", "comment": "Malware payload (AgentTesla)", "value": "f709668e39e86edeb96d387fe1f77140e222429e60b768c99c1c9c11731b52d931ad12cb274237c64b509f48df5c7d39", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189209, "uuid": "fd4ab021-6648-4c5a-9dc0-2aaceac250f8", "value": "T17BF49C169014C81FFE1AEB70C1A4FFE4A6F1FD73A4E5542223793989EAB9F011E8D119", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189209, "uuid": "6c83ead7-68a3-4437-bc06-b44e275829cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189209, "uuid": "ee5d912d-af0f-4d65-9fb7-539eff330ab0", "value": "12288:QOuKuTxnueUElRHvxsXxs2egQVtwOVYYc9NftxzyRdhHCM4vPkAAJ2rxs:4T3UElPshsDYYcHzzyFjSMBJ2ds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683189209, "uuid": "bacdc31c-38e1-414d-9a01-eca6ee00f618", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683189209, "uuid": "9af57d70-7528-45ec-aac0-b98854de449a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189209, "uuid": "13206a7c-eb38-4707-be25-3b8888beb930", "value": "No.13234290.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3be7b5cb-ea1a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683163391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163391, "uuid": "f41de016-2761-4282-a9f8-f66b4141b8a3", "comment": "Malware payload (RedLineStealer)", "value": "d22641ba4580a729127f2ddc9e47cc70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163391, "uuid": "e63f5b56-6264-42fb-8074-341a42b56482", "comment": "Malware payload (RedLineStealer)", "value": "27475c84e7e1c13f7f01d76f839caae12f366b72e1b47bbb82c551b1ef83134b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163391, "uuid": "edc868d2-ac74-44ff-8654-1dcd170a3e46", "comment": "Malware payload (RedLineStealer)", "value": "9f5b09b159c3fed2675472360d7f50b471e49e7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163391, "uuid": "2dbed003-d56c-437b-a795-a3d07676eeb1", "comment": "Malware payload (RedLineStealer)", "value": "f9b7531d908dbb6c66b3469bdeb84bda6fcbd1361e8798af33d67884262e8ca19c89ecc3f8581c43088052cff5b1aefe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163391, "uuid": "7f320ee5-c90c-461b-bee3-7cb38bf95715", "value": "T1D8452346FAD99232CA71133514FA17D31A35BC6006384BEF3B4E586B0EB25E4967273A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163391, "uuid": "a67ed3e2-1ce6-4085-ab06-933ab5ed759b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163391, "uuid": "0b3778d2-1aeb-4644-a44c-cca1b5f58f31", "value": "24576:+ydOmUaJFgViUxGTjQ9P0DAY1J/+pDW+4IPMZT:NdqavgViqijqDY9+4IPMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683163391, "uuid": "9bc4676c-d96a-4670-8af1-1a79cd0eff71", "value": 1265152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683163391, "uuid": "a3c7eb6c-2483-432e-a6b6-65d411fa23de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163391, "uuid": "3366a283-0635-4b1b-8e06-06ab964122e8", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ab7098-ea6d-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683198946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198946, "uuid": "df3e103c-bed2-4901-aa22-729887132162", "comment": "Malware payload", "value": "3e92b89b0eabf842425826a813ae15c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198946, "uuid": "efc80456-8375-4dfb-98ca-7d0d1aba2be6", "comment": "Malware payload", "value": "27f54019a83ebcd74148fc566bb063841caaf2b43ad5061b68cc2d027505ce14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198946, "uuid": "c3764363-686b-4b6d-9796-f50f60c212f2", "comment": "Malware payload", "value": "260e2498ca077a8c35fff39498d5cf76cfb455fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198946, "uuid": "89354f3f-b5db-4b65-882e-964fc8ecf91a", "comment": "Malware payload", "value": "85ea6746e3720b29aadf8ea0eb064efc70239252116398b290f99d2a3e38c9c305b18e82d680e5a29a848a755a3df538", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198946, "uuid": "ce860d71-6d64-4070-b741-8c3a3e395519", "value": "T162E5E13316E7FFD5E3AA5ABCF45612150DA0A8E7522CE2487CC820EF55AD7109E09DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198946, "uuid": "956b0be2-be82-46a1-be61-6dc7bbf88cfe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198946, "uuid": "6f849289-00fb-4880-8186-537b22427c42", "value": "49152:FNFru+MiNPNBEdi8aMiKqsJKo1uUvwwiAKwLwOY4yiH02VMOHt:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683198946, "uuid": "6fce54f1-5182-4537-8c23-bb62e60020b9", "value": 3052032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683198946, "uuid": "49bd2954-98f7-4ad7-8e78-d0ab23a10ee2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198946, "uuid": "548010c7-abeb-45b3-aa81-0658d3d13881", "value": "27f54019a83ebcd74148fc566bb063841caaf2b43ad5061b68cc2d027505ce14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464be567-ea4a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683184024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184024, "uuid": "eb878588-da51-4429-b9b8-24df871d3113", "comment": "Malware payload (Mirai)", "value": "1cb6de6ba5f190269e1cb9513d251511", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184024, "uuid": "18c58435-3dc4-45e0-9aee-bf2b7a4d2329", "comment": "Malware payload (Mirai)", "value": "28925fe9994044f10322e6d62d9f83f99ea8411d3ef55e52e3982b86334712eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184024, "uuid": "4f89c8c1-5ccc-40c2-887f-9920392abfd8", "comment": "Malware payload (Mirai)", "value": "55ab70de3a0a4dcbd9da40b4cec025f3843c22b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184024, "uuid": "7ef2c6bf-7670-47b5-8eca-903d63e5a86e", "comment": "Malware payload (Mirai)", "value": "f680bde0321421062d5f4717656e119357696964bd009e05eab2ac256a2f3ff7ce6ac21c549702187bf03037fbefb053", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184024, "uuid": "948a404b-52b4-4870-b937-6ff07545f996", "value": "T11FC329C3A540C5B3D00209F222ABA7454632EFBB599BA9E2F71D3CB49F305466276FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184024, "uuid": "b31a2cbe-46df-451c-b4b1-7b9967c026c3", "value": "3072:zzPwUKUBV9+4fVTNv5j8setJ8au49QuTsqLKBhMvVtXBtcZkG7gyqc:IBo1N551etJ8au4lhc0tXBtcZn7gyqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683184024, "uuid": "9f5f2376-0b3f-41ff-a923-d0eaaf99f6ec", "value": 119134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683184024, "uuid": "d6eba538-f3f1-4b6e-aea1-4cd7e40791e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184024, "uuid": "65675b9c-533e-44dc-8f4e-fe35f092a501", "value": "1cb6de6ba5f190269e1cb9513d251511", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476e4b47-ea74-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683202065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202065, "uuid": "707f3115-1cab-4d44-8643-e0ad4e112bc6", "comment": "Malware payload", "value": "4771a36abd205ca8ab3c6bc4fdcfdaa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202065, "uuid": "b6b6cd47-cc1c-4d70-9966-1a386726958f", "comment": "Malware payload", "value": "29197567d12d2832ce5639aaeaaa9e154a115a3586221ea61c2248fb39821bbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202065, "uuid": "fb28534d-a66a-44b9-a039-41c504d16063", "comment": "Malware payload", "value": "b995bc22b1dd4c7079316f5f6c24e77582178854", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202065, "uuid": "8715e32b-b5e9-40df-ae50-96bca948edd1", "comment": "Malware payload", "value": "a94725b4dd4d529c47dc317170b8bd37a662e04cf0e9ca517c35313a414d2cb2e21c73452d4ee7d99c9271d9fb75a1e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202065, "uuid": "785bcbba-5d2d-44fc-89b4-f6cdc1438e86", "value": "T1432439DC50EE884AFDB6BCF89EF86598866311588E75CAF108E4D491E8B40D1FCCD85B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202065, "uuid": "5996c7bd-7c62-44c8-afbf-9bda9492fef9", "value": "071307373db47402e881a4d65e0a19ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202065, "uuid": "5ef2ab03-526a-4d7c-8b1b-623799113f8b", "value": "3072:8O57HZCTXe8wCDEKpKU26mMuL1w/j/kDmxqnIWVQBvm+Wkms5ZloZB7ltfuc5Zaa:84Yq12KmfJg8xMs1Y7lhnnYONOnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683202065, "uuid": "ad97fe90-aa35-494b-aaea-045a157409cd", "value": 227168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683202065, "uuid": "34e00dd2-54a9-46be-b80a-f24c39c8951f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202065, "uuid": "835a388f-5bde-424c-9db4-2f9a9849d0b3", "value": "29197567d12d2832ce5639aaeaaa9e154a115a3586221ea61c2248fb39821bbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a7634de-ea6e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683199574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199574, "uuid": "f3ff9c7d-7ae6-470a-bba5-b13e58ec1cfc", "comment": "Malware payload (AsyncRAT)", "value": "12211d33ac7dffff7ee8ad4bb1201e97", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199574, "uuid": "9df27a42-71ba-4747-906c-2ded13968b30", "comment": "Malware payload (AsyncRAT)", "value": "296389b0339e15e62f5790d00ed58c9da8dd7ed8d8ac817667295e5306db30da", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199574, "uuid": "09b73003-62ad-4f9e-8dfb-b705b65d3e2e", "comment": "Malware payload (AsyncRAT)", "value": "6f38d8c1575a48761dc0dc9ba10c3f42ed6cecd9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199574, "uuid": "d67e1096-8c39-46bc-a3d0-452aa01b8f79", "comment": "Malware payload (AsyncRAT)", "value": "202c29aacbb3c4eda09b6bd133a8c0bd9a82cd0fb7002834d98baddd5e3f7f093a7ab937dde396692351da03523a887d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199574, "uuid": "0459891e-55e6-4b1c-a4c3-0c9674071960", "value": "T14434DCA6ED93D193312A8BBC4B9B8053E32550F82C011E9EF51D14DA83F7FD5236A678", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199574, "uuid": "9712cfa0-7dd2-4529-8b37-2fc0b5806ad3", "value": "6144:IOaqqG2nmEmRMFMik8HF9MeKJpHUjMFzlPmvpaZBYXkqjoDWFo7OqxmWXeXSdu9D:SYdvTaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683199574, "uuid": "16b1d136-6659-4359-860c-aff138a461ae", "value": 235872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683199574, "uuid": "d8ebf3d7-3d13-4439-b649-0b61c1bc1d7a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199574, "uuid": "79469c44-8faa-4fb5-b06a-aff03d625d7c", "value": "C.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0b5051-ea50-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683186560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186560, "uuid": "66d8ebc2-10f0-44c2-96fc-59daa638e862", "comment": "Malware payload (Gafgyt)", "value": "2c7f1b2d1f6bdfcef4baeef5f5e60efc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186560, "uuid": "584c28e1-23e5-4ca5-b086-62e5b8dab64f", "comment": "Malware payload (Gafgyt)", "value": "2a2bc3abee927a0ad7918a37874fbc850c04362da9970dd34c0f807e1eca2f17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186560, "uuid": "206f1968-c7e0-43d1-bd49-c8ee35a720f7", "comment": "Malware payload (Gafgyt)", "value": "6c74a94bbfe69aaa8ee7968d54d271ee2d93ad5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186560, "uuid": "c8441516-0831-4098-82db-5d7ffcec07fa", "comment": "Malware payload (Gafgyt)", "value": "c693bebe8b4ee22e06b0aa0d939de8bef017bd468d253f9a35d4aad84d603873ae1b4866e7a40d91759264fb7ae09796", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186560, "uuid": "6f13f14e-c61f-4f07-9c37-5532f9ac7900", "value": "T1FC03E13185419223C7B49B76E4BC430372DE5BB6E0EF30E6D30469ACF3D3799296994A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186560, "uuid": "b96768c0-27c6-4357-8f11-f0a5c5466d52", "value": "768:BPQlBsm8kqZYNaJSj7sCXJbYj/O6+eFbuszKbR7s3UozYu15tiFgdod3p:B+scB5j7sU0DNx5us0RmzYuXia63p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683186560, "uuid": "2e1700d8-24d2-494a-be20-fcd07fdf065e", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683186560, "uuid": "2e457a73-28d5-4b73-8fea-e2dad3cea3f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186560, "uuid": "a58a0360-f23c-4ec9-9cc7-bd6fa15871cc", "value": "2c7f1b2d1f6bdfcef4baeef5f5e60efc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7c1849-ea64-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683195334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195334, "uuid": "d037d998-e70e-4cd6-b393-4088d87ece04", "comment": "Malware payload (RedLineStealer)", "value": "70d6a81499c8a61fc1868bb5dd822cf8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195334, "uuid": "7c40add7-78cc-46e3-b7ce-0a385f0e8774", "comment": "Malware payload (RedLineStealer)", "value": "2b5c69b4bf95d349cf4e7b209f063222159f45aea240a47df2fcb1d0ca97647f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195334, "uuid": "d17773a1-7f74-47b5-a11b-f9432e988212", "comment": "Malware payload (RedLineStealer)", "value": "908eb6cbd2d8d8faee321562c2ed17e78e7c0a5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195334, "uuid": "62bbada0-3f61-4991-bdbb-ccbb04625389", "comment": "Malware payload (RedLineStealer)", "value": "f6becc1f3eab9f39f96830e2b84d1ba9eadda9dd07a3ce092ebd4134274f9685c3014a33dcc37ed7b68025bef395eafb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195334, "uuid": "b565db56-bf6c-476a-a7f1-c364eab028dc", "value": "T12EF412029AC85072EDB467B138F506C30E36BEE55E7C935B378A9C1E1C31981E57636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195334, "uuid": "bccb15fb-2a33-43af-b178-05fc22b6a7e6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195334, "uuid": "c7e983f1-db0a-4b43-b05f-39dddc6fae5d", "value": "12288:/Mroy90s5jbj4OGWsV/z8K5lYFJ3OFLirhkXncRe/mzHDbxy:vyTbj4OG3tzl5MOFLqyXnaHvxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683195334, "uuid": "e34eff14-5916-4644-9dd1-620b778ceac7", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683195334, "uuid": "173a421a-7e97-405d-9b38-f62a2c58adc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195334, "uuid": "7f56fd4d-2d9e-475a-a689-68c79b24a025", "value": "70d6a81499c8a61fc1868bb5dd822cf8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9fd975b-ea9a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683218551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683218551, "uuid": "5329f4c6-29ce-4793-b90f-75890be1b8b0", "comment": "Malware payload (AgentTesla)", "value": "e191e6210a41dd769249706f63544aba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683218551, "uuid": "52235e34-35b4-4dbd-ae11-9675be3a6360", "comment": "Malware payload (AgentTesla)", "value": "2d6c9ac070f5bb55d66de498da4a8c26d377eb79d7917d03af6d3608e350ac08", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683218551, "uuid": "530fd4d6-e65f-4c48-9dbc-144719de5dc3", "comment": "Malware payload (AgentTesla)", "value": "5f7d1ba46f42fb599b8aff89f38aaade2ffcc949", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683218551, "uuid": "dd639808-5de4-4ffd-936a-a3758298de3b", "comment": "Malware payload (AgentTesla)", "value": "812a04db0c2e4a208e7c5f2f5f9b673da64227eae391cd7532ffeb87e73764b7f89183f8cb148a05259f23854caa39ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683218551, "uuid": "ab69efb8-8a0a-487f-996a-cca667806248", "value": "T1DEF4E12523B97B91ECF6C3F87608A401AFB43D6153B6E6E84CCAE0CD5554B08B750BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683218551, "uuid": "c73721e9-2399-4041-84a7-9af82f2b0c0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683218551, "uuid": "5381f04d-4915-40b1-8317-54f5a3616f09", "value": "12288:V011K8fRe3Nz9miqDpO00Klrb6nLzHXcXizan35LkEScpMgCoKqQUP5Vf:WPK8pe9/kay/6nLzc/bScmqtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683218551, "uuid": "99887725-851d-4aa8-8e9a-0925e7347814", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683218551, "uuid": "0e4576f2-282f-49ef-9fdb-773787b8161e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683218551, "uuid": "4145ecfe-98cc-47aa-84e9-53f1194f6927", "value": "SecuriteInfo.com.Win32.TrojanX-gen.27571.1923", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc65bb7a-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683194154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194154, "uuid": "2b91d3c1-e133-4aa7-b8f0-a2dab15f64dc", "comment": "Malware payload (RedLineStealer)", "value": "19df906dcc6832150ea885afe1b37066", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194154, "uuid": "68002f19-2037-43e8-928f-1ab30c372044", "comment": "Malware payload (RedLineStealer)", "value": "2da30d32c89579b2f31dd1de4c0ea0df0a446feef8a69af55334515369d0263c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194154, "uuid": "985b1f02-588a-429b-b81c-5cd671447af2", "comment": "Malware payload (RedLineStealer)", "value": "a20000afc543feed9361567c347594e9c7e8b085", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194154, "uuid": "d153b1c2-c31b-4749-b555-39e5550577d6", "comment": "Malware payload (RedLineStealer)", "value": "108c85fcdbc8526efd5c7b008032373b0c9494427fa651688ecf5b5cd03da50f55e5bd11d57c15d461ab022daadc8f3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194154, "uuid": "e78b3cda-a773-4c58-b61f-a1fda50dad4d", "value": "T1B455F14079D2C472C5B3253206E6EB76497EB8300B665AEF67941F6E4F303C1AB32966", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194154, "uuid": "19a3431d-2e9d-497e-9928-f3e825d9f4d4", "value": "a474be77234ae202002ad60047ac23ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194154, "uuid": "f6d0796e-b650-4e0c-bbb2-c77cac0c714f", "value": "12288:2s9fXUfFIWfTC0xzIBo4swnD9fvtvYSgry:2soF1nxzIV1vt7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194154, "uuid": "4222dd1d-656b-4afe-b83f-a8ce55445c21", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194154, "uuid": "2c4fff8d-d93e-49c0-ad14-32fc25e80e0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194154, "uuid": "b29b2a45-b50b-43c3-bcf0-6bcfaf9693e2", "value": "SecuriteInfo.com.Variant.Zusy.465956.29298.4898", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3703728-ea81-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683207830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683207830, "uuid": "54cb1de2-b361-46e2-8537-b4e3a5b60d5a", "comment": "Malware payload", "value": "a166c0a269f3883d10de0d9167a71f13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683207830, "uuid": "950667b1-0ce8-40f2-a2e1-e3a78e09485f", "comment": "Malware payload", "value": "2da80c7c23bcc560350ada7ee87788e07f1c8a5c7976a118d82b737748814db7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683207830, "uuid": "aff06574-ac21-48e3-8c22-537014ef6ff6", "comment": "Malware payload", "value": "7f2a24eaced6043dd710e93e3328d4c834dbca45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683207830, "uuid": "9151ad94-afd5-43ea-a9f7-0ae45b2f7e6c", "comment": "Malware payload", "value": "6b3e5ac7be9e09c2256653b911277344c88ec5126e4e8c7a9e8dcefdcb8b431af786b21216d48743deae5a65cda9d533", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683207830, "uuid": "8be195ef-918c-4eea-88fc-541a813f6486", "value": "T1CEE4F1052B61CC13E381527A516AE73D9B756EA43C0ACF1237F87DDB7D14B2A282D293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683207830, "uuid": "85ec4755-3ccf-4f33-9b2d-5c7cf6bb563f", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683207830, "uuid": "27f7ae09-05ea-44f0-9660-f28fb6fe01d5", "value": "12288:PVNvjB1YWvhDYr/rrn/olzhJ8evF3Vp8Vaa7vNQCQQcHvt:PVNv11JMrTWFJ8edn+NzNvQQcPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683207830, "uuid": "2c6807b2-92f4-4b28-ad46-853d521d832e", "value": 662321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683207830, "uuid": "a935cbdb-ea76-4cfd-be70-fee4d702d79c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683207830, "uuid": "cc6b1f77-5ad4-4b86-bcb1-2a511803c4ba", "value": "2da80c7c23bcc560350ada7ee87788e07f1c8a5c7976a118d82b737748814db7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daacb8ed-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683194151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194151, "uuid": "6ecf523f-b8e5-493d-b0b3-f11df0ab3da4", "comment": "Malware payload", "value": "23bf2b51d10ac130d73a4c2ae1cf2031", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194151, "uuid": "0024d524-a75f-4d14-a072-b3c1d1e9d224", "comment": "Malware payload", "value": "2dc8944f9f502c69ecf03f97f5d0cab24e5cf40d680c846008eefaa59385db24", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194151, "uuid": "5c5db1a4-fc1f-4b02-8b7d-8b02befd3dfe", "comment": "Malware payload", "value": "03111f4e9855d71a7da7b07c93fc83e4c86917e5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194151, "uuid": "65748c92-3f69-4461-aa64-1962b66f794f", "comment": "Malware payload", "value": "db32a797670dc9734991acea960656c7b6dc2bd97e48d1c02fcea2ff707e4aa8bbfb330a7a24b19feb2d74cf41001eb4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194151, "uuid": "e93cfaaa-b1d9-4d49-8b9a-6fcd88aaee01", "value": "T174E28A49AE717FBFEC2ECD3301E94646219D561A51982F272E71C528F68B04F49E3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194151, "uuid": "5d323017-e7a1-4016-a934-0af447a82be2", "value": "384:4L1vThpeKUregTblfke5sfzU9wv8e5OZ1Fzl3422FXiF3lSefmpoL:K1rhpYkeSmwv8e5u3DCXillSefm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194151, "uuid": "d6df0e67-0a28-459d-bc51-552cec9cfc48", "value": 31704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194151, "uuid": "f9cc530f-a5ee-4453-b88e-e8e5eef3d537", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194151, "uuid": "57ec09f1-a7c1-45e2-9df9-98c8efc041d3", "value": "SecuriteInfo.com.ELF.Mirai-CDA.23801.25211", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c65a79-ea8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683212580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683212580, "uuid": "63b3ec32-91bf-4ea2-b814-c9e83af7b566", "comment": "Malware payload (Mirai)", "value": "3e5c14196bb4a4cd24db0fee57e7e629", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683212580, "uuid": "8f45b146-a536-42e8-bfda-2d4b25b7bf27", "comment": "Malware payload (Mirai)", "value": "2f2ee989420fe531eaf67b6ff1f449b05e8254a77119f4f97d0b16b1511278da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683212580, "uuid": "c05c7a7c-83d0-4e03-94f8-bc006024662b", "comment": "Malware payload (Mirai)", "value": "81faf8946a4fe3b3eaca7ed5a1120e2ebc4fa5ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683212580, "uuid": "7256cfa2-905f-49eb-97ac-bca8803dd388", "comment": "Malware payload (Mirai)", "value": "2af081a718398f55ad8520e4230909f6a7727c2136375bef55e73656a027c6583543e0f085d3968542ebd71f69d6c64a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683212580, "uuid": "34af069d-bdda-40e8-9276-028368205838", "value": "T145F2F223E3DD0484CAF44D73F1FE51E60B955338A5D87858A6E482A8F4DC007A3E9DAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683212580, "uuid": "aa42b91e-2985-4514-a78d-499adef51d56", "value": "768:TUkSE+3tLdM+XAfNND46W8p5fIMUy+B6XFY3UXu:fSE+da+Xul3p5AIPXju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683212580, "uuid": "a1861cdd-6f85-4f06-ac2d-5837cf191d24", "value": 35184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683212580, "uuid": "29f2e369-b073-4bdd-99fb-cafe1109fbfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683212580, "uuid": "26fa0ea8-eb5a-4849-afe4-db637be9da90", "value": "3e5c14196bb4a4cd24db0fee57e7e629", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa0a51e-ea55-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683188944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188944, "uuid": "481ab700-d2bf-4f5b-b15d-3475ecc600d0", "comment": "Malware payload (Mirai)", "value": "a642ec5665b273cc2d0b70464cd56f84", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188944, "uuid": "1a36a474-f90f-41c7-bb9b-74127a5a074f", "comment": "Malware payload (Mirai)", "value": "2f4a5106c951562d4b3b71951be0a52b6501088f41b7b19d7ede04da29ac455d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188944, "uuid": "08655eff-7433-4f63-92cb-86d55fdef616", "comment": "Malware payload (Mirai)", "value": "2b27bce90b48d1cff80008ae51269ad6b53b561b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188944, "uuid": "7934864a-ca43-4073-b6fc-9c4528e66dbd", "comment": "Malware payload (Mirai)", "value": "829ecf08dfcb5db5b27908171fc93f9b31740698e867e9044369271ce04d86310692b4c90a520cd459fb8887abf20c6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188944, "uuid": "6cfe2592-a5a8-4667-bd99-8fad28b11a9c", "value": "T1B0933B41F9418B17C2C327BAFBDF439D37366A5897D7330169297EB42BC67891E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188944, "uuid": "c459ba7e-6da5-4f75-b3eb-043f4ff06214", "value": "1536:HzDBmIByJZIlhOPx5O8vQTsGYP+CvLUOStVNXLqZ1mkgmQAE+dAXDfj:H1BSZPjQkBLUO2WLmkgmQAEUAXDfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683188944, "uuid": "38d38653-fb45-4787-85fb-b8f90f58c56c", "value": 91819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683188944, "uuid": "6a54158e-9bb9-4095-8215-5d21d5c36fbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188944, "uuid": "d4847aaa-85ae-45ba-be1f-871a61458db9", "value": "a642ec5665b273cc2d0b70464cd56f84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815983bb-ea49-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683183694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183694, "uuid": "e1860e48-2f9f-49fe-a69a-6127be935b29", "comment": "Malware payload (AgentTesla)", "value": "d640c53222fc4bb304374678480327e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183694, "uuid": "c5247822-9099-40cd-8c1f-e741ff8fb848", "comment": "Malware payload (AgentTesla)", "value": "2ff3aef2c170c0ef95cdd998d12e517f9f3f0b4197f0277c80da34d1ce8a5ca3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183694, "uuid": "6d8cb6af-7fc7-43cb-8137-0f1fd222aa72", "comment": "Malware payload (AgentTesla)", "value": "8bf35ef9bb12cd72384ca024634d21b0b4809c83", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183694, "uuid": "bceef735-ef80-4107-9263-c63a22b27799", "comment": "Malware payload (AgentTesla)", "value": "26524f45d8cbd293f7300e210ccb1dcaf8d1189c415ddbb0fc94423b5d61ed5556515ec8647b8a5da37f84978cf1db97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183694, "uuid": "e1f5a9ee-79ae-4294-ae64-bd5f04e60ea4", "value": "T1EC513B7727DF4ED7F09D44731078C0A676CC60260A0EC366DA074846BC0DF629999B57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183694, "uuid": "2a4aba20-11a0-44db-923b-6306b67092cc", "value": "48:9UUpXu1AF1IUIpy3qYHRnzKyqOab+luHEMLmeiJgWVfQBvAQ/nrm6fn:J9QgBm2RzLIEJ1fk4Q/n7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683183694, "uuid": "14c58a8c-db65-4921-9b92-52f8833f21a4", "value": 2861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683183694, "uuid": "c1ca0b35-69c6-468c-8ec1-96602df8c5ac", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183694, "uuid": "cef93185-5c3d-40de-977a-2fde0027e531", "value": "CITA_doc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac80dde-eacf-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683241208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683241208, "uuid": "61cd5d11-1b41-45a9-a941-a9e670b1ad6c", "comment": "Malware payload", "value": "d09d543261568edf94672d89fec9a3bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683241208, "uuid": "3b10803e-8344-45b9-a21d-1065215359fb", "comment": "Malware payload", "value": "3021ea547621fadca735ad51c3b6f2c9ed4c04673f07978480531646413aa982", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683241208, "uuid": "07334f2b-e79d-4a68-b1d1-4f01a3052b58", "comment": "Malware payload", "value": "120f859706c5c985b32c080ec874b511c9c7e85d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683241208, "uuid": "a6ad0710-7eb9-4b06-a707-ac4eb2d585a7", "comment": "Malware payload", "value": "e95b422cac8e2f4e419d2fa0bdd74a3cd74d2000e6584d59a9ede2842a4e2ec37d6c927ac9e7a0f353a05c05aab16bf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683241208, "uuid": "c86e5df7-29e7-4560-8aa4-d70a94dfe239", "value": "T1F2E4BE8D3184F080C57D71B1F86AE6FA252D7D9AEE74D21739F63F4BB9B001824506BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683241208, "uuid": "e80db885-2ebc-4fcf-8c07-b48a76054109", "value": "12288:4NzwXZrbqQUoCNLmZolVMHKiiVGnU45W1C:QzwpaQUoCNLUolVMbiVENW1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683241208, "uuid": "8696b643-36bc-4c55-ba9b-82ff68388adb", "value": 661360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683241208, "uuid": "b19c26d6-a4c4-440d-94d6-9fce405e0d27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683241208, "uuid": "18bf831f-4ce3-4aac-8eb2-6d4fc44ccbdc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d6df6d5-ea76-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683202853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202853, "uuid": "1a984782-154b-4694-9ff7-4fc7e2ce517b", "comment": "Malware payload (Amadey)", "value": "ea1bb0fcdc2bf8b2052834f86bd0310e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202853, "uuid": "dba6a330-da93-4547-871a-73d887f8a849", "comment": "Malware payload (Amadey)", "value": "307ff5f51c2349fd918ffd7073c11235ad26a5038f6d812082db62e405f1380e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202853, "uuid": "73227d55-88a2-4905-9366-65e5919c6126", "comment": "Malware payload (Amadey)", "value": "7a6f1839f93f69d3d7e34e2f8cd737e0d4884d19", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202853, "uuid": "7a64bdab-36dd-4819-937f-001ecb30bbaa", "comment": "Malware payload (Amadey)", "value": "32ddef8d36be97f6dacfe9489bb7b0b560fd55c70b10394aad731aaf10b1e6e2be90bd1b1d007abd56a17682cac26e43", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202853, "uuid": "c62dfa5f-6513-45ef-9dfa-874e82207efa", "value": "T119752312EAC484B7C8B40B7028F507D72D32BC638C3887A17751955A56F2FDAA9B172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202853, "uuid": "0f351ddb-42aa-46ed-84a4-451fbf9e3a6d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202853, "uuid": "7e5d2399-ee62-4a5e-8b21-28075a09122b", "value": "49152:XZLVwZqsq1TI4itS+StWWkJeSeZ6cD5rb:VCO6ZtS+SkeSIndP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683202853, "uuid": "94cb0c94-f1a0-43ad-97d2-c2f5edcf3a34", "value": 1612288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683202853, "uuid": "6961afc3-61c0-4ca4-8654-ead4e5fb57f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202853, "uuid": "1a566507-30dc-4c2b-b0d4-2e5ef58f40a7", "value": "ea1bb0fcdc2bf8b2052834f86bd0310e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2905100f-ea57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683189558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189558, "uuid": "b6aa3d78-cb98-4ff3-ac6a-c078726b3b29", "comment": "Malware payload (Mirai)", "value": "a1844121f014ac424c63c3963c0e36d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189558, "uuid": "2c4ae127-d07b-4506-95ce-3d229e2567db", "comment": "Malware payload (Mirai)", "value": "30d868ddc96cb2adf863dba459ee8f40c4384d4edbf7ea43000f284f1164b653", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189558, "uuid": "cad4f39e-b0a1-42cd-ae6e-86f0e8007a14", "comment": "Malware payload (Mirai)", "value": "2c69020557e7d1dbd179efec9cb25a170ec7f692", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189558, "uuid": "fe481579-d060-4189-ae74-03b05882fe03", "comment": "Malware payload (Mirai)", "value": "a51e4befa39a760eb696f0283838243a3de2654bc1927d8e2d3fd475195d7e4d6113b171cf4943e30787eb3962a6cb90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189558, "uuid": "7d712121-b01b-4bcd-972e-1e623954e558", "value": "T189F2E071F9222171E2D09974211E4E8536D45CBC807FBC20B0AA2A8CBD62E565A3EFC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189558, "uuid": "8dfa25b9-d083-4c3f-b861-5155403ee778", "value": "768:qu9YDJSsqL8dTvlz+kZaJftXp/KJxrKu+lmLSZMA9q3UELCU:qu9CgsqL8dTlqk41tXp/K/5+sLlL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683189558, "uuid": "9e947e24-92f3-44a0-9cb1-b6bfc667b2fc", "value": 34500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683189558, "uuid": "6ef05071-c31b-41c5-a76d-6b590c74ffba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189558, "uuid": "024468cb-d2ab-4c67-bdb9-82715a5b22e2", "value": "a1844121f014ac424c63c3963c0e36d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ec8e12-eab6-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683230436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683230436, "uuid": "132b98ea-c626-4766-a1c9-f816520d8567", "comment": "Malware payload (Amadey)", "value": "fd988308edb84485e42f0e97670ef724", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683230436, "uuid": "54265436-952e-4300-a625-3850076efff1", "comment": "Malware payload (Amadey)", "value": "318ffcd348285d68b7a958dd80a30587ac4a0fe204b8808864256d8ce05d6925", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683230436, "uuid": "5fdb6604-1772-4673-a084-0dfe7bd5690a", "comment": "Malware payload (Amadey)", "value": "cea9056fea10505b6c4817072f03255567171e1a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683230436, "uuid": "ed9a2978-bbb7-438d-a145-5ac3355c2a19", "comment": "Malware payload (Amadey)", "value": "a42a05c886eb0fee47507bafb8dadb220467c60a58be9c66bcd3217dbbb95045aa76e3d1800bdac7cfff9a0080d43bc2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683230436, "uuid": "ad0a10a4-752d-4b47-a250-caaa3d55cd3a", "value": "T1DD84F152E6E89073D8B517B058F706C30E36BCA15D7893AF2785A94B0D736C4B97232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683230436, "uuid": "d2a4f002-e4f7-4535-9fdd-4db2fc888b3d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683230436, "uuid": "96426fdd-8365-4877-9179-14c54ba2eee1", "value": "6144:K9y+bnr+Cp0yN90QEtVddK1kFR83tdJDG4G6hMB9e4Ppel7xqF8xvE5Y:7Mruy90VdsqDK2n9eXl7xy8pz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683230436, "uuid": "79a8f52c-739c-4f6f-b4fd-4d333de57681", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683230436, "uuid": "f992e477-29fa-4e4c-826a-0be8c5fbf25d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683230436, "uuid": "5c1c3550-ca2b-46c4-aa93-21e150e32cc5", "value": "fd988308edb84485e42f0e97670ef724.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9fbfaf-ea7e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683206291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206291, "uuid": "7fe4cc72-9097-4b61-a553-0c44a1ad691f", "comment": "Malware payload (AgentTesla)", "value": "c071c51fe156b750d0ab834fe244b211", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206291, "uuid": "90929e74-e44e-49be-ab93-1a215d9af81f", "comment": "Malware payload (AgentTesla)", "value": "31aa9a1b8971563f88b86da4d28fb79eb8bf88e43d0c3aedd9592837b4b602b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206291, "uuid": "030f5b76-68b2-45af-8c15-f593ece28b46", "comment": "Malware payload (AgentTesla)", "value": "317a4b869a6a92190fd77ff54e7fc286c621bcb5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206291, "uuid": "7cda9821-d2a0-4895-a749-c3afe061ee7e", "comment": "Malware payload (AgentTesla)", "value": "44745a08c2c4f153eeb316343f7fa4eed5acbb12afeacc897cac009099903397b07e8657d6eadc8443474b0ca40d3b53", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206291, "uuid": "bd7b89d1-a82b-4678-a02b-f1c0ad6fd94d", "value": "T1B3F31A6C52CA8AD1D32FC179C4A1101806F2A1B78657E79D0EAD98FABF467C3322FC55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206291, "uuid": "22b09d69-97fd-4ac3-904e-78fc9c597db4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206291, "uuid": "bb40d09c-83af-4662-8726-c74b995c2bd5", "value": "3072:1uy+MDhspZp26VS/53zYGDazIIBef5995wvakia1i6hlpNp:22/5cGDaMPf59Yvb79hHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683206291, "uuid": "8695ec9a-cbae-41b6-86a1-bc9558159fe0", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683206291, "uuid": "276af2e4-3f2b-472d-be9b-a4d39f626664", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206291, "uuid": "840531ae-8254-49e9-87b4-8931c5e80935", "value": "31aa9a1b8971563f88b86da4d28fb79eb8bf88e43d0c3aedd9592837b4b602b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2948c005-ea2f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683172379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683172379, "uuid": "91ccdd3a-1be2-4a42-a3b3-4103b771ff0a", "comment": "Malware payload (AgentTesla)", "value": "f51ba77ad7935cf732fc2fc5df33d75b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683172379, "uuid": "4b903ca0-d2e1-48cb-a2ca-931d60407cc7", "comment": "Malware payload (AgentTesla)", "value": "321c6fa6f024e57efa93d5e203fb0c87a05918e4513d0a501899fd865cae0f44", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683172379, "uuid": "3d3aee43-5ca8-4fb8-ad91-43409675652e", "comment": "Malware payload (AgentTesla)", "value": "a8799a8508302fde8d545c8edd98a34c4e08d7c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683172379, "uuid": "4f63ed47-fc38-4790-9c3c-4287bfc4ab64", "comment": "Malware payload (AgentTesla)", "value": "ec912d9902d1572768f653c422df1f2cf18a9d56ecb836ec0ac8cbc22a281a3272a63c620961af2c705aeea20458879e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683172379, "uuid": "9760147b-1292-45d7-b9dc-60bdb7ddef8f", "value": "T194B2F45A5B8C4C62E366E87B465DE00E18BCF23A31C211D5BD9DD2753B3E50E0B6B1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683172379, "uuid": "e6f44038-5290-4f71-a8ee-fd5b9fc5a69a", "value": "384:IbXKNS2/UgUPy7xAZwfYFejDjtQV8LIa41Brpa5VnBZJ0efUneEnPPcpvx8oD0qH:IbXKNnUgv7xAZwDDjtQSLIa41Br85Vic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683172379, "uuid": "2588461d-7e37-4ca7-92c1-4cc82abdd6c3", "value": 23768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683172379, "uuid": "3aa3d938-cf2c-415c-b7de-91ffad58d77f", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683172379, "uuid": "f6d1fe9e-518e-4332-b57b-f8b4012a2eac", "value": "f51ba77ad7935cf732fc2fc5df33d75b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c731a8d-ea57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683189564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189564, "uuid": "05e48a56-73f0-4db7-93a8-f0af41f2b218", "comment": "Malware payload (Mirai)", "value": "241895894f02b808ad4ae074de29c043", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189564, "uuid": "890e3602-7d15-4bb4-b425-92664ed65069", "comment": "Malware payload (Mirai)", "value": "32c0bcd9d66c98dddcdb08ebdf3f76f76674af6f22e035e96a9e198aacd88922", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189564, "uuid": "3f58deeb-97a4-404f-ac11-9a4a64c74136", "comment": "Malware payload (Mirai)", "value": "64d297d18ea14006b008473e20c59ac3873a516a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189564, "uuid": "3d124404-b907-48a5-a5e3-4aaaacf7524e", "comment": "Malware payload (Mirai)", "value": "f626dfc263923c8bc49b4b5799075ab483ea37b4f135b8eead264df1e624776aaf43b8e3f01d489aa1ee0f014d79abb7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189564, "uuid": "cb1589a2-40aa-4a30-b780-df9b0011cccd", "value": "T1C2D2F1641B45C871DE90C63ADC7C8345631A5661D2FD33A22A500A1DE2C31D8EEBFDBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189564, "uuid": "9cbb1a36-9d92-4048-835d-53289258886d", "value": "768:gtFPMu43+Knj412MjX2YNoTdv0Wt4B1lkrIsH5ids3UozD:gD0uwqxkTN0l+rIssgzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683189564, "uuid": "b5f26610-6b93-4f6a-8530-829858452012", "value": 29968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683189564, "uuid": "d1a7b116-4a29-4dcc-869e-43d30814a00a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189564, "uuid": "60a3f7ab-4f00-4487-b0a4-cce6a366decf", "value": "241895894f02b808ad4ae074de29c043", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4492e08-ea6b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683198489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198489, "uuid": "aaf6115d-0b14-447b-8c05-e625f3c1a94a", "comment": "Malware payload (AgentTesla)", "value": "ca545aaaae6cbeb3f49bb62f712b6a1e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198489, "uuid": "bb917805-4874-4828-9274-fd6daec8e36f", "comment": "Malware payload (AgentTesla)", "value": "32cb45b7a29d11d5962d991558f0e216de55cf5882282b55c9a2bb625e01873a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198489, "uuid": "79befc9f-b32c-42a0-b757-c0398de8a6b5", "comment": "Malware payload (AgentTesla)", "value": "803e30eb1a53acbab0c63bdaf2873b34faa3ecfe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198489, "uuid": "3756d116-225b-4e19-9146-1e585e434860", "comment": "Malware payload (AgentTesla)", "value": "969ae18585674a59a117fe6df5e7692571dbc7fc9dac67bd9b5b785903438cb3b686b1d4ac712e627728849b97487080", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198489, "uuid": "f3d4c7c3-25e2-46e2-9ed7-84782fd2b270", "value": "T18CC47C3C29BA5627C176C3798BD19427F1609C5F3112EEA994D333BA4752B8239C327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198489, "uuid": "59ce04e2-cd34-4505-9509-0b4d7d653bdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198489, "uuid": "c6609827-9151-4226-adab-cf0aa09300da", "value": "12288:yD53A2KqnAovPHO1+O9QpiAMZfwsVA70tRz52GYvshOWI:0Qin6l92MNVA70tRz5eUhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683198489, "uuid": "73a847aa-ba37-4914-84de-453289d33e7b", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683198489, "uuid": "515a83f5-709a-4690-a066-5de07a7e537b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198489, "uuid": "5b4b444e-2ba8-48d2-ac7c-8d2301293706", "value": "Bank copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515115c4-ea84-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683208953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208953, "uuid": "f31b1f40-d6ac-4e8f-989b-53a325004685", "comment": "Malware payload (AsyncRAT)", "value": "40007c48c4a68c28353bc2263e46a8aa", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208953, "uuid": "e2b3b0da-c6e6-4761-8949-1ba8ee3933ab", "comment": "Malware payload (AsyncRAT)", "value": "33650cc18d2e03d1cdf58b578a3383ed130b31ed641047d3a84ac4da124bea11", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208953, "uuid": "bc33e785-8b0c-4d79-b4ae-192f36dc6d62", "comment": "Malware payload (AsyncRAT)", "value": "edc72a9967bda687d56ddfe0fddbca15d0c40035", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208953, "uuid": "782c3c54-94e5-455a-9774-586d32cc13e2", "comment": "Malware payload (AsyncRAT)", "value": "17099dd70eeb2909296d8fd8caf0700514ab415c9dfa073f97d77384622b37b59854c9be10b44ce094d611a6091839cc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208953, "uuid": "59b03352-34ff-4dce-b987-9fba29077718", "value": "T1B2351202BBC184B3D4721B3569676B21693DB5312BB99DCF57D44A2CEE316C0EB307A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208953, "uuid": "a52f6ee7-61b6-4678-841f-defe71990a05", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208953, "uuid": "161e4a52-d9ab-4958-8b1e-a1f7f4444072", "value": "24576:NTbBv5rUanOuF+8bQybXmmNxrndGryTBZPa:HBjbs8bQSXVdGoBZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683208953, "uuid": "a290f8aa-68cd-48fa-8ed1-70e626c573b7", "value": 1096476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683208953, "uuid": "d2dd5751-5c39-4cfe-b222-faa7ab055335", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208953, "uuid": "b119436a-1719-457a-8890-05ce5fa17a08", "value": "33650cc18d2e03d1cdf58b578a3383ed130b31ed641047d3a84ac4da124bea11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2117536f-ea8e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683213167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683213167, "uuid": "95448c6d-b55f-47d1-99f2-61c6c04ec1bf", "comment": "Malware payload (Mirai)", "value": "3b8de51c2f8f0d9fb3a1e125decf8b22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683213167, "uuid": "ff0f3fa9-46fe-4e51-918d-380160355c53", "comment": "Malware payload (Mirai)", "value": "33841886babfa86bc45411f4339a5242079bbd769e585c9424a705d19f1c6392", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683213167, "uuid": "a83d8fdf-ab1b-44e1-9754-49abf34b2494", "comment": "Malware payload (Mirai)", "value": "b7d72da0bee5bbd6fb3457111cccfb05a9cf3321", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683213167, "uuid": "afb1385b-239b-4e3d-bf06-aa41fda60ecd", "comment": "Malware payload (Mirai)", "value": "f4ba9f89cee1b5c4663d8728f594d3f6b565cc2a4c7d091b1dadde6460d63fb74e8ea0ca7f11f7b4b08eb71c8011d9bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683213167, "uuid": "022a75f5-b08d-45dd-ad95-a468acb7122d", "value": "T1F5E2F171978D4C16D1B41AF6C3ED40C6A64C2EBCA8EEF0A33BC91308D4D558A66F949F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683213167, "uuid": "142c8f53-93a0-492e-9156-3bfc50094ab6", "value": "768:CgEPAkn10/ngYlH7ZtC6LpC6z4ar9vA97I7SjH3U3r:CgEPhiNZMmY6car9o97TK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683213167, "uuid": "1331db5e-d2cd-4167-a2a5-31a42a2986c8", "value": 31280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683213167, "uuid": "a5dc2ff9-eec8-4969-980e-94dca61b66d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683213167, "uuid": "feb0a341-fbfa-433e-8f5a-4d01caaf3cb8", "value": "3b8de51c2f8f0d9fb3a1e125decf8b22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a6c726-ead7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683244549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683244549, "uuid": "51b46253-dbf8-4be5-b5db-26683c41efe8", "comment": "Malware payload (Amadey)", "value": "8b82dcd4258e70fe99cfc9017c97b67c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683244549, "uuid": "e542d33e-443d-474d-8d4d-a8d8d3218c60", "comment": "Malware payload (Amadey)", "value": "3393e925480732e15e616ae5df5755ebae98ed2b9b2ea58cdfab8b20132e4395", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683244549, "uuid": "f092b459-c46a-444c-bb05-f457521d9da8", "comment": "Malware payload (Amadey)", "value": "9b120a9cd65a9660cbea61782d0c9c7d180a3655", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683244549, "uuid": "af0d117c-d674-4462-8844-005dae2711d4", "comment": "Malware payload (Amadey)", "value": "d6c801efa17fa03e3a6dee86c1e40dd22f3a09c228f17913c0e3074c2558e56414194a43e4964e04d4ae8a19ef9477ba", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683244549, "uuid": "4b6e363f-7f50-474e-8ed2-f2f103c67b94", "value": "T13A84F146EBEC9172D9B507B409F603870B36BCA26D39426F3789686F1C72AC4E531367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683244549, "uuid": "80432ab2-642a-4986-b5ba-2de3b27d7aec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683244549, "uuid": "5f102b83-6977-4d94-9d3f-9aa825ef4856", "value": "6144:K1y+bnr+fp0yN90QE7X7zbfzy+zH0tWKiamOdP/N967qtAbB+S1Ma6Vc+:7Mrry90h7fu+gEKiAk7qtAbYqMDVc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683244549, "uuid": "1a5ddd10-12bd-49c5-a0e1-f8678fd3ec60", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683244549, "uuid": "5c3744d3-7f5f-4bdd-8746-f50e3f0dc09c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683244549, "uuid": "f6b6c9ee-5271-4a93-a828-06a834f5ec13", "value": "8b82dcd4258e70fe99cfc9017c97b67c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa81afb8-ea58-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683190205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190205, "uuid": "753851d4-7cca-47f1-a5a8-eca1a90ca7ef", "comment": "Malware payload (Mirai)", "value": "0c60a557fb3a57a77c3fb15178f47f43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190205, "uuid": "e9682ebc-9e85-4d9f-a9c8-51fa67e55165", "comment": "Malware payload (Mirai)", "value": "34350bd6a6d9dda7fcbbafa39a3b877bf028a474fc0c7fede4f71cd56c9b7c18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190205, "uuid": "a4f72891-ca68-4162-b386-1ae7f62ab259", "comment": "Malware payload (Mirai)", "value": "1e77cea183d38f59e87860e9c166937097feb9cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190205, "uuid": "9a45d88d-69a1-4f0f-bc9e-7deba3d42e3b", "comment": "Malware payload (Mirai)", "value": "4f9eafd4c9f4480b99fc89e3674e5d1e65d46f3c8d8e84c9b6bc71592db4ca78da13c8cad248cf729bfaacdb6309aa67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190205, "uuid": "001dedc8-4500-4fb7-a480-9e2abe673a2b", "value": "T186D3626B7A109F29F79C973005FB6D34834A23A72AD5DA4AD19FD6001E3231E5C0FAB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190205, "uuid": "afb105f6-cc75-47c5-9f3f-004278ec8cf8", "value": "3072:6gZqoNC7WgjQ1cLFK1ggrUQHWNpOORE+VYEKmbLD3oD4Fb1lPlTqzW4U3E:6goN+cLFK1ggrUZbbLD3osFb1lPlTqzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683190205, "uuid": "4b711bcc-c6f5-408a-9ca8-c13caa77138b", "value": 136756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683190205, "uuid": "00dfc8bc-e5d1-4d16-8375-8c93a2dfeea5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190205, "uuid": "ffda43cc-600f-4562-889c-39c25672baff", "value": "0c60a557fb3a57a77c3fb15178f47f43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f214ed2-ea4a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683184093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184093, "uuid": "fb06ccae-8405-444c-b278-274f4d294782", "comment": "Malware payload (Mirai)", "value": "8ca135323395bdb7b808d8b9c42c4d2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184093, "uuid": "c58ba8f6-72e9-433f-bb33-1cce636847ce", "comment": "Malware payload (Mirai)", "value": "344901619533991cee5f959730319ffa3b648f64cb6cd0d3868a33aad33c9ad6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184093, "uuid": "fb38f33c-e7cd-4c5d-b12b-dd834ccdcffb", "comment": "Malware payload (Mirai)", "value": "e85405d9644066cd9782b2b64f7dfd3b21576263", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184093, "uuid": "e7356ff9-0a01-40ce-a2a7-a71ae46271f2", "comment": "Malware payload (Mirai)", "value": "0968c058abbe9449db0e13c3fbc8cb719aef3f0f92da94d9ce9c6db2d91e7a3c7acaf7c216d28d70888ac2db8ae415cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184093, "uuid": "8c9ff596-dd49-41c1-95de-b9d1d4965a9a", "value": "T106E32B06F8004663C2D12BB7B39B038D7B265FA557D73352EA297DB02FE17491A3A9D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184093, "uuid": "a6e2c23f-a4f7-440a-94aa-eadb2d473eda", "value": "3072:pCAEL95L4khZvbsuRnmYG8ZetJ8au49QuhsRRyv9O/fXyGzQSQ5WOQVJW:YRm8ZetJ8au4lkRyvOfXyGzQSQwOQVJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683184093, "uuid": "2683f0f0-98f7-4888-84e3-7bcf07916242", "value": 144764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683184093, "uuid": "3753e87d-35be-4dcf-8288-901efce047ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184093, "uuid": "85eff50d-ca65-4e85-b6b2-12a6a5f3c8a8", "value": "8ca135323395bdb7b808d8b9c42c4d2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2640eac4-ea20-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683165931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683165931, "uuid": "3e66dde5-504c-4ac3-ac7e-36fa4eead023", "comment": "Malware payload", "value": "ba3e6ce97cbd9c12c5cff8abc38706c5", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683165931, "uuid": "c6186d4b-a557-42eb-82a0-4b58e53d2876", "comment": "Malware payload", "value": "352070d3b4149fb4b28b030acfd60da0d143650eb643fd58ff12ddfc904f23c8", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683165931, "uuid": "1266a88a-5b66-4f9f-aecb-dfacdb69bdd6", "comment": "Malware payload", "value": "31714576c0099cfc9f64ad515e9b9d3e02feff38", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683165931, "uuid": "982b1efa-28fa-456f-a48a-46f882ffdb3a", "comment": "Malware payload", "value": "d1e3118ed8c92203c533f7e9858fc140eab1ef4c77fd6edbbd173fd58b3a297f24d0a0647e49107aa5ae1a4bf277d796", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683165931, "uuid": "b5846de7-2751-43dc-9fdf-e49c9cddd385", "value": "T100D61286F768DA2FC8777072489A633652474D168E829787684C3F1C387B6E80F5DBC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683165931, "uuid": "2d49c45e-0ea4-43bf-bdc6-8acb74b7acc9", "value": "196608:/GEcD5udky4kLcrWDsilakJkEhWYYLsl2DqPw+6uJqHaF4toXOduE7NOMvkq:/rcIdSsxDjRwZOPt6Eq6F4toXOL7Nkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683165931, "uuid": "55261e67-826a-4df6-84a4-a14ede9ec556", "value": 12705592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683165931, "uuid": "feabc11d-3146-4438-ad20-4e3977d2a1cf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683165931, "uuid": "e34c485d-56a9-4267-b770-3b52d2367dfd", "value": "new-update.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d9d6f2-ea81-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683207668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683207668, "uuid": "ebe268d2-037e-40cb-af14-e3e91be07f9a", "comment": "Malware payload", "value": "5a39a8bbb5d45eb5a078d9c54c58f118", "object_relation": "md5", "Tag": [ { "name": "IP detect", "colour": "#860B55", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "netsupport rat", "colour": "#B6CA7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683207668, "uuid": "7c57fd86-4c8e-449c-977f-cddf1f9887d4", "comment": "Malware payload", "value": "371c52c6d1206fdc9d9b2f665fb6150596f9444896faf44420d4e5d33f1b68a7", "object_relation": "sha256", "Tag": [ { "name": "IP detect", "colour": "#860B55", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "netsupport rat", "colour": "#B6CA7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683207668, "uuid": "f42ae96e-f5f7-4b52-83e5-fa47446d7b26", "comment": "Malware payload", "value": "41b9582b72696d7d1d1b2664b0a9518887bba36a", "object_relation": "sha1", "Tag": [ { "name": "IP detect", "colour": "#860B55", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "netsupport rat", "colour": "#B6CA7D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683207668, "uuid": "fb51a834-d657-4d5f-9391-98f1cd530bd2", "comment": "Malware payload", "value": "d752f31ee0f9f0d120219ca4adaf7a2b4354210bc9b522ec0740cd495f529ede887c78630f3292c3ca8b8440cce6048b", "object_relation": "sha3-384", "Tag": [ { "name": "IP detect", "colour": "#860B55", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "netsupport rat", "colour": "#B6CA7D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683207668, "uuid": "3e0c9fda-f83b-47ee-84ca-51e115b1b852", "value": "T15B641E51A3FE9108FAFB3F50ADB416644E7ABCAAAD79E25C1250505E8A72F40DC70733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683207668, "uuid": "340b1716-6839-40c2-b6a5-0615f5023c8b", "value": "3072:+7O6uzBncUvgXSiyqgAZN3Q4De7XaGkH04uOU4aWttssRvX+cGdWBCJjQ+4jvjlp:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683207668, "uuid": "4e7f32f3-0d53-472b-b412-639003a87476", "value": 324804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683207668, "uuid": "87fdc30b-4f89-4c54-8695-19af61a085de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683207668, "uuid": "d9f2ece8-1260-4811-bdd5-488b95963f42", "value": "Notice_3_may_2248985.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b05f983-ea65-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683195521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195521, "uuid": "c1aa40d4-8e10-4edb-bfe3-a06d151b9932", "comment": "Malware payload (Mirai)", "value": "d24c037b4937ff548744e83653c903fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195521, "uuid": "4811d287-23c4-4675-b159-48f240477038", "comment": "Malware payload (Mirai)", "value": "3857a70a3f149aef7450ed9c9d9c3faf89f743bae03258e4b0f95c038d44140c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195521, "uuid": "d72b08df-8330-45f3-b754-ff2696a7417a", "comment": "Malware payload (Mirai)", "value": "1bd4d302ef28beb22e154753d03bfa3534b9650c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195521, "uuid": "1e22fd62-faa4-400a-a320-2323e01e5df8", "comment": "Malware payload (Mirai)", "value": "eaecc1e33003b7a9578c0793d549297b47eec8d520224ec78c9dc27808e72a62119ab8d641394114af03cc78d60fe72c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195521, "uuid": "6bd2b9d6-e4ae-4f60-85e3-4b0f3f82f725", "value": "T1CBA3D609BFA10FF7ECAFDD374AE91706258C651A21A93B367934C818B64B24B15E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195521, "uuid": "edb52e30-3083-4cfe-9f0e-ab69625daa93", "value": "1536:Io3tkrUY1U2A98ENrFEGw+PBVkyr/ZpxezuAY5N:Io3tkrUYrA95fkU//l5N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683195521, "uuid": "66ac8ec4-78f5-42dd-9a28-68e29b23acd5", "value": 105392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683195521, "uuid": "6c9074ea-8095-48c2-8ad4-6154208c9b20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195521, "uuid": "620c6971-5b81-4b71-af9f-9387beb6a265", "value": "d24c037b4937ff548744e83653c903fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dba6ef9d-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683194153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194153, "uuid": "59202deb-a293-45e9-90be-45989d578243", "comment": "Malware payload", "value": "dd4c5534ce849f5e1a21f9106b5aafa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194153, "uuid": "a06b7a3b-6d15-4a4a-8bf5-c657e6647ae6", "comment": "Malware payload", "value": "38a758be666b8aa814b8f86739d7059d0c09ff9ebb33eb0e6346bfc43ab8ae3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194153, "uuid": "30c28f46-d3b2-454e-9e19-e550dcf82981", "comment": "Malware payload", "value": "6e7ad9d6954f5b988df32365aff4fe2f3a37c7c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194153, "uuid": "274b9379-4c7f-4a70-bcdf-19756603239c", "comment": "Malware payload", "value": "512ffe22aabaf8d801a48345d16b37a3b02d4b30582c2fbf242521cc20c6655a1697a337b643027a16ed0f0ac867b185", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194153, "uuid": "1bee2302-60b5-4748-9956-a633c0bbc9ca", "value": "T16E03394668E2D4E3F523263FEA4910DF9178E8A72E07DE1622E0F16C25536135A3839D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194153, "uuid": "6e370208-6f1b-4c43-9699-c30756ff5119", "value": "192:nEhnrp2ScsqqnT2s1pFXySRMcHqbDXGvmhkL:Ehnfcsqqnis1KSuiqmu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194153, "uuid": "263d25bf-64b6-40a3-bdda-26660e27ff76", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194153, "uuid": "5e957656-7713-4c3b-b02e-9e87896dbe5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194153, "uuid": "444afefd-507e-4423-b500-871737504e42", "value": "SecuriteInfo.com.Win32.Dumaru.AA@mm.13952.4888", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de705761-ea41-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683180414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180414, "uuid": "6e0ddef3-1e1b-4f58-b685-87c7b952d284", "comment": "Malware payload", "value": "d6b7bad3d4cb7ba7bd432d72db7dbc92", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180414, "uuid": "56070c37-8aae-4136-8459-50844d4a2ca5", "comment": "Malware payload", "value": "38c2cbf78b685c79d9a6d37c88ce4af0737bd667aeedb6781025c1dc54a3923a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180414, "uuid": "91a58128-104a-4c18-9f3b-e2c6e45a34e9", "comment": "Malware payload", "value": "d3e87bfcd82451227ad5c59690c69fa5a7ea9424", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180414, "uuid": "971b30ba-b810-4beb-a143-18fc5253bed7", "comment": "Malware payload", "value": "5f169d35307dfc148906adc563a92a7c95b9fc15650fb66ce505254f667e7a6bdb49a577772c8af962fe3470c5b925b6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180414, "uuid": "ab2ff2d7-df53-45c0-a611-d36f2f1ad2f9", "value": "T157728D719A4E1C57E317C4B3E1A9BE36112AFACFD5C36A000328F9B10DA7252565986C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180414, "uuid": "08abd690-a992-4661-9975-e8dad5e599a8", "value": "192:F+CmzTjUj6LD4XP5xvZXZQL9AhNaYzo0dCXGtkd9dfdAp0SlqJ1cH:F+CmzTjo6ATvZXiLC3o0dCXGYRASoqJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683180414, "uuid": "326b7116-0f9b-4e16-b7ee-95ac36f81978", "value": 17025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683180414, "uuid": "4508801c-66b7-4099-833b-baebc5d9039c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180414, "uuid": "196de5b6-d414-43dc-8130-7ed263557ef2", "value": "Zahlung 20000 Euro Exemplar.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e27514-ea1c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1683164569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683164569, "uuid": "f66d415e-1e2a-4ea6-93f3-860667163ee8", "comment": "Malware payload (GCleaner)", "value": "fda78a40d6e36a38712ca7f79be2c78a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683164569, "uuid": "2d2bc2a1-6d88-460c-9108-16e42b7002d2", "comment": "Malware payload (GCleaner)", "value": "38cf550bdfc6ee19117649f70a28eba50610a4abc737c3bb908935ffce2620b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683164569, "uuid": "3d1c593f-6338-45d6-9036-61b5e2cc7d89", "comment": "Malware payload (GCleaner)", "value": "3bb73c25a7bf4ce9073f1cba5059d32fcc1ff68d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683164569, "uuid": "a72dab9e-5d15-4933-8445-267562ad947f", "comment": "Malware payload (GCleaner)", "value": "9e3c0b372b0c3bac0b7d8e812f66e641ab74165350717229545fe446707a6d8486af937c07222f7a0792ed51bdbd94d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683164569, "uuid": "c5dc56d0-f82d-4044-a787-c0e7fd09154e", "value": "T13A95331679531F78C1018FFA7DA64900857FFCA30CE81E28B3A8C79E697852BD9171A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683164569, "uuid": "af55c53e-32cc-4c03-9a7d-c446eebee3af", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683164569, "uuid": "dd5a6ae9-ce35-482b-96fd-b545ae8509c3", "value": "49152:ck4raFs2J3PuMgdYN7Twa6aChA4psNiTPreiBUzgoj6vR7VHAG5cg:ck0aFFJ3mdYN3f6aCSjiTadps/Xcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683164569, "uuid": "aa4bdca5-972d-4a0b-9606-61d9912f9e47", "value": 2025020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683164569, "uuid": "19cdc396-37dc-4f61-bbbd-5bfbdde9ceb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683164569, "uuid": "b07f8218-8569-4af9-af1f-75cd4db33254", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5430ea-ea7c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683205541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683205541, "uuid": "4bfb0b9c-5619-4405-8a81-0fa950972da2", "comment": "Malware payload (Amadey)", "value": "b52a6a67f7ce03b411992b6e8f908964", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683205541, "uuid": "c135b71f-a8b7-4421-8caa-84dd89416bdc", "comment": "Malware payload (Amadey)", "value": "38e22800a6be2449a17420b848e183b881f36f00bdc758f6a11b0b10f9e6e9b2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683205541, "uuid": "26d57634-9d1a-4641-9256-2dab6bf0ddcd", "comment": "Malware payload (Amadey)", "value": "d58803c0be76c42a411adb5ba03990867abdf9c5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683205541, "uuid": "285ce342-7f01-48f2-b5f8-e9e9f8d454db", "comment": "Malware payload (Amadey)", "value": "b6c29b33bf15d9b31ef8717073252c63a400987598e3d68fd7b0fe72bfe62a7c1dd8e4002964ca73a57a5882f6118162", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683205541, "uuid": "ddbf8a1d-9796-4928-b827-6c68202286e1", "value": "T180752366B5ED9170E8315BB159FA07C30735BC91483489BB368A7E4B08736C1EB39B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683205541, "uuid": "dfac24a7-b93b-4881-908d-9896e01f149e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683205541, "uuid": "ab01b24f-9c03-42fe-8479-726c8b3bec45", "value": "49152:9lrebYOMmBqKWSbk9DmV0TiNP+ETMpuvZ:ebYNYq649DAP+EIpuvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683205541, "uuid": "b1e55d19-bf27-4c2b-a975-f678a3ce7207", "value": 1620992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683205541, "uuid": "c4066014-4a28-45d9-b42e-ffd134b8dbe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683205541, "uuid": "65c24dca-add6-4d33-9f74-ebc410fafa93", "value": "b52a6a67f7ce03b411992b6e8f908964.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1092a4aa-ea93-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683215287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683215287, "uuid": "9646a057-3df7-4fa5-ada6-ba62c6fbd2dd", "comment": "Malware payload (Mirai)", "value": "cd8b9b7a57c9cd15c6dd8683febdf8b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683215287, "uuid": "d192949a-d1c2-47af-a1e9-f8d625c7832c", "comment": "Malware payload (Mirai)", "value": "39072d904aa9a0acc3f8fb0f30a02af1999e27bd14a4ccfab5a4a59b1527a865", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683215287, "uuid": "3868c3d3-7afa-4914-a518-58c64eef5474", "comment": "Malware payload (Mirai)", "value": "427474997a21874533e2275a776a37fa8808a291", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683215287, "uuid": "2a3abc75-1246-49ff-a26b-a6463c45b2e7", "comment": "Malware payload (Mirai)", "value": "019206a56f023c925ecfe311acbb2d0c2a0de00f84a1b79f9c60f30029f50d7c1a5b745b0f253affbc5e4c5dca002d3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683215287, "uuid": "6dfdf6c4-7f60-4865-b625-31222a7c6274", "value": "T15703F126E2426332D9B0243BDD73040933AA7A68F1D9F004911957ADBFE254BA3F5CB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683215287, "uuid": "0a05218a-4914-49a0-98fd-1ee5aba6143f", "value": "768:5lExwAF95suoKlIiA0tKDBmcOB1uzy57QJs824trkM+7n/PYGggq3UIA7Q:5ybdspKC39D2B8+5RDY+7g3gQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683215287, "uuid": "81ab33db-2e01-4d7f-a711-08500730ef08", "value": 39652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683215287, "uuid": "1255d7a9-2a60-4bcd-b453-815578b567a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683215287, "uuid": "3a0802d9-05f3-4be7-97e4-cfc2e410ea1b", "value": "cd8b9b7a57c9cd15c6dd8683febdf8b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8233af0d-ea49-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683183695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183695, "uuid": "f7ef1e2f-f825-430e-b646-794aad3c4800", "comment": "Malware payload (AgentTesla)", "value": "e232c96ee7ede4803e1c0bd4cac6b22c", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183695, "uuid": "95df9b1a-b017-406a-9428-ad3ac213f402", "comment": "Malware payload (AgentTesla)", "value": "39c7c79563f9ec76f97411c3bfda9a3d7404f6dcf66a29edf044c193c293816f", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183695, "uuid": "3e376f68-b45e-46f7-a2d6-dbb19f38b8a4", "comment": "Malware payload (AgentTesla)", "value": "f3370db90d75ae16d347e935fb0eb882b9e0be91", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183695, "uuid": "714a9f03-4870-4027-b3ba-cccd9e2a6ccb", "comment": "Malware payload (AgentTesla)", "value": "f80f2683ce56659b3138069d13ec7a92a7824134344263b75e52f99b2779c20074339cf534b76f84307a098eaff187a7", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183695, "uuid": "cfa09350-cf63-4d7e-9099-7c2817fea7fb", "value": "T1321423D11C6A78F59F87043E6A0B042B29B9C2DAE6B131FA4316BFA57B865031F365C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183695, "uuid": "4886d610-6b5a-4ef4-a775-901b4971370b", "value": "6144:rL/lExSjrzs/0M+jC3UbnxMfjMlsCR5IkU9xe:KxOzw0M+jC3UbxqfCPIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683183695, "uuid": "d84afac4-7848-40cb-a0b2-a70b5950e39b", "value": 199810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683183695, "uuid": "525557da-1318-4b5d-87fb-74d1b09e0019", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183695, "uuid": "0170c57b-f35a-44b6-af29-5ab4e7e24ae1", "value": "March-April Outstanding Invoices.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c5ce84-ea3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683178086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683178086, "uuid": "1d8f4481-92fe-4e3d-a53d-464e75e5df61", "comment": "Malware payload (RedLineStealer)", "value": "712fc845dd0f2f1e79683fc31448b724", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683178086, "uuid": "4d61b133-3ddc-423d-8628-7f58d0c5d940", "comment": "Malware payload (RedLineStealer)", "value": "3a3d290ac5fb8db16654b6674a2fc2c010110b3861e59282b3c4e1c63b8b0333", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683178086, "uuid": "2f7f0ca7-cc67-4fd1-ae80-3be27936d1eb", "comment": "Malware payload (RedLineStealer)", "value": "2d1c1870b07d2ab572ae82c340e64b13994803d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683178086, "uuid": "b0c8bfca-dbfb-4634-9607-68aaf9198d70", "comment": "Malware payload (RedLineStealer)", "value": "7a200d3c6bf68425bca388ac3d16dfa930e3ed706afe27dc73f60dbcc8bc06361b6eaa9a4757831f3521582475c2c786", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683178086, "uuid": "366a1cda-cc45-42d8-9a04-620291d860fc", "value": "T14C752347A9E49421DC7543B0A9F543D31B36BC92A4B0537B631A998E1C33ADCB972337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683178086, "uuid": "7e90cba8-3a57-4a27-9342-377b41868102", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683178086, "uuid": "63399d70-b4bb-4a9b-bc2d-2eb077762e8e", "value": "24576:Oyo74bGYsSp4b+cwTAozHlUrq7Tm2xRExPznpT3MBle1+NghMThb+tcFxnBMglNG:dLCR8lMKSxbpTQMcmCycvBMgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683178086, "uuid": "8577ca0d-a87c-495c-b1ee-4c55745fc205", "value": 1551872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683178086, "uuid": "8aefb17a-aec1-4f09-8d51-4023fad3c9aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683178086, "uuid": "a8198e3d-d03c-402e-b0dc-69fe3e9e5a72", "value": "712fc845dd0f2f1e79683fc31448b724", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc5d0d4-ea50-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683186533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186533, "uuid": "a14eb822-606c-4c43-92c3-2f630762757c", "comment": "Malware payload (Mirai)", "value": "6b9317b64e4991260e861d35244f7497", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186533, "uuid": "8ad3ce7e-f9cb-4419-a507-47e33872cb58", "comment": "Malware payload (Mirai)", "value": "3a63e4abce5ccee8da17214773d00e83891aed9b4efacd5857cffad4bd9d1943", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186533, "uuid": "6331e0ba-46be-4980-8f2e-b90393436b82", "comment": "Malware payload (Mirai)", "value": "a5476a4644574d6363644f8aed9f3404f6a484c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186533, "uuid": "f1a6728c-b1ff-45a6-a824-2c5dab1137c3", "comment": "Malware payload (Mirai)", "value": "6406f5eea8f52cc9f99f4f61453fa4da4145e721a76d1ee844acedeb1fe7e73799036b93802ba33a422128e3bb4e3e85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186533, "uuid": "47c93773-cf33-4e9e-9707-4df059b172ab", "value": "T18E83B40A7E218FADF79D823547F74E21B75833C527E1D285E1ACE9015EA024E641FBB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186533, "uuid": "6bdcb4a0-e052-4718-9a86-06803fd3c835", "value": "1536:/hX807Kjc2OGaryTw4mYCO/78benUHvwbZnLQr:/hX844c2OGaUw4mYCO/78PHvwbZnL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683186533, "uuid": "b8678cd6-ee93-4586-bdb7-86739c82aaf5", "value": 85676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683186533, "uuid": "e7f1d539-fa1a-4522-939a-b93b784c6af4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186533, "uuid": "40e82f83-f5e2-48e2-a650-5129959bf44c", "value": "6b9317b64e4991260e861d35244f7497", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561cef31-ea1f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1683165582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683165582, "uuid": "95f8ce11-fb71-4c8d-ada6-4563bd6ee387", "comment": "Malware payload (CoinMiner)", "value": "3b5d5728a6d74a0f0f48c5c943443b74", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683165582, "uuid": "a2547a52-e6c3-4a64-a7ed-a29cea4d974f", "comment": "Malware payload (CoinMiner)", "value": "3b3f397dd74ad22804f323c0bb49e3d99ac5a5423d0b3787a3bd71fc8abe9e6e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683165582, "uuid": "f5d22993-33b3-47f2-bb96-edd45f58eac2", "comment": "Malware payload (CoinMiner)", "value": "d57fb768113b969396996a88681d42c4d4c227bd", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683165582, "uuid": "e0af8689-7416-46da-adfa-15f33393e22f", "comment": "Malware payload (CoinMiner)", "value": "9c82ae24c7c35aa876fd7680ab40331660933abf5fd4eb5991b167a44b736040b4d06b5275471484bdbf16d71e822d8b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683165582, "uuid": "d1a3bc6b-8775-44a6-958b-dcaaf3b4ee5b", "value": "T100447D1273D0A974F626CB328E1AC7E46E1EFC51AF156BEF27546A2F08712E1C572312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683165582, "uuid": "b362bc42-c45c-470f-8324-8db903423093", "value": "2d39bee49f300ea90fe79768115a52cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683165582, "uuid": "2d668feb-4098-420c-b26a-5ee0a4e3641a", "value": "3072:3lM2SprixzpyHisBXhylChgU1mY0G31CFEnttis57xc0MMIECuiZQE0/uWm:KVk94His5hAXymJ06S+06ECui501m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683165582, "uuid": "73ff840c-0ee2-4dd1-ac4b-6e217c2f5409", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683165582, "uuid": "67996049-e3f1-48ef-bcd7-d31f7bff700d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683165582, "uuid": "5434f644-eb60-4bf6-b073-6544624aca9b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e1e7cd0-ea4a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683184010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184010, "uuid": "f13af55f-e92b-4415-b39a-fcbba6c0e975", "comment": "Malware payload (Mirai)", "value": "95396d54a2df665b8149ce7b3cef44e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184010, "uuid": "c8e71c78-a85b-41ea-ac61-bfbac3ab57df", "comment": "Malware payload (Mirai)", "value": "3bc240fe769e681eedf59f725d51a7d9f42f4451dc7feb4f85a39603c8fabd34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184010, "uuid": "ebea8edb-1883-473c-a4b7-3315218db269", "comment": "Malware payload (Mirai)", "value": "0e560d9a56c41afa8b39ae8a99b332afb8d93ca0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184010, "uuid": "20066ef5-65e2-42ec-8297-3aca319d21d5", "comment": "Malware payload (Mirai)", "value": "a047d342a03c86aac17d64deb2d05b0bdee87e644e1fd96873028e4a96a19239137629d53f9c9bd5c1c397546a4fb303", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184010, "uuid": "8fa898b5-15a1-4889-9fe6-bf94fb0435ee", "value": "T183F3C83B7D11ABBEE164C63107F76B7083952AE726D15382E26CEA185F7028D095FBD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184010, "uuid": "cd9ba9cb-4850-42dd-9a59-b801c4cf5588", "value": "3072:QJ7YqnXli5bMiPletJ8au49QuhsIRNi0QLjfiW2nLsJiBeGW:u7JGbfletJ8au4lBRhQLjfiW2nLsEBe9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683184010, "uuid": "458f3c02-84a2-41ba-b331-ce2b7f4e8af9", "value": 166098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683184010, "uuid": "fdb51079-8826-4068-a192-feb1688ad4f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184010, "uuid": "53a5b6ee-dde2-4fc7-bf2f-fff1bf45dbe7", "value": "95396d54a2df665b8149ce7b3cef44e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578fccf9-ea49-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683183624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183624, "uuid": "db22d1c6-869f-489b-bc57-ae99354c68ef", "comment": "Malware payload (Loki)", "value": "ce69ad16de81845d50c9243e8e7c2926", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183624, "uuid": "7ebb5c6a-20a9-499a-bf64-abc40f4110d0", "comment": "Malware payload (Loki)", "value": "3c306b96216641fbd00d7d7f3259f7285174cf8d5032ad0de6c70af5622f87d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183624, "uuid": "f13b5bf7-c569-4aea-b324-7fe891c4cbf8", "comment": "Malware payload (Loki)", "value": "145e906caa9c618776807055fb2c2837d869da5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183624, "uuid": "6a51cf70-281e-46e2-a902-e47ae1ce91c1", "comment": "Malware payload (Loki)", "value": "ffeaab127bf8bf876e63de5ceb0f2741ab4049f5ccd2ba58c4cb74d3ba8247433f16f1cdd32eac9ce9943ca036c503b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183624, "uuid": "bac62f59-1a89-48be-83cc-32c3cb1203b7", "value": "T1E01517AC316171DEC86BCD768AA83C64EA6034BB83CFD603912715DD9A0DA97DF141E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183624, "uuid": "0b1da682-a9ad-4e7d-add4-ea2ad07965b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183624, "uuid": "7938ddf7-af85-4c95-8bfb-48a2e267ca33", "value": "12288:K3bkJMqQFHni4Iy9uYr0fCFkIuBMiDc8PrRJRvlWzC2WIgP2VD6Btl/3YtLF48xo:dGwRZRogvRvlr2WIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683183624, "uuid": "4afa848a-f3be-475e-88f3-eb1a7f58e14e", "value": 900096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683183624, "uuid": "bd551a91-1755-4dc5-85dd-bdd500a3fcdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183624, "uuid": "b04bb025-670a-45cd-9d3a-47734cf5215f", "value": "ce69ad16de81845d50c9243e8e7c2926.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2188a03a-ea5a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683190834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190834, "uuid": "47061994-99c0-4d23-828b-9449fed917bb", "comment": "Malware payload (RedLineStealer)", "value": "0682776c3f3712e96fad5e39c305e367", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190834, "uuid": "b666393b-abc4-4e88-9705-f8e531dfc6e9", "comment": "Malware payload (RedLineStealer)", "value": "3cbb4d611c6a1ecc866aa6b754c18ad59d5d5cee34e62952f9cbba5161df322a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190834, "uuid": "327c94f9-dcde-43aa-8266-46d6cadc96f9", "comment": "Malware payload (RedLineStealer)", "value": "6e1de890cf9d8597f3087bb096dfc8c4cebad33a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190834, "uuid": "eb02252d-451d-4fe3-b441-97e55b92c9b8", "comment": "Malware payload (RedLineStealer)", "value": "3da1cb5f1518e8807605d3d905ddb34a5bced7b0d60f13201da6a37cbb500a1e1edc4fa427b5cb46bd11627b2482d07e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190834, "uuid": "2f28642d-1638-4c03-ae79-cfd2b5fe7496", "value": "T151752382E1D49473DD29ABB084FD07C72B79BCA1982C92277342D6AB0C616A47D37737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190834, "uuid": "a01463e6-2e05-4ae1-93e2-5a53a748f20b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190834, "uuid": "8cd46102-a6a4-4318-997c-dedb494b5c36", "value": "24576:KyWNKPiwXUiMsVeQuMvj4ylCH1GF6ZY1N9wTXYjNKtayaSu/e7bEtcQ+0a3XV3du:RJiwXUiMsgdFwCy6Zw9wXtjiUEcfhnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683190834, "uuid": "d2bbb7d1-0fac-4e2e-ba47-994e3b69afb4", "value": 1552384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683190834, "uuid": "8d57f0f8-d637-436b-824c-7919d5212e71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190834, "uuid": "7de65215-3a5e-4cdd-8524-1dd18c759493", "value": "0682776c3f3712e96fad5e39c305e367.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20997d98-eab9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683231635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683231635, "uuid": "b520545a-c5b1-401e-9911-b32ebfecc7ea", "comment": "Malware payload (Amadey)", "value": "b9a8daac90993d6759cd99ff322b1c67", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683231635, "uuid": "b9697af1-6e13-4e33-a48f-47228ed8f69e", "comment": "Malware payload (Amadey)", "value": "3d7299a0ffa6067676f8b49b6fbd85d32a9b9597355712b293e2a94ad4a362b5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683231635, "uuid": "2a0b2c7c-3108-4858-b1d9-036d88015704", "comment": "Malware payload (Amadey)", "value": "189c38dd976accb24c99b04d1d3ed8f082993638", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683231635, "uuid": "09ea638f-7878-4526-8df5-e927655ac530", "comment": "Malware payload (Amadey)", "value": "0122e00c323702b80447796bc4d000772bd0bacfd535e4db318b6680f5ba1d40f979c46519f41820fba5b4b20622d577", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683231635, "uuid": "71a8d7fd-3a86-417d-a066-c1a1810d47b3", "value": "T1A326227363591495E0C2CC369A37FDE071F6975EDB82683E61D6FAC620221A2B217CD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683231635, "uuid": "43f3a4da-2434-435c-83cb-80a2a8437c84", "value": "f540b6d6dcfc33b21d0deb0ccba24751", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683231635, "uuid": "271ed4e1-d149-4117-8ca4-31cce7902622", "value": "98304:2GgIlPKNT8aXeHEl/60qSAHbCej1j7eLdFZ:2GzoT82+VSA74dF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683231635, "uuid": "3d8b03af-37ad-469b-ba3d-afa06eea3082", "value": 4718592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683231635, "uuid": "e7dc7545-90fe-43e7-8387-b8a4c154a5dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683231635, "uuid": "b98c6dba-425f-4c8e-b80c-ba33f5183adb", "value": "b9a8daac90993d6759cd99ff322b1c67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e1986c3-ea4b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683184520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184520, "uuid": "48d682d3-0af9-407e-ae5a-938727551cbb", "comment": "Malware payload (Loki)", "value": "bf136bd0d7568d3db33aede1e943caea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184520, "uuid": "15eb6621-1cc7-403b-ae84-6a2a840c522b", "comment": "Malware payload (Loki)", "value": "3f22bd2e20b994c404cdc3fd87820817b32c3471d003c3156186ecac22936022", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184520, "uuid": "f6f9fa33-2844-48e7-aee6-e609936d0ba1", "comment": "Malware payload (Loki)", "value": "73167832a6b1cc08fc605b8fc5045ff54331c73f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184520, "uuid": "f517c645-6889-4daf-8975-60d10becabd9", "comment": "Malware payload (Loki)", "value": "2f8189610b6d0eef9c9c8d6bf077cf7ee63f650d698f95eda8136b627b2f4f5eec622ec3088e35af0c34aa4cc9a5b156", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184520, "uuid": "c1dd92c0-e1e9-4bf5-8e99-8236d2734257", "value": "T170D4C0A521BA8752E03F87F10078B55413F630ABA9FEDE150F8670D99D9DF402E89A4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184520, "uuid": "67278ff6-6d87-4321-b3a0-b16c82062934", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184520, "uuid": "6914b051-defc-4993-8a62-35b057e086a5", "value": "12288:31ni4IycA7XRrWBkz0eSZ0fso2f96VgCf/v9+pM6DkqkvB:31kG8CzXKe32qv/vopMwkqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683184520, "uuid": "18b2e875-9511-4f53-be1a-5432e80aaff6", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683184520, "uuid": "53d78d6c-5d03-4597-9af0-e98e624d363a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184520, "uuid": "cbc8d2b4-7398-4c39-bca4-72c9f8253c75", "value": "bf136bd0d7568d3db33aede1e943caea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0c5728-eaba-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683232241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683232241, "uuid": "05c62bda-613c-47a9-b663-8095beaa69d9", "comment": "Malware payload", "value": "c978e71f7e75fef5062a57d11ee2fae8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683232241, "uuid": "00548893-7e2d-4718-8120-5e06ce58494b", "comment": "Malware payload", "value": "3f3a756e029dd0cfbf8104950a863162e31f7223997f936866ca214827b59666", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683232241, "uuid": "eebbf7ba-b308-4ea0-b4bf-6adb61952199", "comment": "Malware payload", "value": "7bcbc46699f6068a560cdcb51f1d53d4d8cb7d5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683232241, "uuid": "a183a5e6-f9c3-48a2-bc5c-0683fc17fb5a", "comment": "Malware payload", "value": "2cabf21fa8276b984f0960aab268bac9cdb4dd80620dd246b171edbfe75b368e531a32ab39f6655cd485f5bc9577e7c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683232241, "uuid": "5d67e774-f423-413b-9c1d-a8eb361aa0c4", "value": "T155E4BE9A2148E398EA9DBD39DA66C9F2A4717D61CCF8411FB5FC3E4B39707100CB0669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683232241, "uuid": "d8991673-1c6d-4deb-b577-e9d1b8f533d7", "value": "12288:Tu0vL1IiM1gXIh+sQYKtTKHWfO3M6sELfJEbz55sq:TuELsNhtKeHWfwM6BLfJqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683232241, "uuid": "69200a4b-a202-44fe-9ea2-9037267677f1", "value": 660848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683232241, "uuid": "adc719ab-a218-49ef-b6ae-679137c4a4cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683232241, "uuid": "e84e0336-7804-4d28-a581-8306fc9cc8de", "value": "c978e71f7e75fef5062a57d11ee2fae8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8902a2d5-ea49-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683183707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183707, "uuid": "08fe4a96-3ed2-4638-a00d-3f1c793de569", "comment": "Malware payload (AgentTesla)", "value": "f305afd0ae7790fd1643f91578c2ac99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183707, "uuid": "fde1ae65-0f72-4f99-a220-546877797c5a", "comment": "Malware payload (AgentTesla)", "value": "3f5c64bc5070d7a04a7238746cbc51dc64e7715810e64c34dc560b8fb8c3a23a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183707, "uuid": "54da4fe4-0289-401f-b72c-5c083a814cc5", "comment": "Malware payload (AgentTesla)", "value": "807637d3d880c62f7a9410197eaffdf058a58960", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183707, "uuid": "c79f2b36-e790-4c54-af4c-3ab01b6b59b6", "comment": "Malware payload (AgentTesla)", "value": "d67862804b5ef937acaa5067f6447996db4f402094e2193838dd36f8a4e3c37d8327925b611f2548529f090ed5fd9335", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183707, "uuid": "e5e6439b-1543-4dce-bcd9-a257474d28a1", "value": "T18EC423AF5219A3EA820F8047CB864AF9A00D50F667359F05A9D2730951DD283FD7AF3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183707, "uuid": "81c11f32-867b-4345-9018-6e2c776bee29", "value": "12288:SJoUOJVn3zbdDZvz4dIzjWHaRMsOR/9xUAslmUS/uxI555:4oJnvdDZXjpW9xCS/N5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683183707, "uuid": "c5f36f1e-4f26-419c-b9be-2edeffa32cb3", "value": 586105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683183707, "uuid": "109f7dca-415b-4c39-a5fe-9b37f69130f9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183707, "uuid": "ae9cac80-80fe-4b3c-b588-ee0e85ef2c31", "value": "RSG - USD 37,760.87_pdf_____________________.zip - (2)_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c351ed-ea7c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1683205391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683205391, "uuid": "539856c7-b0b1-4edb-bdf6-227a8a173046", "comment": "Malware payload (GuLoader)", "value": "4a9532c39c0713ce127fdde32ced584c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683205391, "uuid": "2f02e827-6d8b-427d-9e41-2cb91a15871e", "comment": "Malware payload (GuLoader)", "value": "3fbb047dafd852970c75fe510d4f6b5f0e03ca4cda1f3f8d75764a5103371723", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683205391, "uuid": "689020e2-6eda-4737-ada6-bdf0b0c238a6", "comment": "Malware payload (GuLoader)", "value": "fbfcb73a34add69f845240b21ba33ec1d90fa5c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683205391, "uuid": "9320d6e2-bb5f-4655-b608-c6d2bc90d721", "comment": "Malware payload (GuLoader)", "value": "96585016ce669b0f9e85b20ab38c79f41a364ba3f7744809a520471a385d03d3a99e68f92394556c00fd7e5e11fc8c43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683205391, "uuid": "b9d4ff5a-095d-475f-b6e3-530026546d1b", "value": "T17F6412577B89C85FD89C0A7D883A9BFE53733D1C9B25190B2364BF5E38312825F19981", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683205391, "uuid": "84463b81-e64c-49e9-a5c0-6ec814e82e79", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683205391, "uuid": "4b35c5f8-6e57-49e8-96a9-ca0121d874f3", "value": "6144:R4SUjhth51nny3OMc1yfpolVBfp7vZmLm56zsoI+vL9sEInDpp:q/1nXMc1yRolrplmLG6g+S/9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683205391, "uuid": "e09fba8a-fbcf-444e-b111-c794897d9f38", "value": 334718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683205391, "uuid": "c4ecac4a-ce9e-44f9-98f6-42afef2ae611", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683205391, "uuid": "659a16cf-adde-447e-942b-73594dff07e5", "value": "BL017351-00691MDL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90ed6e7-eaa3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683222496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683222496, "uuid": "13285d4f-2edb-419c-94b2-234ca8d7310d", "comment": "Malware payload (Formbook)", "value": "861632d63af8b5cc4a72b7fc09aef813", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683222496, "uuid": "de32d4c1-232f-4bff-a8d3-7f44207854ed", "comment": "Malware payload (Formbook)", "value": "40af7ea5c438a5e5d39e726925d6ce11eadb0438f7dcaa50e753e7bb393f6775", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683222496, "uuid": "047a3c74-8715-4604-8397-9e69f5307771", "comment": "Malware payload (Formbook)", "value": "f1266cbb9908d2121f06845e764e4a249f5e3fce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683222496, "uuid": "4d56dbdf-ed47-4f51-89ab-5bda987e9d92", "comment": "Malware payload (Formbook)", "value": "2b028bc6886163c8e05356a375043f0ebb2c6f04cbe5a7f7bbc67caa9fed2ef514a5461eb9204a91fb8d5141e1806feb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683222496, "uuid": "52391799-939c-4ddd-a6e7-cf3cd93a59df", "value": "T1DB6412533B89C89FD4580A7E8C379BFD07F37D0DA6241A0747A47F6A34312829F6A586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683222496, "uuid": "d17422a5-3a38-4c39-8295-2df9173a1631", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683222496, "uuid": "5cf3797d-e00a-4eb3-bec7-3f82b069c842", "value": "6144:R4SUjhth5tWIzlI2nUWnKdn6zqouoAbdZmLm56zsoI+vL9sEInDpx:q/oalIyUJhaqfPbDmLG6g+S/9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683222496, "uuid": "10814cd4-172e-41c1-b667-c5b8b5f70268", "value": 331069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683222496, "uuid": "4758a2d0-5555-458f-8cfb-611a3fee2e36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683222496, "uuid": "898e2528-7777-4bf1-920e-8f9d707b00f7", "value": "PL59107-00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5b535f-ea51-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683187308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187308, "uuid": "1bd3549d-85ec-4d3b-9c54-cbaf96bd976b", "comment": "Malware payload", "value": "b76bd3941714868db0e12678403a9b12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187308, "uuid": "efade560-9cf2-4961-895d-251734e3df7a", "comment": "Malware payload", "value": "4155771d50c90864f0236a3325064901d513875238fec75f781e61d3044b68ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187308, "uuid": "b884fdd3-ff46-46c3-a96c-9eeb72ea0ee4", "comment": "Malware payload", "value": "4bd81ad40ba78509b786129b46d3a3ba43c4db59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187308, "uuid": "68012cda-4473-4c59-89b0-68ea761e937a", "comment": "Malware payload", "value": "ee6f8b2baffa8469e9f11487de26803a062fe4334ff955dd8f6cd5592b15b523353ff7572f8120a35106118364606ef6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187308, "uuid": "314a2603-d5e8-4f7b-b6b4-cfefab02eb31", "value": "T156A33802D5508B57C1D2177ABB9F426D37332B68979B3321AA247FB82BC279D1E3D121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187308, "uuid": "9bbdf35e-f4da-4b04-ac14-c9706705e773", "value": "3072:iHobm0w+aSP+wUsGZmDYgTE+mBQO/IXZFW:iHo6+aGUsGJEE+mBQO/OZFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187308, "uuid": "5cea1e02-9df9-4dd0-b951-3f80e54711fc", "value": 106529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187308, "uuid": "4e1424b6-2982-4708-b0c4-858b1f54731f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187308, "uuid": "442dc4c7-57e2-4529-a15d-53d24b82fe6d", "value": "b76bd3941714868db0e12678403a9b12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93faa51f-ea58-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683190167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190167, "uuid": "9bb7f2b9-7858-497e-bd26-023534fc1529", "comment": "Malware payload (Mirai)", "value": "339dc767b91a602b06b0ccfdef38a490", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190167, "uuid": "1a30ee95-f86c-4647-b1bb-5786cf554b05", "comment": "Malware payload (Mirai)", "value": "41f4ed1069209932639111a5f77019b0418381246646902fd1d1521899971878", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190167, "uuid": "410152c6-89f8-4825-b84b-547363cc684d", "comment": "Malware payload (Mirai)", "value": "0b4defe65e5074745009a973956dd0e2fc5db548", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190167, "uuid": "23280e7f-094b-4216-b974-d31545b03c90", "comment": "Malware payload (Mirai)", "value": "7c46e42697424fe09d6f222e89f278f2d398cb3c52bcf4acc76c2facff6988950afb6b32cb61483af18ce535c04ad231", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190167, "uuid": "2b78739a-f365-4406-a0dd-b0a5400d6438", "value": "T1F5C2D03441CA5E42C635C73ABB25C9847F554ABCA3B361AB7E40A368F4C3457EB3209B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190167, "uuid": "93764815-e08a-49d1-9887-9be72555f87e", "value": "768:wRYtLOjiI0iTehHr6qiLGOXQJYu5RZ8s3UozGd:wat9wALKGlYu5RZ5zE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683190167, "uuid": "c72b52d4-0fd0-4554-ab04-b0310c481660", "value": 26328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683190167, "uuid": "ad1de8f4-8535-4747-b0fd-cf0c63d9f831", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190167, "uuid": "aa5205a2-f4de-4ba1-a86d-77a63de65974", "value": "339dc767b91a602b06b0ccfdef38a490", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201fd051-ea45-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683181813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683181813, "uuid": "86835628-5f00-4eff-84d4-057c54dd4661", "comment": "Malware payload (RedLineStealer)", "value": "d122703ccfb980c2331aaa0e8f77ee82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683181813, "uuid": "86842584-1612-44c4-9e1d-f340c6496410", "comment": "Malware payload (RedLineStealer)", "value": "42f43904f6b1ebfb34d57a7522ee30e61140e374ebf098835e65afc2be10ee5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683181813, "uuid": "b3a7f080-280e-4ee5-bbad-fc6159ad0c21", "comment": "Malware payload (RedLineStealer)", "value": "bec221ed663bf746e1332e23ac669e46ba9a5898", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683181813, "uuid": "e89c55ca-7977-4058-b673-e1ef847091e6", "comment": "Malware payload (RedLineStealer)", "value": "99bdc63320dd31d12a98c7dab36c16aac5693ba93fd9f87159234076b6a56d83cee9da9c8efae398dbb16fedde43e788", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683181813, "uuid": "f9896efa-4d6d-4aa7-9c10-6cee6967aacf", "value": "T116C41243A6EC4036D8B017B05CFA07831E3A3D914E79875A3B81A96F1DB39D0A5B572F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683181813, "uuid": "6dfa0f52-25db-4aea-aa16-7d767ccbc721", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683181813, "uuid": "40648747-2358-4f0f-bc62-e0fcf9e5e92c", "value": "12288:+Mr5y905fCmJJ9qj+8gVtNRsrzaj451kb78eNlFkS60j:vyqfj9qj+8g9Rwzwa6/3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683181813, "uuid": "37e23e08-76dd-4550-80bb-5663d232e69e", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683181813, "uuid": "2947affe-6459-44f2-b141-1f7024d1c4e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683181813, "uuid": "d9f74dc5-5ac4-4645-b2ad-74059bd9419a", "value": "d122703ccfb980c2331aaa0e8f77ee82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee50228-ea7d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1683206158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206158, "uuid": "b1857a9c-c6e9-4648-85f1-1ac00a2cbb94", "comment": "Malware payload (NanoCore)", "value": "c9cb9ebf65d06e09204098326b3b697e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206158, "uuid": "0fceb407-06e4-4dff-8f60-181f14b0169d", "comment": "Malware payload (NanoCore)", "value": "43b1ea9d28fbd3c57dd563eb2097aa6555489795d3f060f2d03192b057878a39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206158, "uuid": "3a49ba29-20be-4d69-b9f2-38681dc2b210", "comment": "Malware payload (NanoCore)", "value": "724b274388945b7bfeac08e09493cce224209237", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206158, "uuid": "bd46ab6c-51bd-4d97-8865-1065e73f02ee", "comment": "Malware payload (NanoCore)", "value": "c3166035ab19a9a73d8246b193b65187db914ba4e06f5bb3522cb93c3c8566f9e292bc0798cac69ac9f725b962d39e9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206158, "uuid": "194ec9ed-2e33-4729-800c-e6f6c29586c5", "value": "T1ED64230561B4D0F3F55A57722E3E4922B3F4FF4256A8A78F2BA06B8A3D2E544CE0D741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206158, "uuid": "ddda1100-fea5-46ca-8d56-da493f4e0526", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206158, "uuid": "3c0db90a-9947-4726-8a24-7d69910bfc75", "value": "6144:/Ya6srTy4CMQbMEGo+as5arFDvnr4APl9tD3KpnbyabsLDLNkbT/KFODte:/YS7ChbMMDx7nr4AHtD+CXQ/KFie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683206158, "uuid": "bba0f7ed-4f0c-4e54-ad57-bf5a342dcb7c", "value": 330301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683206158, "uuid": "6152fb1d-30bd-4303-a51d-7aa04f019340", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206158, "uuid": "0748a27f-173a-4e5a-b445-f3de2d91db02", "value": "Bank Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a2aa86e-eace-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Tofsee)", "timestamp": 1683240832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683240832, "uuid": "151fc3f1-4e17-4a97-9f9c-7d4f2ad45b05", "comment": "Malware payload (Tofsee)", "value": "a287377cc831c829ac4f1f039a9691b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683240832, "uuid": "76fc52d0-282c-4948-a881-389a99174599", "comment": "Malware payload (Tofsee)", "value": "4416e4a4b101caee2b4e13d32e46d99c5c0458f62a8f095680a6df135dcb9bfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683240832, "uuid": "b26895ac-34ad-45aa-a22a-031f78909255", "comment": "Malware payload (Tofsee)", "value": "43c5dff1710c27f71fa53c77d5c53d55d211e974", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683240832, "uuid": "3fc194e1-0e29-4dbf-85bc-fe92be071f44", "comment": "Malware payload (Tofsee)", "value": "b77cd32c119bc800d02bbd27f06becdffe560d61825c70fa7abe1a52612fbb3e8bdc3193b04cd2f09606ef74ccc857f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683240832, "uuid": "c4802cb8-c5f8-4eb6-b4a9-5b0771f6ddaf", "value": "T1EA64F90382E17DD8F9264B739E2EC6EC761EF2508F597B6922189E1F04B12B2C173B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683240832, "uuid": "4e3caefe-9a48-41ae-9ea3-1bcaa8d19992", "value": "405d30f2af5701980296932df5084009", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683240832, "uuid": "c84b3ac3-bc90-4c09-af98-be54f876fa3a", "value": "3072:T8fNxIhB7bkD8Oh/UL8crUiFwfNpkj+ym/465NgPeN9oD5h9y4UHHOx//t:QahkD8OxUL9rUIsXy84U+PevS9FC8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683240832, "uuid": "fae056f9-d969-4490-b0f1-623479fac728", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683240832, "uuid": "cae21c3e-245e-45f7-8b77-7c94a94be69d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683240832, "uuid": "b4e6e006-9b5e-42b0-b5af-d7a00a17c37d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "401fe258-eab4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1683229540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683229540, "uuid": "87aa721b-a630-4b90-a788-2e05830aeb52", "comment": "Malware payload (njrat)", "value": "b878a102be7e16fb25e2add37ec27483", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683229540, "uuid": "6cb47635-3437-49e3-82c4-500e5e6ed1ec", "comment": "Malware payload (njrat)", "value": "44b2e6749b401fffd705180073c3e649c8458d445915470caf41a7ca5a312020", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683229540, "uuid": "cad65d4b-b519-4f1d-9e55-ca098e0cfe30", "comment": "Malware payload (njrat)", "value": "cdac3c46100b47ad65ffe4b3716ae671804c491f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683229540, "uuid": "270de62e-7051-42af-a9a9-2f35c9dc6771", "comment": "Malware payload (njrat)", "value": "4948d7c8c360ad0b2919a04ef532912aeef4725155b087abd381bfbdf480fc72353b42a9c81e7bb3b586bf1e2561c889", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683229540, "uuid": "b7c3c170-a460-482f-886f-1c747c5be812", "value": "T1E7F2F95761A70A26C7AC09F184A3F66003B5520B1616FFBB6ED878D76B43BD8B140FE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683229540, "uuid": "3639f1d0-5d91-4a4c-94bb-c5e5ab962069", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683229540, "uuid": "9093b835-9aec-42f8-b535-0f0e10482c04", "value": "384:ktetPbVS5/OcLmDqWPT+1o1dvtey3ZZtoFIrB+pJz/4r2xmzV777F7/m0N+GC430:kWcYCW1vXf2Dz/S73pxEvbq0yC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683229540, "uuid": "ccfad5f3-b0a3-404e-ac25-babce4b316a5", "value": 34528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683229540, "uuid": "b4ead839-6090-4129-ac31-6ae17295cfc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683229540, "uuid": "0a6e2f29-6aca-4b75-aa8c-f6bc725fe381", "value": "b878a102be7e16fb25e2add37ec27483.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f00ad7-ea52-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683187376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187376, "uuid": "c651f417-dede-4520-8ea4-322f7670bb7b", "comment": "Malware payload", "value": "0ae03ac29bcd2e9c89544c3c3f65f75b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187376, "uuid": "ec1e0feb-4660-41b2-b12a-484a5d4708d2", "comment": "Malware payload", "value": "453f3d1bbb6bf503e8035478bde958d5e4855f82125692cc9b77fb2315371422", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187376, "uuid": "37c56150-c07c-42e9-83fa-3ac34cb350dc", "comment": "Malware payload", "value": "0baf16556dc66f4075c09ea27db175cc64d0f8a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187376, "uuid": "966ef123-0a40-4ef4-b1b1-1bbed236b1fd", "comment": "Malware payload", "value": "de533823676798c37a41e96f4a791841095f28b7f58ec742c2b8c22552750cd70550b183a1295dd538cc40dbcef00029", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187376, "uuid": "f7a735ea-a50d-482a-87f2-eea605ea786e", "value": "T1BA03020EED666243D92CDC68515D5AB76A809092EBAD1F08FB118F88921DF1B31CFC3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187376, "uuid": "6ce27ba3-511e-4ba2-945d-6b0b988e1e8b", "value": "768:+EYQ5OW6p1Ex1CAsTh0dgF2iAqiTsJdW24pd2Wd:+Q5OK3EigFETsP4pd2Wd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187376, "uuid": "91916eb5-bc1d-4e78-8e12-8fc82d75d457", "value": 39924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187376, "uuid": "7bf7236a-3ecd-41ce-a167-c0c7ae7b5b55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187376, "uuid": "33b014e2-1b3c-4f10-9e21-2872cc6db86e", "value": "0ae03ac29bcd2e9c89544c3c3f65f75b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8809d449-ea49-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683183705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183705, "uuid": "3668b9fe-ef57-4066-a3ab-543bc648682e", "comment": "Malware payload", "value": "b4d99d9e91873b6b9d1c69235b47afe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183705, "uuid": "5b4aafe6-8a7d-4a6f-94f1-f389928b92ca", "comment": "Malware payload", "value": "45c1bcece0977f50737ae1f7dba9c55813e4b72fa0dc4ecb082861dc7958e246", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183705, "uuid": "7fe065f3-7eca-4a9d-8637-1f5155902d07", "comment": "Malware payload", "value": "44349ed625398c3339e6b36bfb459d5f52589150", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183705, "uuid": "30267a14-9144-49d0-82f4-dad29ff132aa", "comment": "Malware payload", "value": "550d4329367f66cbd3909aeba226e3c42c1a04396e58951b1067af289c454f77be59860c0cbc3a5688e0dfcbbdf2e325", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183705, "uuid": "8b4ad6d1-db1d-4f86-aaac-99c80becda41", "value": "T16AB5F133B66DBFDDE75D1AB8F4B211A40CC46EA7621880ACB9C8DC4F5175718A9B18F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183705, "uuid": "6f774c93-ffc0-4ca9-923d-f391fe32868e", "value": "24576:QIGTpY66Ci11j2/ewRJ1OgBLU3F5xKnbrfgnbPhAgKMpIApXgCky2CbKSyJxdwR/:w6jFKzczK/kVKgN+CkJVX86jZi6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683183705, "uuid": "b6ad922d-8662-4820-afb2-ad6f270c6c18", "value": 2355200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683183705, "uuid": "c7cf1daf-1d0a-4997-9b70-5e5f97b9f739", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183705, "uuid": "d05d95be-14e3-4755-bc68-a25f638de426", "value": "RFQ#7386A-04192024-NEW_SAMPLES_ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf81f24-ea8e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683213159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683213159, "uuid": "45b662c3-be8f-4cd7-a7ae-436866a48fe2", "comment": "Malware payload (Mirai)", "value": "1374d35d5467d1d731eec8c5264b29c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683213159, "uuid": "27a9f24f-d53b-42eb-8156-1d9d75e59a67", "comment": "Malware payload (Mirai)", "value": "46cb41f8508a27f2cbb629fede3c3c2064a0f50403919c9cf9d201cc0525d656", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683213159, "uuid": "89e885a3-aeb9-4c41-9bb9-6d0ec9588f47", "comment": "Malware payload (Mirai)", "value": "92d8e0fb0075b7bdc83a3bf0f4963dd27812b408", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683213159, "uuid": "19528f70-d453-4a77-a4f3-0191f532224a", "comment": "Malware payload (Mirai)", "value": "e8b660e5ad95c73ac51ef3e7cd7ff28259b9f69ec189956a9face9b0e3d1150c4b756c9c426d9b2ea6e214644f00a3dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683213159, "uuid": "6343dc25-82f8-4bd9-9ff5-6e1f590a999a", "value": "T196F2E1A549E5C544846592761CBF7C0F0D26B70EE109B03CABD737872992F6C663EE32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683213159, "uuid": "87509897-49b3-413d-b09e-9428582f8812", "value": "768:NYuXQRH6lLCbVWLC51vC+X2F+KpONF64j4wK4V77aHnbcuyD7Uiyqd:NXXwuLCbVW+PvDX2F+akPj4uqHnouy8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683213159, "uuid": "c7700d82-5c22-4ad5-9186-eb1b074a0ecb", "value": 34516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683213159, "uuid": "b0371fd8-cff0-4c71-8cfe-fe38f3552ca4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683213159, "uuid": "9a5841e6-88d3-436d-ad66-32d5f2981f88", "value": "1374d35d5467d1d731eec8c5264b29c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c102204-ea7d-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683206072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206072, "uuid": "ef145af2-daba-4bf3-bdca-d3141a8ce2e2", "comment": "Malware payload", "value": "66d1d2d7a1560a8d71b6387dedcb942c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206072, "uuid": "a92439be-6008-40cd-9447-9ad22853036e", "comment": "Malware payload", "value": "472aaae1dadf37f7b5de90730717707f45821777bafb3187c20176d0a28824f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206072, "uuid": "17b97ccd-f46c-4b97-9fb9-4a3f7a0533e8", "comment": "Malware payload", "value": "54fd79b3aecfcee6e9c0a4218d33cbc45c73c185", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206072, "uuid": "cf4f03d8-6b35-4e79-96bb-37abf6360991", "comment": "Malware payload", "value": "04df9c55c2b2f7d61e4e8d30e8cfdfced7fb91f96b75b78b778bc2f1e9388c3f66a089b5adfce68a2961fef856dacd46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206072, "uuid": "66d926b3-20e1-4e46-b865-7f9b517ea807", "value": "T168347DEE1247EADAEE33BCB4DAD56BF09A173569FE8DC1F140DCB427042016B4829947", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206072, "uuid": "6ed6be3e-5bc7-443d-aa0c-ce5d65b15049", "value": "071307373db47402e881a4d65e0a19ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206072, "uuid": "de7063a1-e5de-4d89-acc6-9623cfc11f11", "value": "3072:d25JU7WQVImGGiT58muhaSs+6eP9Joyg5rCkVEY3tAW36s86JUN1Il2S7Ke/:MW55g5rCI3tAWKs86JY1Il2SGe/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683206072, "uuid": "ab72d33c-d4a7-4c13-9188-4e7e1e39748d", "value": 232800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683206072, "uuid": "31114333-1b6b-4ccc-b8ee-14ff0c56c054", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206072, "uuid": "c7017535-f4f0-4a52-819c-ebac4d523835", "value": "472aaae1dadf37f7b5de90730717707f45821777bafb3187c20176d0a28824f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7488a4b0-ea42-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683180666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180666, "uuid": "1bcf5397-0301-4bbf-b16c-7eb23b23fa2a", "comment": "Malware payload (RedLineStealer)", "value": "2c83bc8f2ad3c1c16fa57574d7a0057f", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180666, "uuid": "2a389cdb-f343-406d-9324-aec15b4fc23b", "comment": "Malware payload (RedLineStealer)", "value": "4766822fe5257e71508938b767734450e18bbacad05971d0d3b732879d8b4f1c", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180666, "uuid": "1f403dd8-b619-4805-8062-3dc60ecf3205", "comment": "Malware payload (RedLineStealer)", "value": "d4f4f2a365ca6ee27e24a67226fad936cd578eb3", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180666, "uuid": "f8a30810-d967-45de-8ce9-38d43147e4ec", "comment": "Malware payload (RedLineStealer)", "value": "1a6b0f6bd6f98c6e5745d5e676535af1e19bfbfe972421782cca4a30d2d78115fa0f9ea5e398c3fda29f15bae5b32bb0", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180666, "uuid": "d8724582-b188-4e3a-8c3f-d3d8dfc5714e", "value": "T1748423C86EA7BD06FEF32BAC516BAF5BC9E6C0684BDD2691025A750D2F0B5907763004", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180666, "uuid": "78f96e40-025b-4d09-b517-9a66a8082328", "value": "6144:A6xnwlNmNcMuM8MfpS0n9p//dljPuB+HEswHMK5rMkjFF1vVq+hYMv:APmOpCS0HzSB+kswHD9RvlhYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683180666, "uuid": "59054cbc-a37f-4b14-82db-26fa11fbe617", "value": 378893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683180666, "uuid": "67c49e5d-1fa4-4c49-9097-d4042b28cf0b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180666, "uuid": "15c310bd-5871-4faf-83b3-c367e716e8b7", "value": "Loader Crack 3.7.exe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1948433-ea41-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683180312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180312, "uuid": "750df5e2-9ce1-49cb-9ac1-57f0dcad2f0b", "comment": "Malware payload (RedLineStealer)", "value": "7ab3041b6ac6d2fdaae56ff610ca1125", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180312, "uuid": "ef0759d1-f94a-4c6a-8e61-526b656bc50d", "comment": "Malware payload (RedLineStealer)", "value": "47905a192164ebc97d304e93c68649617afefccca619ebd49739a852b0c8821d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180312, "uuid": "a1e753bc-cc8c-4c9a-bd3f-4b7c1e553dcb", "comment": "Malware payload (RedLineStealer)", "value": "2010804f95a0bf9739231792c3ac60ba98fbdc95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180312, "uuid": "09345ca2-01ef-4b62-a9f7-cf326e6ab554", "comment": "Malware payload (RedLineStealer)", "value": "6af64be804e5a7009f7ba10778453d741a245eaffd17c5ed550a496e7ea12270fda73c6bfe1e6d1c82c51176705c6af7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180312, "uuid": "34baf00c-4a45-46bd-945b-e8f435c052da", "value": "T1A5A40222B7D89532D8B627B04CFA07830B357CA299B4535727C5A98F0C726D0E536B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180312, "uuid": "28a5e862-70d9-4121-9e9b-b12e9ad5f351", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180312, "uuid": "4b717761-e749-4515-93a0-5d1e14dda408", "value": "12288:XMryy90536Wt/Al/qFn2fXvoVr3ibcYdrQIk2:RyG3Al/qR2or3ErVk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683180312, "uuid": "d2887f04-2c9e-4f8b-8a6e-94bebe6aa0e9", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683180312, "uuid": "a3e2d755-a806-445d-a081-f44d18a2fd57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180312, "uuid": "062d62ec-c33d-4983-a821-30ef0b29bb30", "value": "7ab3041b6ac6d2fdaae56ff610ca1125.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da1ce820-ea59-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683190715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190715, "uuid": "e019f608-da54-486a-b47b-30792f23b65e", "comment": "Malware payload (AgentTesla)", "value": "70777b9dd0548e6b6eab90b19c6dead2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190715, "uuid": "83691247-9ced-4bf1-bd55-07e77b9da04f", "comment": "Malware payload (AgentTesla)", "value": "47f9bb565bcc679215abb38b4c2385a8d3ea9415e3219d51e338867dc9086b1e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190715, "uuid": "6f2b3e6a-17f2-463c-bd2c-dcc9d7e76996", "comment": "Malware payload (AgentTesla)", "value": "0d0b81e604f484156dbdde9f1631808beb8d79bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190715, "uuid": "19506893-c28a-4c24-ae90-6cce80509482", "comment": "Malware payload (AgentTesla)", "value": "f5a9a219f3c2d2a4cb8e17c80748b8a486675e5a089b2bd77fd0d8d54ee68700efb67f53feff52a87e9e50b3bcc2d224", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190715, "uuid": "883027c3-10dd-4931-ab2f-c4033f85be1b", "value": "T191C46C3C29BA9627C0B6C3798BE59423F1509D5B7011EEAA54D733B64713B8239C327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190715, "uuid": "0912ff81-2509-4c28-bae0-cd3ab411abdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190715, "uuid": "168ff1c3-3f46-4c58-bd41-ce69d0b2ad89", "value": "12288:pYzt+KqnAomQigtRjEuCuzC7XUZs1L29qL6QMq:pwknkUgu9zCwO12wL3Mq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683190715, "uuid": "b931bd59-e0e4-42df-96f3-7cec9370cae9", "value": 559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683190715, "uuid": "d2105415-79c0-4c26-9b46-f4fd70a66314", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190715, "uuid": "5ccb325b-5802-46c6-ab91-ff35b57a2efe", "value": "USD 935,661.12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ab0db2-ea50-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683186598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186598, "uuid": "d2995a74-1fae-43ab-9841-de3118a2aa05", "comment": "Malware payload (RedLineStealer)", "value": "60eca7726ccde61de67e580c3670a1a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186598, "uuid": "d370d2cc-5599-46ac-ace6-50b2cc79b219", "comment": "Malware payload (RedLineStealer)", "value": "48d77180cf874b0ca209ee99f37c36e98c9bc44fcdfa55ccd45039214987d800", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186598, "uuid": "196b62bf-7d44-4226-82da-5ae41bfc4e7d", "comment": "Malware payload (RedLineStealer)", "value": "d62d1920f365bc8902ff8b1b77c7efa8ca874868", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186598, "uuid": "199b62cc-5c9a-487d-8bc3-0bb165b3253a", "comment": "Malware payload (RedLineStealer)", "value": "54f5640c04acbeaa0bf4ac3a335bb1b3ed16f535d2a6ac1db7ae6fb2cafce878d70738f6638def49b215184630ad9174", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186598, "uuid": "464503b8-e78e-4e5f-b0ca-8aded127365c", "value": "T121752343ABEA5832CDE5E77455F787C30F33BCE148A987262B10A5450CA32E5CA7476B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186598, "uuid": "492daf77-c3da-47ab-b7c4-717d3dd25f22", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186598, "uuid": "d5e46b7d-308a-4f1d-acbe-0a7bc7943d95", "value": "24576:ay6nLJ7Ku2w19LKU9wL0iRc9bhnj7DFt+GhZHU2wMR1PY:hqKudGU9wLi9lb+GfH6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683186598, "uuid": "7246e190-af8f-48e4-bf08-0eae3d0b5af1", "value": 1618432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683186598, "uuid": "c87eef09-9b35-448f-b112-5230548c6c50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186598, "uuid": "2ddf0e5c-96d4-4a98-8a1a-1c3fc88922bf", "value": "60eca7726ccde61de67e580c3670a1a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28dcac3-ea53-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683188044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188044, "uuid": "8a270f84-25fa-4c7a-9af4-0c9dc43eac02", "comment": "Malware payload (Gafgyt)", "value": "b73116306de407394bee825ff4d95091", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188044, "uuid": "45950686-f510-49cd-bc53-1b0c7f1d9b7a", "comment": "Malware payload (Gafgyt)", "value": "4a3baa3bff7f9622cc625c02b23d7f453077405093280e70dd153d2ab60717c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188044, "uuid": "0169038e-75e1-44ef-ad6d-77d707cc564f", "comment": "Malware payload (Gafgyt)", "value": "ddc09091365dc4c0506485afde3e6fe1f16e0607", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188044, "uuid": "f1064d8c-eb69-4c9e-9260-9331f3f482ad", "comment": "Malware payload (Gafgyt)", "value": "cb6a53fd00e71872092e040c8dfe0c2e9f802b16b6d5bcdb2e50770274b698e57faaf5933553920bc78d56c91bbc2225", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188044, "uuid": "4b448c6d-d969-4a65-a32b-596a2a7dac2e", "value": "T13F933A4AE7404F13C0D1277ABADF421A3323D715A7EB73064A286BF43BC27AA5E72515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188044, "uuid": "51981645-e764-4558-92ed-cd1b5f43f036", "value": "1536:sxnn/3aT2Rb3xsaCniPEClYDiDeH9ny1Hv86zSbzw/9HXDgJY:y3Egb3xs/tKu9n2HvZzWM/92Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683188044, "uuid": "a13c7c8c-f152-45a3-be2b-0eba7bce6f94", "value": 94644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683188044, "uuid": "2cf3aa0c-18e5-4cb4-8664-7e876910517f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188044, "uuid": "4711b538-2ba8-4dc9-a387-97767e34b9f9", "value": "b73116306de407394bee825ff4d95091", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b89af78-ea64-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1683195227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195227, "uuid": "ed3513ee-e225-457a-9913-db819b0f8e33", "comment": "Malware payload (Quakbot)", "value": "1a9d42957bacf586d050739f4b1fa6f7", "object_relation": "md5", "Tag": [ { "name": "1683182516", "colour": "#CCA21F", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195227, "uuid": "98c77acb-3fbc-4dbe-85de-0917c7c4f06d", "comment": "Malware payload (Quakbot)", "value": "4acf40ba4dc505e027323e56fc1ffee7fa9909abe5186e2a8acf646069ecf290", "object_relation": "sha256", "Tag": [ { "name": "1683182516", "colour": "#CCA21F", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195227, "uuid": "4cba75c4-4092-4a87-b21b-cd5533f9f9ed", "comment": "Malware payload (Quakbot)", "value": "91a7c35c6fdf8f684b21815ff29a2745c16d901c", "object_relation": "sha1", "Tag": [ { "name": "1683182516", "colour": "#CCA21F", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195227, "uuid": "c96797c8-873c-4e37-8c37-32c03aa73529", "comment": "Malware payload (Quakbot)", "value": "2aa9309e0b11fb6910ac4a9907cb58a0bc6195a6f11030ffed5513a9b87973757bdac5557fbdd1ad3357825dbddeb912", "object_relation": "sha3-384", "Tag": [ { "name": "1683182516", "colour": "#CCA21F", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195227, "uuid": "606236f4-d150-4089-86d6-f865259127c7", "value": "T16A44CE11B944E130E9E212F3DABA391A6F6FD660035A62D373605EA51F885D37E3E343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195227, "uuid": "192b9f32-5567-4047-99f1-09adce51844c", "value": "aa6732aad80627bf3fc823b2fbac9d4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195227, "uuid": "d1729166-87d5-4e4b-b02b-f6e99b507585", "value": "6144:SsUG4yxNqItF5W9XncaWDAdjaTNc8Qs3Az0tDCFHyHQT3JkYVU0ZIf2Bqp:Ssd4VItpkdjSe0AFHyw+0ZHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683195227, "uuid": "4921e242-a9a8-4942-911b-ba31f2283603", "value": 256668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683195227, "uuid": "ef425c54-cac9-4fdc-926c-ef7e1b9fe31a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195227, "uuid": "ec35a166-4686-4af9-97bf-1022f86a3eb8", "value": "itsfresh.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40cdca3-ea3b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (HawkEye)", "timestamp": 1683177739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683177739, "uuid": "dc6b39a8-7ff5-4ef5-b60a-ce1e85f1e881", "comment": "Malware payload (HawkEye)", "value": "5e9a63f5b3d8f53478a2889c0eefd510", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683177739, "uuid": "92b59455-1299-41ab-af8f-ac14d21ff101", "comment": "Malware payload (HawkEye)", "value": "4c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683177739, "uuid": "e6335978-b37f-418f-97db-c7f971307faa", "comment": "Malware payload (HawkEye)", "value": "d6d545146b969ac2ea389a1f11ffcda377549da2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683177739, "uuid": "e865ad60-b53a-4547-a4d2-5bf83312a02b", "comment": "Malware payload (HawkEye)", "value": "5a94cb0dbd712651268c1bace5ce6cecde15e1509ebf238a36cc3edd8c6bcdb410aab394bf72e90ae9b3739aab2df346", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "sansisc", "colour": "#AA15AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683177739, "uuid": "c8a8e8a7-ef3e-4623-9047-b69d4ca4784a", "value": "T1DCE4F02E7B8DCE16C41D46B680EFCC901770AD659A13D68E2CC933EC1E6A7C63D0959B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683177739, "uuid": "d7198b85-72b2-456b-b438-95854879ec59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683177739, "uuid": "5bf6ebee-d49e-4944-aba9-82249938783b", "value": "12288:gXQnnE6+s3WsZ/lkwR939lgKFWRg1xY0VcRuaHuatAUz3huJ7XrjaJ+:gXQnnYsNHXR9NlgobVcUK7UXrj++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683177739, "uuid": "5b020bc5-54be-42cf-a55c-cb4567200a3b", "value": 673888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683177739, "uuid": "7fcb00ce-e8ed-4d4f-a4cd-cb1491fcad4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683177739, "uuid": "f2ba1662-f370-4827-84bc-d1901fb8cddf", "value": "microsoft10converters.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35900cda-ea6e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683199458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199458, "uuid": "1cc69676-6f45-4069-941a-bb436e994099", "comment": "Malware payload (AsyncRAT)", "value": "ea9c86f3f4b0040d0cc82c45d5bfefa0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199458, "uuid": "9ffbef00-728a-4710-953a-746b8dfa6f61", "comment": "Malware payload (AsyncRAT)", "value": "4cc3dc04d2546a3b18d3e9447fb27bde8d4b469e171bb98723b4572c3ddb077f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199458, "uuid": "9372cd49-e52d-46a7-a780-6c20169865d1", "comment": "Malware payload (AsyncRAT)", "value": "44f8f09a9d25b6916391ddd5821725d147aadbd9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199458, "uuid": "34252603-d0eb-4181-838e-8bce7e139c61", "comment": "Malware payload (AsyncRAT)", "value": "50773463dccc040943665f52354bbf884ece0ab05a70d2e2560031a63f45fe83aaead6badd168f13b70a16be725f487f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199458, "uuid": "f23ec4cf-c14b-4443-b549-c4e570f9ca70", "value": "T1F301D054F0AFAFB38047BA7744D7ADE1E83485C307A0A9557120B655C46D0F848C9AC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199458, "uuid": "02a6c97b-7cc7-4404-a528-32938ee1a7ea", "value": "24:UFQOSGUTCaK2EUscg2wOeyW/cuslDHMg6tNu:cTKma/EUsc+H/cDlDMDtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683199458, "uuid": "e8c291f7-a4ee-4c4c-9709-59f3deba7bb0", "value": 797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683199458, "uuid": "5baf4547-9139-4f43-b4fc-8a298eaa6dba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199458, "uuid": "2ac8aadf-1599-4769-b000-cf6a7b8bc643", "value": "Confirmation_188843.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d42cf3-ea5b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683191425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683191425, "uuid": "fe8e9bb7-c693-4f06-b2df-c17362331a2d", "comment": "Malware payload (RedLineStealer)", "value": "86d5c924899fcf4c4ddafbe8148a6eee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683191425, "uuid": "3dd8cfe2-e994-4c6a-a27f-786beb85f528", "comment": "Malware payload (RedLineStealer)", "value": "4cfd6eb94c925a6f41c9c15d990fb5d5583ff0d39a52b54416ad6f53763930f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683191425, "uuid": "5e090ac4-7128-49e7-98dc-991c44cc4582", "comment": "Malware payload (RedLineStealer)", "value": "dcf24c1cb48ce729c03d3ed9bb2662ff7d5d641f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683191425, "uuid": "439dd29d-f776-41b7-9c35-5d6678ef8dc7", "comment": "Malware payload (RedLineStealer)", "value": "c5c5ebb2ae186d833842c922ce666b8f897cee985d799465958932e48dc5c1b91ccd77c640695be93b326f8874b8c853", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683191425, "uuid": "235641a6-f67e-440f-ab4d-dc31b9998ae7", "value": "T122752303EBE44563CEB127B058F166E31E36FD922A24871B77C49A8F0C72AD5A531727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683191425, "uuid": "54b22ec8-5187-4c30-be99-132aa0a1ff2f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683191425, "uuid": "e11bc73b-3a56-4f87-b5c8-41a3dc594663", "value": "24576:Xy/M3LJH0ZYhtvlVZKNlGJsLg0vbGDGsh+rfr+d6fCoNwwlUHwFir/P4:iaJH06vlTWvbG9MD+d1oN8wc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683191425, "uuid": "d3fd1795-c203-4f15-a990-8efb0359cf3c", "value": 1621504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683191425, "uuid": "9326e77e-5b38-4331-b1c9-d6d1e907b50b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683191425, "uuid": "e9049bc8-3ddb-4d4d-884f-d1c77c8ce7cc", "value": "86d5c924899fcf4c4ddafbe8148a6eee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a94974-ea4a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683184099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184099, "uuid": "8ecb7cd3-e1be-4ba2-b578-d21008484f85", "comment": "Malware payload (Mirai)", "value": "4c7c086e4cc47a6c11ee2282b14d9633", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184099, "uuid": "d5cf0536-8321-45b1-8e2f-320765381418", "comment": "Malware payload (Mirai)", "value": "4d55006248c1283b549a901de1689aa0a32e7db0bcb7ae3c757ca4e09aff1257", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184099, "uuid": "59a17140-e552-4e04-abdd-3978994cc789", "comment": "Malware payload (Mirai)", "value": "728ecc9db3488f0d9abd4483a03a5e3abb589ce5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184099, "uuid": "d089bde4-81b7-41b1-a14d-15d04a96e76e", "comment": "Malware payload (Mirai)", "value": "4ba69038ff0fbb4898cbbd1848698e08e204bced5c1e682be06a2caa2caba7fe6f1fa00a7b13c7a1323d2f80937584f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184099, "uuid": "a8c28bec-bc6e-4fc2-a74b-1037882a0458", "value": "T199F3D91777618E73D81ECD3302AA1601148DDAAB05D977ABF2B4E958FB6684F05E3DC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184099, "uuid": "69ea3052-bd8d-48c3-a88c-5e50f7fb9155", "value": "3072:pHsCSIq4VObexQetJ8au49QuhsVFLRX0qIjfiW2nLsJiBeGW:pHsCSuVWeQetJ8au4lcFd0TjfiW2nLs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683184099, "uuid": "f704def7-0870-4530-b285-f33f06ffa504", "value": 166210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683184099, "uuid": "5249f7b9-fc43-42b2-b796-17414ae19619", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184099, "uuid": "935c71ee-7b45-4d74-87a4-f2d0f69308ee", "value": "4c7c086e4cc47a6c11ee2282b14d9633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66bc7e1-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683194171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194171, "uuid": "179743f9-6134-4700-9a25-c3477f58e377", "comment": "Malware payload", "value": "6dbd2b8d90cf33b11d92d6613d838e9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194171, "uuid": "2dcaffd4-403c-4ff3-a4e0-bc1cbb4a9ec4", "comment": "Malware payload", "value": "4dd5e053c9d6e94fecb49655bb10f057f1a277a563671a735895e3cf8e377f39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194171, "uuid": "f7503dfa-3aab-49cd-bf05-af6327f33f8c", "comment": "Malware payload", "value": "7748a862abd303da5c78035f98497fee720ff2a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194171, "uuid": "0fd9a186-60fb-4d01-add6-0f52d5cb2161", "comment": "Malware payload", "value": "396d85770803d66b9f76dd7504faaba2ba54bff1726b7441b2ccb5663133aa4c30d3f00d08191f47437be1dda9987724", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194171, "uuid": "1f451082-5aa8-4580-8da7-6fc41daedc76", "value": "T13EC33FD05754ED23F394D83DE825AB5987A9305FCBE38879707CA9CEDA6D5A02B0C243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194171, "uuid": "f8b1ccaa-e969-4952-a838-36e016be8353", "value": "1536:GHqmKI895lENE2ZgWo/0IIYDWKQwyeY4:sK97go/0IIYD61eY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194171, "uuid": "87e64dbe-faf0-4bbb-a3ac-788c52a70507", "value": 120832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194171, "uuid": "2b023f58-7d75-4ab7-b768-69b7dbed5cb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194171, "uuid": "1443283f-3da2-4ddb-8df1-7ae98c502173", "value": "SecuriteInfo.com.W32.S-909ca299.Eldorado.32702.19591", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea46f5d5-eabb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683232832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683232832, "uuid": "6f982a80-571b-4931-b8ad-20912077d9eb", "comment": "Malware payload (RedLineStealer)", "value": "1771cc4737b92e3bf05ac35f4b42d88d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683232832, "uuid": "efa4bfb3-e693-4471-8d3a-19922189c74e", "comment": "Malware payload (RedLineStealer)", "value": "4e420c4c07a70100e563e93edb18965d03e7cf1a1def69266c8e5fc7fb04f79a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683232832, "uuid": "dbeff06b-a10a-4aef-8185-3cc96eda2f43", "comment": "Malware payload (RedLineStealer)", "value": "fa7604c108fcd30c4a8c989dfe5b21ced56c22e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683232832, "uuid": "a0eed73e-fd45-424f-b251-76bf0ecd2bb1", "comment": "Malware payload (RedLineStealer)", "value": "278b61ccb8874ac8ed1ee606f61f048e58af64f012c683a39d99a80e5a2ba99b1408b987e62d9320c3b955edb510bc86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683232832, "uuid": "0574d730-8600-4a44-9487-aad81a5a23cd", "value": "T16D840217EBE84072E8B21B7018FB06931F36BCA1AD78C35B3745995E1D73A85A53132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683232832, "uuid": "d5daa178-edb4-4b06-b1a1-769823660597", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683232832, "uuid": "8ae860af-56d6-4424-b632-c93265796d5f", "value": "6144:KRy+bnr+Hp0yN90QEN4Re0BsxtQQC/5kEQYV/F/8JDSSqobJcfZuwSjVx1O:vMrjy90P2sxaQyp/FYMoehPSjVxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683232832, "uuid": "ab4e9e3f-631e-4e29-8c88-5d307aa1ef7c", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683232832, "uuid": "ed5478e5-21d1-4803-9530-38f7eca236da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683232832, "uuid": "e44d34a2-30c0-4b6c-bc2b-02eb93e8272e", "value": "1771cc4737b92e3bf05ac35f4b42d88d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6adb4cdf-ea4a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683184085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184085, "uuid": "5fbfde8c-dca5-45f1-9710-1b895bf1b708", "comment": "Malware payload (Mirai)", "value": "02196cc497ea563b8941e229494333e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184085, "uuid": "6a8e4572-1d04-4a75-86ce-fb39a631ac4b", "comment": "Malware payload (Mirai)", "value": "4e623bb4d2d2bcbcdeadfe936b4d72f1dd763b609e1054554b7cd599a6146b51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184085, "uuid": "dce5ab44-6b0a-4ba8-8720-84a1638f7af5", "comment": "Malware payload (Mirai)", "value": "1a7b748baf95b7e498a72817ab4e7089b596090f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184085, "uuid": "e57057f6-dca1-49c3-99b5-3aecf57a1789", "comment": "Malware payload (Mirai)", "value": "2de244a3a007d604e967da42cd6adf9f362750fc46c5c87e3523c1fcdd5ef98fb11e71c21fe865604cc793ada5e42994", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184085, "uuid": "14861702-1476-4925-afd4-f8894cf7e400", "value": "T1D3D32C06F8004627C2D12BB7B39B438D77265FB95BCB3352AA297DB02FF164916399D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184085, "uuid": "98cdf21f-bfbc-4440-b900-51366b2eecc4", "value": "3072:VvCAEL95L4khOvXsG1X+r8loetJ8au49Quhsetvq+qEF3XvhCQ6KAGFQpXW:R1hloetJ8au4lftvqQNXvhCQ6KzFQpXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683184085, "uuid": "bec206b1-c591-4167-883f-8fab0794c6d1", "value": 138186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683184085, "uuid": "2b373dfe-4903-4cf0-9c8f-5eeae1052d41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184085, "uuid": "044b7113-6dbc-4223-8c55-d699523cdd1f", "value": "02196cc497ea563b8941e229494333e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3939ebd9-ea63-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683194740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194740, "uuid": "e45d758e-abd7-4fc4-aec8-da77aafac97d", "comment": "Malware payload (RedLineStealer)", "value": "a422bbf0e8a9a28b3cace3c64a3d8016", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194740, "uuid": "f2f462fc-5d10-43d1-abea-9b3abe76ffc6", "comment": "Malware payload (RedLineStealer)", "value": "4ecdceafbe9de36abd4a963f49463cb01e9f313d4422eb2cb6a6406416b9e9c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194740, "uuid": "5c3cf1d6-44cc-4eee-bbe4-82960c95f3e8", "comment": "Malware payload (RedLineStealer)", "value": "14f9f94fba39d0d2dfa0f1a3cf92b6044d0ec283", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194740, "uuid": "b2bb05e5-8abb-4a35-89ab-b829ad58348b", "comment": "Malware payload (RedLineStealer)", "value": "f237a62f28f695c384c5643260cfa1bb46a94d3c241d5d9b089e62bbb91ada6052e3c747f5cd390e2c92d23bfee2b8e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194740, "uuid": "ee19fc75-7265-48df-9c97-ffc15f47683a", "value": "T152851202F6F115B0FCA22D315A396A15E83DBF101B7DCB9B6B98796EDB305C09530E62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194740, "uuid": "d5872235-0bbc-4150-a393-b1fbd43cce7c", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194740, "uuid": "9b523f79-3794-402c-959a-4161ff4fb713", "value": "24576:oTbBv5rUlTl0bib7nkVqXo7hd3bBmqZLNK8apiTAVFnyeUClIaoruE0pXFrXUaId:KBSqdNQgTKgapVXUaIlNad7+EutZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194740, "uuid": "35715d7e-9daf-4a08-8a5b-9189fa53edf9", "value": 1728111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194740, "uuid": "fb5036c5-0b6f-4ea7-b530-42d290ea6006", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194740, "uuid": "d65ca465-b165-429b-8ed6-61fb7becbe3c", "value": "a422bbf0e8a9a28b3cace3c64a3d8016.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c55f35-ea50-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683186580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186580, "uuid": "60ce7534-0481-44fd-89b9-22c4faad14db", "comment": "Malware payload (Gafgyt)", "value": "e03da568e908245f33d9e76f698ced73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186580, "uuid": "d12fd04d-14fb-4d69-a97f-ff4608e39c9c", "comment": "Malware payload (Gafgyt)", "value": "4ed0dc9f6eab29935238ab146ccb3e0b3bace23fdcd0fe7c82436a99f97adff4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186580, "uuid": "db380e43-6d7e-4d8c-8fe4-ca1e384b180d", "comment": "Malware payload (Gafgyt)", "value": "441213554edd699b8f2fe276a5892b8399038980", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186580, "uuid": "bf2fb548-910c-4ab1-9480-ad6151221dfb", "comment": "Malware payload (Gafgyt)", "value": "7b5e19560b722a67cdc47bc5188b8a17686641dd6ea8d5d970fe9eb158ef6f2de8f0ab526939f3e8bfcdffa0e778bfe0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186580, "uuid": "2113a4c6-aadc-498d-b2b6-7c9c6dfcc87b", "value": "T1B9633B42AA42CAB3C8930AB502EB9A260631FD2A0F179F55F31DBDF49F135C87617365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186580, "uuid": "e241ffe6-fb7a-4081-b208-059ba480a07c", "value": "1536:n28bQEmDIdV5LTepgWncXy3olDmF+l2OZ/fufYEZ:hbQEmDI1LeNciYmEl2OZXufYEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683186580, "uuid": "9ee4b2a8-48cd-4a42-9477-e03314760303", "value": 68892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683186580, "uuid": "087cda7b-57d1-4b29-8331-8f65c2f16112", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186580, "uuid": "d3e3c803-ef6a-4fc3-9570-9fa26d1aeffb", "value": "e03da568e908245f33d9e76f698ced73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe945df-ea7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683204918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683204918, "uuid": "69bd3ab2-1c49-43b9-b355-e6672b765530", "comment": "Malware payload", "value": "f2ceb5df875ca18a6415b7a45b64d19a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683204918, "uuid": "3e7c60c2-aebb-4e8f-8c17-cfb8002795f3", "comment": "Malware payload", "value": "5190b35219729c1fd4fbf9be3a72cabd3ddeae5de092242aed5792babc21cbd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683204918, "uuid": "1043852f-ad2f-4274-bc5a-ed4ef6aef7c2", "comment": "Malware payload", "value": "2fbb7c135344a6bbef028183bf127648165415ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683204918, "uuid": "b9275318-a900-4a57-b538-2c78f3fa7d7a", "comment": "Malware payload", "value": "1db50386b39390e78d75e5aa5e8c77b75ab3ac1402a8138f5a3608aaedecfbc501d74ade6dd094264324cd00da11099b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683204918, "uuid": "21417577-3abc-4a8b-99c1-8f8d4d42e2fc", "value": "T1A0346CBD2086EB0AFF7088705FD4755A83674497CE67DBF2DD5694B03820CA1E806DAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683204918, "uuid": "d05b7c1a-1eea-4fc0-bb07-6ef03c8a742a", "value": "071307373db47402e881a4d65e0a19ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683204918, "uuid": "fadd03f0-ed38-4335-aeec-b504db8a9781", "value": "6144:l4Oe4XG0QafzJd2BbLEdOjtra3Rez5pXC:WLMQaftd2BXUOBra3RcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683204918, "uuid": "5d7ab49e-064d-42d9-b4cf-dcd2311fcd50", "value": 250208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683204918, "uuid": "7d3b6d95-d853-426a-87ba-14033988faab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683204918, "uuid": "5f75f467-096b-40a3-be76-efbfd7a03de2", "value": "5190b35219729c1fd4fbf9be3a72cabd3ddeae5de092242aed5792babc21cbd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16794563-ea57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683189527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189527, "uuid": "ac63eb2e-6a86-42be-b324-1d1fde9b20d6", "comment": "Malware payload (Mirai)", "value": "19d277ff670094e49c4eae5dd0d14100", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189527, "uuid": "dec10331-9044-4592-b24f-26f5e25cbd8a", "comment": "Malware payload (Mirai)", "value": "5340dadb7741f996a7415f47b638dc6314aae7c55d2df323f24c9282f11ab3ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189527, "uuid": "96bb4996-6798-4823-8a0b-a88d97305d42", "comment": "Malware payload (Mirai)", "value": "aefe2f6a38a6f1c12d38ef51fab2369cfe6dd141", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189527, "uuid": "33b96879-aafc-4b37-89fc-ff96835cb7a1", "comment": "Malware payload (Mirai)", "value": "7ce2094534befb8afe8433f1d5c6081c9d8c2ab76254027efb64e181ed6c702a7e995fb450d35f0e9e24bc82f1462b57", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189527, "uuid": "69a3f335-3c25-4f25-afb5-d54d0c3e5f10", "value": "T198533B01F719084BE1F31EB03B3B2BE583A69E8221B46249795FFB49D571D32548AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189527, "uuid": "0d707b4e-b5a5-4e6f-826e-db40c5b848b7", "value": "1536:tDmk8awDsIzMtDoZzExi27D0MwVZPak+XbqIby41QazTg4YVHRBrb:lmk8awoIotsZwxX7Dp9EP1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683189527, "uuid": "054c4f11-dd13-4358-b8d6-6e89ca93d797", "value": 66332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683189527, "uuid": "72932d69-153f-431c-8ab8-a6ff65c7e864", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189527, "uuid": "fc985268-6308-4f00-b245-6969b44e1b3d", "value": "19d277ff670094e49c4eae5dd0d14100", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98b0d7da-ea1e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683165264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683165264, "uuid": "ff8dae1e-2187-4167-929d-fa468290ba8a", "comment": "Malware payload (RedLineStealer)", "value": "04d61e9de28c85e4150becf2fae7f073", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683165264, "uuid": "d1c961b3-e083-4834-98f2-e6629c85ee92", "comment": "Malware payload (RedLineStealer)", "value": "53555e1cd1bb37441658549fa8476f85d941ee508230a752386f87403ef88be6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683165264, "uuid": "207f109f-623d-4ce9-b4bc-a01694b253e6", "comment": "Malware payload (RedLineStealer)", "value": "2f9ab26217442908e2266c81811a4839b519a61a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683165264, "uuid": "144d55ad-c6ea-40df-a8db-799e49bb741f", "comment": "Malware payload (RedLineStealer)", "value": "8d1820785b89ebb6f7d9951be59d9962d4b1fa06791c6ec20c4684c08d14892a497f32d508174f4a8bbbbe6b87346037", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683165264, "uuid": "99d1cd2d-f002-4748-9ea6-2b3a34cf56be", "value": "T19994BF1272D09874F636C7364F1AC6E4661EFC918F556BEF22296E1F0A712E2CD72312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683165264, "uuid": "8c732767-b5c5-4066-8f82-819cedecbf57", "value": "2d39bee49f300ea90fe79768115a52cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683165264, "uuid": "cb895b29-fab5-4f08-9b45-1871d28872df", "value": "6144:Ml81qqYeQImLfMwrFMltRNCYjHwXBnZ3dlMft70S2KqJ4830:Ml8o1eQImwwRMlHMXBZ38fCSdyh0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683165264, "uuid": "7f8a2180-2863-4750-ac84-ff3c7d3a709a", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683165264, "uuid": "7abd40b3-5cf0-46e2-bdc4-b78e14c1021c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683165264, "uuid": "8e75fdd0-d93d-4c17-ae37-aac79d436b06", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e23e1c-eab4-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683229714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683229714, "uuid": "8a191451-bfe0-47f8-8460-03354f21b8f8", "comment": "Malware payload", "value": "6f90a7c04412c859da5f98dc5d77955f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683229714, "uuid": "c0332f3c-cdd4-46e7-a7d4-49a34e9dadeb", "comment": "Malware payload", "value": "541e2f4a8031bf40bf3e37f578ebbdfa62983a92737dfae5fc9c2bc333108a5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683229714, "uuid": "9c56dbec-e869-412a-b017-967c9c092b65", "comment": "Malware payload", "value": "570eb3f2a5ef5a2e8660dedd7c7ad7afbc10c11b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683229714, "uuid": "ca2162c4-dcb9-4f89-8e39-a5a2fc5f8628", "comment": "Malware payload", "value": "4f05f6f4c14657647146c3fcd4aa48c5ca0790bce581d6682832f367f0b0e6e19af30fbac5a9d0c560680872ebe77271", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683229714, "uuid": "068dc9a5-011f-4d16-87ae-84e24f389d7f", "value": "T19D26EF60B2CEB063917B4FD4C4E77B03D5CD1B295DB8EE8546A192EF5612288E23D2DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683229714, "uuid": "e5016e2f-6623-433f-b17c-aac50c40b5b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683229714, "uuid": "02f5a3f5-c0e0-4e0f-bd48-57bdbf8e7082", "value": "98304:ZkkCZklBzstya5dACREJQ+Y261vb8MQJSP1y5:SkCoBzsEDC526Jbfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683229714, "uuid": "3edcaacc-26b4-4522-b7b7-32a64c4adb4c", "value": 4469760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683229714, "uuid": "d503485e-6357-4c4d-b595-6465a0407a85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683229714, "uuid": "512f01d8-8e58-4612-83de-639fcef9c025", "value": "6f90a7c04412c859da5f98dc5d77955f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "737def99-ea82-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683208152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208152, "uuid": "e3c5a2a9-8b7c-4473-b620-a59be4264ba8", "comment": "Malware payload (RemcosRAT)", "value": "97a0392f45b97d9047413cab0a8e84e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208152, "uuid": "95c960a6-993e-46e0-867e-64c385407d3c", "comment": "Malware payload (RemcosRAT)", "value": "549261710c9d695d9e66f2526a1b658f695603ae3a529a6263be3c2dc78b94d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208152, "uuid": "4da19307-736b-4932-a8e6-1ebb2d9a9407", "comment": "Malware payload (RemcosRAT)", "value": "31476472c9773fca2cfba0de4d2d0dfeec286ed2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208152, "uuid": "8bc65a77-72b8-4b59-8342-5a0f927cae73", "comment": "Malware payload (RemcosRAT)", "value": "3c9eb5c0987dbd499d62c7c020ef706e44cf5cbe9d5494ca9f2873b2fbb4449906f4c41d7e7edf7288d2d398b8526776", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208152, "uuid": "2795e28f-65cd-4486-be92-ba5fa7c2c120", "value": "T1E9E4F1012B61CD27E381127A506AE7398B747E94391ADF1237F87DD77D14B2A382E293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208152, "uuid": "f81893a5-93f2-4488-b7b2-2f47aec4cb96", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208152, "uuid": "079e36d1-56a7-423a-ac0c-a8aa266f5791", "value": "12288:PVNbqGGnQcn/olzhJ8evF3Vp8Vaa7vNQCQQcH9S:PVNuG8IFJ8edn+NzNvQQcdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683208152, "uuid": "f853c62b-a5d6-40d2-9ee7-64bc882e0f32", "value": 666721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683208152, "uuid": "390e2e8d-9462-4c67-8740-33999b0224e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208152, "uuid": "a80ba87c-c5be-48cd-ab3e-8572015ccc73", "value": "549261710c9d695d9e66f2526a1b658f695603ae3a529a6263be3c2dc78b94d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5137b7b2-ea6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683198645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198645, "uuid": "625865e1-4358-436a-a8f4-d0ce17ec6844", "comment": "Malware payload (RedLineStealer)", "value": "bb231b5d0dcfdd61a971c3951223157e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198645, "uuid": "e3b2038b-7a65-4c75-a06b-a96eafc8c426", "comment": "Malware payload (RedLineStealer)", "value": "56027122bab50e6062addb3da5f18f639d88eefb9b6c9667aa91884cbe70e7a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198645, "uuid": "06e84e84-f862-4002-ab9a-3cc8d93b796d", "comment": "Malware payload (RedLineStealer)", "value": "95a64b94af586f64f819a1ce7a9e54ed855ad6e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198645, "uuid": "52b692b5-6fca-4a27-b169-2caea9dbf6e8", "comment": "Malware payload (RedLineStealer)", "value": "f44e710a1864d4a17754acc77dc69a52919acf9a54ece22f8b8e88055ca52c7b4abc26ddae1b03f6dae2f9f1e73f5a0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198645, "uuid": "a6c934f5-ccd5-4edb-bac3-fa01fb9ae91c", "value": "T12455233295C94023D97857B119FB03831D31BCE2897896A2634699CA1EB37E97E3077F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198645, "uuid": "7268cc5e-5cb9-4931-9f7c-6b91c9251d21", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198645, "uuid": "c384b232-4478-4891-8411-c21108064062", "value": "24576:nyZZyOfQJRUwy2TeLIKWPf4mBz/QQzUBTAi2n/A3oRJta/Qedh57s6m+eI:yfXcmwnoIln3QQCTAi2n/A3IJthedhZh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683198645, "uuid": "f0c524ad-7521-4c71-95c6-7af3a9074f06", "value": 1332736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683198645, "uuid": "0d8058a0-c164-4f52-ad7c-2dfb2abb91c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198645, "uuid": "556bec80-f37a-4ab1-be60-7f4133168f85", "value": "bb231b5d0dcfdd61a971c3951223157e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a70c7f6-ea4a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683184058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184058, "uuid": "420eb428-4e42-43ea-b4f1-1dfba2601c13", "comment": "Malware payload (Mirai)", "value": "eba45f77f60c8d79021d7af6a75cd9cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184058, "uuid": "050f3521-19e8-48e2-9c55-4b29fadb1bae", "comment": "Malware payload (Mirai)", "value": "5745a0ea3ac8fd8dd63217aa1a6287fde1ed254ea7ee27b67606c4d20de3c8e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184058, "uuid": "8e94fe28-14cb-4ed4-be94-6b4f3603e99f", "comment": "Malware payload (Mirai)", "value": "a5c07004f51ad8359000ca09233b1edbb933549b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184058, "uuid": "4207f5f9-a1c4-4c23-ab6f-f1a3d0a972bd", "comment": "Malware payload (Mirai)", "value": "5af751a4d292f8f1a74dd49aba1767fa44dd3b854185f6606bce43f54a56c3c2d9d1c72a2c904c2d7be06c9416ec43bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184058, "uuid": "201d7f8e-9c2b-4f8d-aeda-0e380fcf6481", "value": "T1DCD33A1BAA080793C44B89F12CB737E08B9AAFF315D621C1E51DBE905B719762236FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184058, "uuid": "35f16680-f91b-4f07-b056-19d186940ddc", "value": "3072:8irwejsaWq7GKetJ8au49QuhswYWEmH6GItQ2Xyg9WW:8i8ejsTq7zetJ8au4lFpH6GItQ2Xyg9t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683184058, "uuid": "5e5066be-ff3d-4b72-85e3-219a3a6a427a", "value": 132164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683184058, "uuid": "733b1f7d-3940-4fd8-9828-9f6f6b877c60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184058, "uuid": "1598e1f6-dff7-4a8f-ad44-f35713a57da7", "value": "eba45f77f60c8d79021d7af6a75cd9cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64a82e2-ea42-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683180749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180749, "uuid": "56e82fd9-a013-48f0-a58c-82346fde3293", "comment": "Malware payload (RedLineStealer)", "value": "ae55f3146ba5c26ae41d72f267349398", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180749, "uuid": "9c91c6fa-3382-4f67-9b8d-76c81e558260", "comment": "Malware payload (RedLineStealer)", "value": "57ca3e73e929deedb72d8b0f6527a7d295da0ce29f82b70a95e15e32be74de90", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180749, "uuid": "edfa4c7c-59c0-480c-9b0e-cc28105b56cd", "comment": "Malware payload (RedLineStealer)", "value": "a90cb627627e0f38bd975fbcd225d8b622e61541", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180749, "uuid": "a3c5a86b-28be-42ef-8abf-91e14d0d6a8c", "comment": "Malware payload (RedLineStealer)", "value": "a791e27a7ffacb33e5c83b02ae4a8c2bf3835ba474a6759a214cba50ddb2b9e1ce7d0babed0c6ed3a8b8c2c405768e2c", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180749, "uuid": "9cd8a3ac-c505-4865-92f0-b513cb14a6dd", "value": "T1F4C5330311C294AF8F763DB5A2718F08E73E81862764B951F879E7BD0CB1BE5122F649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180749, "uuid": "60d557cc-9446-484c-8e8f-bc7c970794e2", "value": "49152:sWdKAVWuJbeD3vPzSSfY6hhZ3IQl6pcc8HflKx/DRN5AL2TrByXdg34WUruTBrcT:JKA0uxa3vOCYehZGUEx/NNnrBmg3NLTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683180749, "uuid": "69a9d9a6-2232-445a-bff3-6f511d6a1daf", "value": 2607355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683180749, "uuid": "fb354b87-8588-49ca-9d9f-225d91cfa739", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180749, "uuid": "e0ccb216-5262-445b-8cb5-f86f6ca85dc6", "value": "Pass_1234_setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c074a4d-ea53-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683187953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187953, "uuid": "57f82920-58aa-4847-b998-17b6c00ecee0", "comment": "Malware payload (Mirai)", "value": "5eeca31d7cdac68361f9c2d4087961f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187953, "uuid": "e8ee2700-cd62-43df-b2d4-94a035c44ff6", "comment": "Malware payload (Mirai)", "value": "581ebf2732a00bf8b12eb8e05d60fce3afa35fb34841dde5a61bfc8c5c15233e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187953, "uuid": "8ce9d319-7db9-4794-996e-e12f26eb6935", "comment": "Malware payload (Mirai)", "value": "af7a897b31965ade58012167125ba9d6f0f10326", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187953, "uuid": "7fce4be8-463b-4fec-9abb-aaa7f7866b8a", "comment": "Malware payload (Mirai)", "value": "bba78d056dd80d6d080148a9f07b59395a3df0520d9a7d845a5c8795987aeaa5fd8ae2cc586caa02a6011f5493dd980f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187953, "uuid": "73fa1370-fd55-42a3-b0ff-2b1a83efc029", "value": "T1C6131956F8924E26C2D413BBB67E5A8C3770A7E8C3DFB213CD506B51B98640F0D96E90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187953, "uuid": "ee926885-4f00-4655-aa8f-4841443a87d8", "value": "768:Y/rU2tvG5lMFH/7m4PaNvAH89iLJ2mta/+vIvot5lVMP/OXRBz7wtwbZn:N2VG5yJ7m40vVktaWvImlV8/OXktwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187953, "uuid": "0b4f1713-d1b4-4b73-84c2-cd90cd40fd00", "value": 44612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187953, "uuid": "777db5d6-8465-4a84-96c0-fd5752212a13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187953, "uuid": "71f39202-c1b8-4cd0-9a40-e38fb80b0841", "value": "5eeca31d7cdac68361f9c2d4087961f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d74a2969-ea79-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683204454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683204454, "uuid": "3336e408-d304-43e8-a0d1-9c91546e0a65", "comment": "Malware payload", "value": "a1fd44225fc8c070d074c743e6a9267f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683204454, "uuid": "a042531c-3ae0-4999-a011-0568708c6a58", "comment": "Malware payload", "value": "58212c824914b413d113f8a6b442f571a67930b7a53ee64d9a5ec64a7ccb795d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683204454, "uuid": "d34882f1-884e-49e2-9c18-a7ce73e038a4", "comment": "Malware payload", "value": "9dd9377eecdd32d6db0170bea0a319f9ddf6f8b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683204454, "uuid": "5e332972-6650-44c5-9c83-ee8386d7f05b", "comment": "Malware payload", "value": "00dde877bb8c94447fb134c7d0f5809373ac2e60d95eebaddc8df0156af040b15d51afa5e4b64c2029d778b94a506350", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683204454, "uuid": "17de8947-2673-4814-86c5-9909d2bdc395", "value": "T10BC4100D16B19887C09D4EF1B89DDB7F05222DB9A722C6363538B19F39123F92D6643B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683204454, "uuid": "a0d2e4b2-9aae-4921-8112-6d92a113f14d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683204454, "uuid": "35e28e91-e4c1-4fa0-9d09-8fb454648262", "value": "3072:LMivwqK5S+TZX8vX6IHmjr7g5qsEQW1IEl51:YYXK5S+Tw6IGH+ERI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683204454, "uuid": "739f0fff-61a3-4647-a289-a55e63a247fb", "value": 555520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683204454, "uuid": "4d3c057c-114a-40e7-aa87-e77baa0b1f87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683204454, "uuid": "e9054b95-b2f8-40c0-9433-a048ba4668da", "value": "58212c824914b413d113f8a6b442f571a67930b7a53ee64d9a5ec64a7ccb795d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd320783-ea58-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Conti)", "timestamp": 1683190263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190263, "uuid": "e6095069-8321-4eb6-94c9-18986bd3c8f0", "comment": "Malware payload (Conti)", "value": "cc94e9ab396fef0d9ee7caa7e9d44b8c", "object_relation": "md5", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190263, "uuid": "41bb89a4-93dd-47e7-b04d-9f256765f7c4", "comment": "Malware payload (Conti)", "value": "583f35d8d15dd19cd1cdcc1e03f6b3e1eaf1fa0df452eb80868d3767292d523b", "object_relation": "sha256", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190263, "uuid": "415d247a-a64c-47a6-adfe-2f648a5cbc63", "comment": "Malware payload (Conti)", "value": "ea701578e445fddc71fc61f4073ccc1000c77220", "object_relation": "sha1", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190263, "uuid": "3003a60c-b2e3-4a80-b33f-253df260e11b", "comment": "Malware payload (Conti)", "value": "309ff0b24d03454d5c2830e82364172a604f93f6833efd09e50882f215d0a941cd7402f6edf8878500770c711bac9201", "object_relation": "sha3-384", "Tag": [ { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190263, "uuid": "08317b29-4af0-4f4a-b982-2c704f973265", "value": "T17FA53847BC9540A9C0AEE2308A669252BB717C991B3063D77B50F3B82F73BD45E3A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190263, "uuid": "aa546c0a-92e7-4277-83c4-82d8b7051d1e", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190263, "uuid": "69fc9511-d86b-4818-9ba2-4d8cb4b64a4d", "value": "49152:5qRNyRu8ApfFrb/TkvO90d7HjmAFd4A64nsfJIF3PrqYgZm7RYm9F3yyD1:ANpfIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683190263, "uuid": "3190f3fe-1a66-4e17-bf5d-f2a8ed39c0e8", "value": 2228224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683190263, "uuid": "fb6b1e82-fa02-4244-8470-a79fb749be93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190263, "uuid": "f8f4a898-3fdd-4f37-9ee2-7fbc0373f0d0", "value": "2023-05-03_cc94e9ab396fef0d9ee7caa7e9d44b8c_lockbit", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e6c139-ea72-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683201180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683201180, "uuid": "3129b8bc-66c6-4230-a6d2-d84321f647ce", "comment": "Malware payload (AgentTesla)", "value": "2cf1bc4e8bb567307773de651dccff18", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683201180, "uuid": "2fd709d8-a200-4593-978e-aeabfa30a0ae", "comment": "Malware payload (AgentTesla)", "value": "5ad812cb5f8de1cf00232dad670e6d0711e198d8e97ade700fb7d8d1819e8570", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683201180, "uuid": "6edc5d21-808b-4d63-a258-3cf4cc23a2ef", "comment": "Malware payload (AgentTesla)", "value": "898460e54dc4a9799f094bfaf99f8a99eb43876f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683201180, "uuid": "f299bf07-3d3d-4f29-be83-7a601f5d1656", "comment": "Malware payload (AgentTesla)", "value": "dca2cd7c8aa45a8502525ede0477dd8a4657735afd360a2474823c3d79cfa3e86e01dc0e49cc87bdb75a1ac6904c4214", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683201180, "uuid": "1da2499c-1ff9-4561-898a-9f75f90c525c", "value": "T136C41294517B76FACD8D93BF0964249943717083A129FB7CA7E049898D02F83FF452AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683201180, "uuid": "9572816c-2383-4ffa-b7e2-19287234e7f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683201180, "uuid": "1f1a6b81-3ba3-4c41-8cc0-f68dcacdf68a", "value": "12288:7eiamOX0qMYK0O0+yDG1MkHr6VTgEOPtepFP0CG:7eiG0qvhQMkSOPCG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683201180, "uuid": "87570490-54d4-43e8-a637-a87e3732acdb", "value": 564736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683201180, "uuid": "da5680ff-6563-4d44-914e-0dd02bb93173", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683201180, "uuid": "71fd492b-a831-4960-be8e-325e343ded93", "value": "5ad812cb5f8de1cf00232dad670e6d0711e198d8e97ade700fb7d8d1819e8570", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81628c97-ea53-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683187989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187989, "uuid": "e0f42924-30f9-4268-8ec7-4d78eb63d0aa", "comment": "Malware payload (Mirai)", "value": "40d778472b4830fc627938d872d45400", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187989, "uuid": "8676029c-33fc-438b-b0ce-65f0e904b75b", "comment": "Malware payload (Mirai)", "value": "5cd26decce9e6189f4ddfe80ed1d879a9346cc7b0ddb61d537690e7f27611421", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187989, "uuid": "88e9dd12-1867-427b-8b5a-6a6572cf6f69", "comment": "Malware payload (Mirai)", "value": "66da2c46d1a4993a01f00d0988f7a602114f7905", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187989, "uuid": "c2b212fd-8266-4f47-bb37-cac8a0100797", "comment": "Malware payload (Mirai)", "value": "f1bcd8cb7a654941dc43b10a5df359f26d5b7ae5663d6dd18198e1f9a29568c97f46986aa4a3b12df4cd22e79a1b1947", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187989, "uuid": "de89db58-c275-418b-91f8-a01d67bc9b36", "value": "T1D1E33A56FB804F13C0D61776BAAF4249332397E493EB730699187FB43F8669A0E53905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187989, "uuid": "6ec63d8a-11d7-4d41-9c7b-8c323a85c740", "value": "3072:7VtbLMtwV+6AaITWSn80DOGoCXk95uwbZnICXi0KM/9eDyIC:7VtbQuxAaITWSn8+OG+juwRICXi5M/9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187989, "uuid": "e05759c9-1f55-4275-bf5b-394cada4d243", "value": 154968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187989, "uuid": "7d8ad8c0-37ec-4bdb-a084-3ee53aba5578", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187989, "uuid": "e7a4c16c-a628-491c-89a4-80fa26ef7a8d", "value": "40d778472b4830fc627938d872d45400", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6356c159-ea4a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683184073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184073, "uuid": "ffe1fa85-5ecb-4591-b63b-8691195d4e06", "comment": "Malware payload (Mirai)", "value": "924e4d00fd97ad6e45d741ae93a63fef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184073, "uuid": "77dccb1b-1405-4d37-abc2-cf6e6c9f3a05", "comment": "Malware payload (Mirai)", "value": "5dd4f599ffd4a17237f4f2b9f53b166cb968482a4c81cd65318d47f9398cd53b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184073, "uuid": "200c88e9-a620-414b-b642-7356271d03be", "comment": "Malware payload (Mirai)", "value": "778192c647195b16d6636ec013128623d82e2792", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184073, "uuid": "0f7e2fe0-4701-42bb-845c-089b0da09cfa", "comment": "Malware payload (Mirai)", "value": "493383e414468abda87626dc4392859f29deef91dcc7190f383fe01d9f40f3def90f5f5eb90804b182ef6617b31d5ec7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184073, "uuid": "737bd222-58af-43da-8620-6603a664aa00", "value": "T1FAE33B3B77130D23C084587212E72331AAB6DFAA38FA52D7E9903DA46F35A453526FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184073, "uuid": "4452873c-0221-405c-85bf-2ee34878b4f7", "value": "3072:UfMxjLvRNPvW/6utJ8a+PQ4KQOhsljJ/G7GIdQ4dGgg55W:UUxRl9utJ8a+PQ46kpG7GIdQ4Ygg55W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683184073, "uuid": "c6ce2d1d-2396-4d9d-8312-657828445148", "value": 145721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683184073, "uuid": "faf479c1-a393-4dae-954e-67e9a4d969bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184073, "uuid": "622e8da5-63de-4631-9eac-e0b345e9340b", "value": "924e4d00fd97ad6e45d741ae93a63fef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "248f2c05-ea6e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683199429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199429, "uuid": "18244698-6136-4cfd-bccb-e12132a06b81", "comment": "Malware payload (AsyncRAT)", "value": "d75f7d1dc90065f8e4b97fb7c665a8bb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199429, "uuid": "301182d0-803d-409b-a561-e4342399108a", "comment": "Malware payload (AsyncRAT)", "value": "5deb8c21c15aa3ef2d65c0f10115264b2239d41ff654d35858c4da7ad03488db", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199429, "uuid": "120a6ea9-64c8-47d1-97e5-169337f955ba", "comment": "Malware payload (AsyncRAT)", "value": "b95c588cd073a4260c124dbb75c2103df5fb457e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199429, "uuid": "5120cfde-4941-4e1e-9072-75d8814068e0", "comment": "Malware payload (AsyncRAT)", "value": "4ada627ed64511f8ead25f7fbe69660243e609e0e55aec2b5a97eaa3fb628da5246a180ff018c4405de360421de94297", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199429, "uuid": "850ae035-142a-47ed-bc7d-041fe39b2568", "value": "T136F0629941A9FC7BC04383B9C020A89875704468F1F822C43B143CF0AA0F840CF027C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199429, "uuid": "731859ee-d831-40fe-bdda-fda068160dd0", "value": "12:5jnGN28AlMqHrzavr9pbpRAPKXHaaF1ZWtn6jJay:9nGA8AmqHgp1iShF3WcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683199429, "uuid": "e2bce28e-4a0d-4d97-848f-3e9ffc787185", "value": 652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683199429, "uuid": "c0045264-1b63-46c0-a6c5-201575ecf1b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199429, "uuid": "ee070126-fed8-4c2a-b219-0beeeb48c4f0", "value": "Confirmation_188843.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c0daceb-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683193939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683193939, "uuid": "868086e0-a5cc-4b5f-872d-fe95d8918027", "comment": "Malware payload (Formbook)", "value": "126cd08ecd39914c6da0bf8f61aaa77e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683193939, "uuid": "36898b57-8aa0-492c-86ff-93fb17ba3eb7", "comment": "Malware payload (Formbook)", "value": "5ee38155e7087564728f85feed6640ef1db1dc0fbd1d86afa1d37b1b2c7c7f71", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683193939, "uuid": "54a7af7b-34ef-4438-8151-d0022f9613f6", "comment": "Malware payload (Formbook)", "value": "40e2ebc37ad4a09646b9c863108fd50bc4fff1dd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683193939, "uuid": "52b65ac9-48c5-4d65-b897-d495ea5cd411", "comment": "Malware payload (Formbook)", "value": "b98aa4f7c28bd832655ea42a0839a4b20b8a762def913d4606e24eb9c9cd7e601be907100d63fccf127885e11c3efb72", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683193939, "uuid": "85d811d7-7f4e-4196-bc59-c09649d4203d", "value": "T125B423BC8D2920CF9987D986DEA89BF587B88140BFD4CFBE818F7D194250F1D4251369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683193939, "uuid": "a46c1147-68d8-4344-aeb2-7d3bdd444ab3", "value": "12288:GgMb2uMitZlY45K1MBnCgYGPMeZOYfcYK2BmcalrL0NPjWMX:GrZVq4TMuOJY9BmcKrL0Mg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683193939, "uuid": "ca7100d3-6193-47ba-881c-1b4848fe538b", "value": 535709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683193939, "uuid": "72854630-b8bc-4f6a-a48b-8b6ae424db78", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683193939, "uuid": "061b0f20-0cae-4bf3-9c60-9204ecbb2ec6", "value": "Inv_7623980.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6acb7fa7-ea52-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683187521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187521, "uuid": "deef89a4-bbaa-4503-81dd-9bff436693b8", "comment": "Malware payload (RedLineStealer)", "value": "2faf5c99c08a80a6a99b8dc5a7d5a245", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187521, "uuid": "06c90967-b8d2-4313-8a30-a350d10d43de", "comment": "Malware payload (RedLineStealer)", "value": "6090eb8f5914eeeeb26c98b0fa99516111e76bd13cc22ea9b9a125c5d03f020e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187521, "uuid": "017cfad8-ed2b-4ce5-814d-6041b5ab059d", "comment": "Malware payload (RedLineStealer)", "value": "e1b83ea96120ea61a6b78756e8251e4e830f636d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187521, "uuid": "92cf72fb-5d7b-485e-a2ff-9ef80d7ce370", "comment": "Malware payload (RedLineStealer)", "value": "d9c090c5a8f75b12015e16c3bb725d47103680d9601eaf6dbf55306614205f451ca59ba34bc647375278de0d6e0af4f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187521, "uuid": "f96fbaca-8f3f-49b3-b2f6-2095772d2165", "value": "T156A40203B7D890B2DCB527B05CF703C30A36BCA25A7887672659AC5B5C726D4A435727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187521, "uuid": "a59b4552-290f-4966-927f-cf7a83bc22fd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187521, "uuid": "3310958d-2527-42bd-a864-c57d635a276e", "value": "6144:Kwy+bnr+mp0yN90QEkOci+h3bv7VWht8nz5LIgRvWgBt/ip+YDYhVJFdMvWLOAZD:kMrmy90+bhrv7W864t/pLJFdxCEvyNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187521, "uuid": "4927f80b-4e01-4f79-b486-2ddbc48ea894", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187521, "uuid": "0a1652be-b77d-4266-bf8f-1d614539e19c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187521, "uuid": "f5cf0a5d-b241-4242-bb5a-f0a6e746d554", "value": "2faf5c99c08a80a6a99b8dc5a7d5a245.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c71cf421-ea92-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683215164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683215164, "uuid": "86eac8a6-5f9d-4ac1-8dcb-cf3217508db8", "comment": "Malware payload (RedLineStealer)", "value": "4d3ebad51b0e5436458bf2b20fad0eb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683215164, "uuid": "fabbc098-ed2d-468b-a828-c623a9c969e0", "comment": "Malware payload (RedLineStealer)", "value": "60d6596e7b9b32eaf424ffd3a2f6a8445b1ebc5ec18b404a9f7c31f238c63357", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683215164, "uuid": "3297ffdf-c910-4c2a-b34f-d78e2ef3d96d", "comment": "Malware payload (RedLineStealer)", "value": "84ab7892c6b285b69a34761f2c1aee2013456404", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683215164, "uuid": "ddd7d8c3-2ad4-4599-9af6-4d2670eabc21", "comment": "Malware payload (RedLineStealer)", "value": "867d5059cb8cb78863d90db3298afb43ef764504a5319036ea7688a726e847ce960d9595f3274c5ebaaedab2e2a72716", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683215164, "uuid": "a4635fe6-8020-44ef-b1a9-3ea6904ede24", "value": "T1D2552303B5D89473E9722BB158F647C32A3EBDA18E7443A233559D6C0DB26C0993637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683215164, "uuid": "8a06c928-791b-4904-830f-6d158143ea13", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683215164, "uuid": "590e0ddc-e67d-4d09-84f3-7a65f7bd9682", "value": "24576:uyrlTRRjfX3l00UQEHXTnwu7h8qCSiXzHckrI+Gp21io5dqur:95TvX33UQQXTw6h8ZSiXwkrI+N155d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683215164, "uuid": "ce107805-a4d2-4b5c-ba8f-9f70cc89f6fc", "value": 1331712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683215164, "uuid": "48d71c9b-4357-40e4-b9e5-40bf40226114", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683215164, "uuid": "a3c091fa-473c-43d7-8a74-677bdde0eb6a", "value": "4d3ebad51b0e5436458bf2b20fad0eb3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8708d582-ea49-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683183703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183703, "uuid": "a619e1fd-dac9-465d-98b5-5f8942c83bcf", "comment": "Malware payload", "value": "367f86f73cb5057f3a03fa5c0c0756aa", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183703, "uuid": "9485ceae-65dd-479b-af95-ad3ede3c975c", "comment": "Malware payload", "value": "6170703403330b1a3f0c586be0a214ee9fd69e4eeadc01b7c85de253d62b4660", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183703, "uuid": "4bba981d-da91-4aad-a76e-d9642d666e66", "comment": "Malware payload", "value": "9371f61e19029e8804d94ef69946fa160e628e61", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183703, "uuid": "bf74af2e-42ee-477e-9c5b-0291a5305bff", "comment": "Malware payload", "value": "4e6e0c9d47589f0b66be95366b5100fa2e03a750af6515a0a33081bd94723583424638c801e9dc8e9b75f2c51990764c", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183703, "uuid": "3f0eec9d-7553-4204-af6a-f6200be6f3f8", "value": "T1DE7533289465EDE3D228346A13B3BF2E894FFED06C54B41EBDD6641971B336C9C421A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183703, "uuid": "be9f3e35-7a7d-45fc-a28d-3c7a7b6f566d", "value": "49152:0YPclm633TfBRafcLgnZNwCjuzcj4KzG642YOp:08CTf3OnZmCjuALG648", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683183703, "uuid": "8dd8ddc8-df61-48ed-b945-5eec0961cfe4", "value": 1594081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683183703, "uuid": "86152626-6568-44d0-96c3-133051478bc9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183703, "uuid": "6a2b83c5-ebe8-468f-8d23-d1d6e739594d", "value": "RFQ#7386A-04192024-NEW_SAMPLES_ORDER.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10161685-ea52-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683187369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187369, "uuid": "e1304c80-45e2-445c-8569-f2d01460f25d", "comment": "Malware payload (Mirai)", "value": "f62f0babc0812253b2321587759fb4a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187369, "uuid": "58d4a01b-2edf-4046-a723-b3af33377bbf", "comment": "Malware payload (Mirai)", "value": "618db789fb26145d1d93131753e510cffbdda8c76acf41d07dd6a09a9f641996", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187369, "uuid": "d5c52e8f-47ef-4aa5-bc9f-eaab73d251d6", "comment": "Malware payload (Mirai)", "value": "889b47ad108123fb28ee960d579655ca9f161675", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187369, "uuid": "573f8ac6-90da-49dc-8a45-581a840ca285", "comment": "Malware payload (Mirai)", "value": "05004e8c558635a4903ece1d6f4540bdf821c277fb2b90ceb2724f4312898ec5f41644a5442096a8cc9810a74182ff46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187369, "uuid": "cd436914-4625-4514-b0d5-848edd8856dd", "value": "T136634A31BA761E17C0C5903A21F74B15B6F143CA25A8C72E7DB21E8EFF24A406547AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187369, "uuid": "5b8cf5c1-6da2-47d4-9804-a0ca0a790db4", "value": "1536:Yh7dkfulnDRXXarjIQ6M+1e575Stw3wbZn2x:EPM4U5Vz3wbZn2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187369, "uuid": "a6cafb8a-b9c6-4c4f-9bb0-5f6addedb298", "value": 70480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187369, "uuid": "40e7fb13-40b1-49b8-b7f3-3118601d0ec9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187369, "uuid": "23d30654-1df5-48d2-be14-d09ba7d6cfe9", "value": "f62f0babc0812253b2321587759fb4a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042a8198-ea58-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683189926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189926, "uuid": "9e86d60e-5dd6-4a82-a6c5-100799b6c083", "comment": "Malware payload (RedLineStealer)", "value": "898eed5b62b80060f62d7c09840128fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189926, "uuid": "e1e5167c-fab3-4734-b2f4-c765475c9d33", "comment": "Malware payload (RedLineStealer)", "value": "61ee174e927ec0c511898bf039be953745ec7a239f443bc468f7b1d0a635fe2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189926, "uuid": "77d4c472-2ba3-44fc-8e91-5d606c69b1ae", "comment": "Malware payload (RedLineStealer)", "value": "63db1401af2d3d634ae291ac718ce327d611b5b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189926, "uuid": "93e0e6b5-d419-4936-af21-e52fb5ca130a", "comment": "Malware payload (RedLineStealer)", "value": "c0dfa7a5f9978e2098fca9cc664147d40eff6fece8cb89a4c07029a4bc8748f6caef54a2190db22521b5e8c3d485b210", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189926, "uuid": "8fe9a4d5-1e5e-4bae-b5af-bdad39705a9a", "value": "T115D41207FBD98032E8B017B01CF717D30736BCB19D28439B62A5B54A4D32A94A57673B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189926, "uuid": "82ac7cdc-8f77-4157-a74f-5d73089b7d8b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189926, "uuid": "1a1d5529-b0cd-4b8e-9d2b-aa0d3aed46b7", "value": "12288:mMrXy90iORPxJHdh95WoUfzGz6bNo700p6wLZ2kQBfzpfTNwrkgFP:hydOh7fWTGzLI0p6wV2kQB7pb2rJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683189926, "uuid": "4bfa7d37-312a-497d-8ff9-89ab01f761b1", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683189926, "uuid": "9d60d044-2e58-43ac-a5b3-fecfec6c0744", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189926, "uuid": "13dffea3-0f74-4a16-979c-6db504de2321", "value": "898eed5b62b80060f62d7c09840128fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1a08c4-eabc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683233136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683233136, "uuid": "c397653d-4d32-4242-9503-b2c901ed9d93", "comment": "Malware payload (RedLineStealer)", "value": "e4ce5f14e6bc941da89dc4683429df85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683233136, "uuid": "d2e5cf1a-9756-455e-8b19-e3ab02c82464", "comment": "Malware payload (RedLineStealer)", "value": "62b8e050c3a1936868f8a41f0cf8b0c89645791cb8a56c5c2080f4cd54dbf4e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683233136, "uuid": "d1e5531a-8d9f-4f64-beb7-981c4707c3f4", "comment": "Malware payload (RedLineStealer)", "value": "183c715b2348a606b47e524e90ebc7a0dd40d0e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683233136, "uuid": "396075f6-ae97-43e8-bb1a-6da5af97ef86", "comment": "Malware payload (RedLineStealer)", "value": "e150b13168b2b6bce93fbe7d99381f291389794b2af7267312c90d26ff8ea69415339d57258f31fb8f1e5f6e8b36a7df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683233136, "uuid": "66a49ef6-9755-4b29-8391-253f518bfa21", "value": "T14C84F102F7D84032DCB527B158FB07E31A3ABDA05D7883AB36466C4A0D735D4A93676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683233136, "uuid": "cbf54273-4c74-4e17-8748-37accabf9057", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683233136, "uuid": "36a12171-468f-46e6-860b-064b464accdc", "value": "6144:Kxy+bnr+/p0yN90QETupmqTWXR+herLa/QzMNW3/gknZ2AlPgC4qU0nKXcTxqR9t:3MrXy900sE65zMego2EYqzKMdC9Yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683233136, "uuid": "72e41968-6dbb-49ab-91e3-bcb52d613570", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683233136, "uuid": "1b3326ec-3fbc-41ad-86da-e1dcfc10d638", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683233136, "uuid": "2a6f9ae8-e168-4888-8213-bde64702c2b5", "value": "e4ce5f14e6bc941da89dc4683429df85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3cbbf5-ea49-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683183690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183690, "uuid": "7ee5e7be-d594-4690-9e90-ffc87eac37f0", "comment": "Malware payload (AsyncRAT)", "value": "8cb765d169bbf336e6ff6e37d79907fa", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183690, "uuid": "d1d89277-489d-48ff-b1a6-6c4520fa23bf", "comment": "Malware payload (AsyncRAT)", "value": "631617f4c253065450764e9bff542db6b274f7d7c444786ec6e54584e8ee4cf6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183690, "uuid": "bf9695d3-1e3a-438c-8e51-b76bc858648c", "comment": "Malware payload (AsyncRAT)", "value": "89a82b09297e98824199145f344fad2797dd79b7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183690, "uuid": "393ecc07-fe48-4190-9c14-fda6e36b2634", "comment": "Malware payload (AsyncRAT)", "value": "e17c6792c84f1ebbe6df5e86b1d95bc85f4a8c75c6ca5bbb8c9063654bd5a8b69d8a84ad315f96368f7e71d85246fbd8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183690, "uuid": "0bd7eb0f-4479-4bef-b0fa-680e79af0702", "value": "T1FC451242EAFE87F2E5331D34093BA711997C78170E24D47FB3888B6E99701429525BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183690, "uuid": "407501be-f8fe-4023-a22c-833a56d37939", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183690, "uuid": "e0bc26af-811f-432d-a650-95e8b7364645", "value": "24576:wNA3R5drXKDZHBBzNuJ/JAaz2uTeEhJeS7ncKYALYndP7vJHYrJdN:p5IF3N2NPXJR7ncKmRJYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683183690, "uuid": "49624926-66a3-4333-90f9-7a5e0cbebf3f", "value": 1264270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683183690, "uuid": "b9711d66-defc-4e6f-bcda-7a9df376d83e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183690, "uuid": "3c7a5703-ceeb-4f5a-ba96-ec935fe5ab01", "value": "532023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b8e4f80-eaac-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683226231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683226231, "uuid": "9779777f-46f4-454b-9b1c-bf4ca0b8cedf", "comment": "Malware payload (RedLineStealer)", "value": "82e1030854c8e2ecf4231e721c1ce289", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683226231, "uuid": "6ab54a66-c2b6-413a-8626-c37193cd8b8e", "comment": "Malware payload (RedLineStealer)", "value": "63307ab8eac410ceb0a80959e4bb21f364a930b17d84564d4ec73348cbfb469c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683226231, "uuid": "fa36e2b9-8a4d-44b6-ab7a-59f8b1062755", "comment": "Malware payload (RedLineStealer)", "value": "8682308137894e241d6062bf526faaa33fc012e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683226231, "uuid": "5e3576dc-71db-49bf-8bcd-d41ee22792bb", "comment": "Malware payload (RedLineStealer)", "value": "c3bd4a63abf01c283b4222cd0e0fda23013ba0211d14089141ae1ba8b093ba40714a9ee6498b6d2318781fcb6f1bc5db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683226231, "uuid": "95e0870a-3927-4244-aab0-edf4856d87f0", "value": "T1E5A40263A7E98572C9B127B458F703C30B377CB5697C436B6241899A2CB2684AD3173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683226231, "uuid": "2da9c3cc-9072-41f7-8e27-ecc92aca8c7c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683226231, "uuid": "ca1435cb-060d-4fc5-8d9f-0f01bb8d7699", "value": "12288:MMrXy90N9pVbdz08uZiaSsTgaA0byjKkWDw:zyyV5zeZid5aLkt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683226231, "uuid": "52144295-a194-44f2-a614-a85e907460b4", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683226231, "uuid": "843d6d48-2720-4ab6-ad90-05210a7acb57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683226231, "uuid": "2ba0e22c-8f07-4d31-a371-6a6c4abcd5c8", "value": "82e1030854c8e2ecf4231e721c1ce289.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9734da45-ea53-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683188025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188025, "uuid": "48b5bd71-d4f9-47f1-b085-144d8f4df583", "comment": "Malware payload (Mirai)", "value": "2e3a3065986e9e7827cdf19c11a21095", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188025, "uuid": "55ec2748-ca7d-403d-8e8e-de50d270ee46", "comment": "Malware payload (Mirai)", "value": "63b382743eaacfbd89cccd96d1a14a475008f95c4487530f6547a779fc3261cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188025, "uuid": "eb19c44e-cd24-439e-bc87-a4c07f722b06", "comment": "Malware payload (Mirai)", "value": "df33a2efc03842342ad77f9460e881dc83f1aa11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188025, "uuid": "c6ed4e4e-b837-474e-b631-ee170a56f249", "comment": "Malware payload (Mirai)", "value": "0cd1244c581910c96ab5a61ba267caff49ffa2ce556d48f7e3708024d1e7c58e3e42f9f7b931e0ee255b0d7800cc2ad9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188025, "uuid": "9b79b540-d2b1-42e9-8088-9cdc1305e68f", "value": "T1DD830A41FD418B57C2C327BAF79F435D37356A6497DB33016A386EB42BC67982E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188025, "uuid": "d98d6b27-82b2-4e7f-a763-3d874b99f9f9", "value": "1536:2TxGIBAIxQJ8x5OEVBvFB3n1n8OYSUmZhBQ4Kb3RXFFj:WBa8hBb3F8OY5mZhBQ4KjRXFFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683188025, "uuid": "6e870a89-f40b-4680-82d5-4ea1dc9c01ae", "value": 85249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683188025, "uuid": "b594e275-9905-4d28-99d7-d599eb7addd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188025, "uuid": "e06bdb1a-d662-4c9c-9cce-e5a7cef6bb90", "value": "2e3a3065986e9e7827cdf19c11a21095", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94fb0f65-ea83-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683208637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208637, "uuid": "1fbbdc52-b408-4734-af22-91dd9d10b131", "comment": "Malware payload (RemcosRAT)", "value": "2ef95efdbedb353a82497ab63aa39067", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208637, "uuid": "3411eb80-9fe2-4d44-85bd-04234a3b5374", "comment": "Malware payload (RemcosRAT)", "value": "6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208637, "uuid": "15179d2d-6ce6-47ae-b784-cea0f049b95d", "comment": "Malware payload (RemcosRAT)", "value": "a7784438c0ca3e37d63fc409435f6a5e96f73f41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208637, "uuid": "38ddee83-ceb3-4696-96e2-603679f81954", "comment": "Malware payload (RemcosRAT)", "value": "3665f7f03dd36e901e5361c26e702d9a81ea749425c1b1279f876628cb54c340d612cd41964ee3a61082c13c620eadea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208637, "uuid": "e70f552c-e39a-491f-83ab-36e2f92281ab", "value": "T11EE3B640F348D896D55B29B3586FC670127ABE9E9175CB0E35C6B6294CF3302206BE9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208637, "uuid": "49cdb171-0784-4085-9a03-eafce7287c91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208637, "uuid": "da0aecf8-328c-4dce-b392-6a14b9b30f46", "value": "3072:X3gonQnBpzMo4JPj5hMVXUgbRZlIwTqeq+3r7E4sf65NiJtmghrOy7BCRIVCNfD0:nDnyMVIZLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683208637, "uuid": "d1e35b87-d113-4e7e-9481-93b96fd3170c", "value": 148480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683208637, "uuid": "d5798fe3-9b3a-437d-b77f-2a96171836f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208637, "uuid": "0f436209-d735-4c79-8fb7-65f7482c32cb", "value": "6432e96629806652156594eb8c7c5af3cc397dc7b5d871787db5be71ff6cdd1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c45ebd01-ea75-11ed-b3cf-42010a9c0076", "comment": "Malware payload (BluStealer)", "timestamp": 1683202704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202704, "uuid": "a7cfa46f-0660-40e2-afde-af0da865ef24", "comment": "Malware payload (BluStealer)", "value": "348bfc0c42d7254bc63e482c4173fea8", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202704, "uuid": "39e95f79-060c-46ce-9fed-dcbd1ee88f6b", "comment": "Malware payload (BluStealer)", "value": "66190693a0bc90c29db018f37585b54fe7a3d42bfb01dbfcdee7567f37e7f8c8", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202704, "uuid": "827441d8-de84-433e-a6e1-711b7f78ff9f", "comment": "Malware payload (BluStealer)", "value": "ef6a18df4c2d04c6c194c5cd959e714114a402ab", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202704, "uuid": "bf110cfc-1392-4b03-8b3e-b02a703226fb", "comment": "Malware payload (BluStealer)", "value": "a7d5ee5142e7cda70c57723ec10a01c712e9af69d2922e52062124da7bc4f583191f648fbb82287e3f79cf6428aea3c7", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202704, "uuid": "3e00031a-e7e3-4a6f-98ed-16b838c6a07c", "value": "T1056501935069C95FFE66DBB0C1B5FF59AAF1F07360D1D4241BB8218ACBA8F012D4C52A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202704, "uuid": "799cfbf7-e32c-48e7-844c-2284d7943033", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202704, "uuid": "a77334e7-e9d7-4ebf-a9e8-a6bed6f521b6", "value": "24576:+3y9ZjI1Uw2ojP1WQ4C8KJ/Ixl2KVpLNzwOKb3uR/kCrVKoNZXgUFqssP:B9Z0xWQTJ/uAWp53R/k+VdQW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683202704, "uuid": "a9eb2ea6-7ae4-4c8e-8c22-884a91a773ef", "value": 1517568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683202704, "uuid": "6812d5e1-1c0a-4eba-87ad-d71aacdfc403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202704, "uuid": "376f4288-8e66-417a-b5de-f58465ab085b", "value": "Purchase Order 202319876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5172f25-ea49-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683183807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183807, "uuid": "25fd3943-ccba-4972-8dd9-9ef3a11ce449", "comment": "Malware payload (Gafgyt)", "value": "e85d50d80c33c2ab89605afaac880d21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183807, "uuid": "6f0838b8-c714-4fe5-85b8-b2b167747d26", "comment": "Malware payload (Gafgyt)", "value": "66ce717ac3bd6d19ace02f2135152b70ff93cbf59945782e2190902e72de0282", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183807, "uuid": "e0189c47-2f08-451d-9087-1d73616bee80", "comment": "Malware payload (Gafgyt)", "value": "b511515245b730a0138ae04c259febf341e4a858", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183807, "uuid": "eb30291a-a527-4cc0-8489-9853c04976a5", "comment": "Malware payload (Gafgyt)", "value": "c8e70deeaa831d28a80e6796cf007af63642e285657e33a1210a40e65a68c70480c44a186c95428f19d1384d84b58574", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183807, "uuid": "8549568a-9346-42eb-bfec-998c4f6f08a0", "value": "T14C03F2AFC37A1771F19E6B77392513997AF7B6E23F024162ACC46D1149739A827E1800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183807, "uuid": "50cbf989-3494-4e58-b288-175ee5fb32de", "value": "768:cSAuvf4Kb+MqPjPidqaKOzGdPR4kqh6ypC0sPXrwP52BkWy:jAun7/qbPis4kuUJ5fURfWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683183807, "uuid": "261bc57b-a01b-4360-82a3-590c539d6028", "value": 40392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683183807, "uuid": "8f34fa7a-e407-435e-82c5-2909502cf148", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183807, "uuid": "0c1f3d08-4064-4662-b487-5c762f49f72b", "value": "x-8.6-.qpwoei102i47fn6v8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b424a50f-ea5f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683193228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683193228, "uuid": "ab5e8196-9b47-428f-a970-6c23726a61d2", "comment": "Malware payload (Amadey)", "value": "1215363ab33e4388037979cc4d051ce5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683193228, "uuid": "3e29049d-7649-4cf0-be0d-88bd2e8ba09c", "comment": "Malware payload (Amadey)", "value": "6755c42c0b84482aed1334a662b8f834e16272a7330c5910b0f22c1d56828568", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683193228, "uuid": "f536f7d9-92b8-4968-ab1e-bd31ba5ea3af", "comment": "Malware payload (Amadey)", "value": "a96597ad5156e6c92d7e9098bfc7e279e612b366", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683193228, "uuid": "805e522b-5a3b-464d-849f-4c2c5d4f5ee0", "comment": "Malware payload (Amadey)", "value": "f4cec85dadcd57d908849e59369577312ba025ef9ab496122ef2322e889b0b4a3978f23af9025c1475b7402482373a51", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683193228, "uuid": "49b71906-1190-49c0-9ecb-39cea265f709", "value": "T1B2D40257A7E85832D87417B208F607C70B35BC736938969B2394ED9E0CB3AD19532B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683193228, "uuid": "d8fd94dd-0f2d-433e-a7fb-24c017534f77", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683193228, "uuid": "b26b1bad-a466-4fa4-8fdb-25395a686987", "value": "12288:NMr6y90ublr+lkJfRLPQxgetlcrwbGVGWxF2L:DylKRFtDGVGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683193228, "uuid": "b7184fd5-444a-4a82-a069-09a5265f5948", "value": 616960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683193228, "uuid": "10abb63e-87cd-4744-b6cd-40bdba8e6e3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683193228, "uuid": "f382ef76-5845-4a46-9207-691aabbfd4ae", "value": "1215363ab33e4388037979cc4d051ce5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b2c164-ea76-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683203052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683203052, "uuid": "5892fb51-cdd5-48d2-ab84-c9a48496ef9a", "comment": "Malware payload", "value": "686de24acfa700d4cde2ad67896c2c4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683203052, "uuid": "98ab290a-e6cd-4289-9022-6fc9224ddaf9", "comment": "Malware payload", "value": "67eaee66522dc72cb0e8d9722f0fe531fa9ed1634cf26cf2467519fc4b6defc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683203052, "uuid": "8c18595d-f9aa-4deb-b239-11ed532abc6e", "comment": "Malware payload", "value": "040c7e6e8fb0027e176726b430617dd0a7986619", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683203052, "uuid": "2296280b-d307-4cd3-8b37-87cf9741a1d9", "comment": "Malware payload", "value": "7e629bc04fc03eb0bcde8b8e0201ab467af2088404bffedeb659eae16dcefe27c0db119beb37a1386b22537b7d654a2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683203052, "uuid": "dc3c7c1c-6e88-4546-95fb-4c37770ccd80", "value": "T18E444AED65DBD10BED3B98309EE87E50A3A324778EEBD3E44995B23078A05B2DC41417", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683203052, "uuid": "d68d7e35-530a-465d-b545-7de8db921595", "value": "071307373db47402e881a4d65e0a19ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683203052, "uuid": "9c0adec9-76ca-40cc-90d6-3c1ad9178141", "value": "3072:A2K5l9oT7tDdoMVyz7/3qTCPVLoKyzKJ68jtpiZByNJQDT48qhzgpWjd8mnxYY6K:2sDdh7TqLtBRpiLyXsz8pu16I2twK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683203052, "uuid": "c4aaca60-2a5e-456b-94ac-b93e6c11a3cd", "value": 262496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683203052, "uuid": "b2589b6c-ddf6-420b-98b6-0f0027050756", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683203052, "uuid": "119bf278-2375-4b24-ad27-aa64b660fc2d", "value": "67eaee66522dc72cb0e8d9722f0fe531fa9ed1634cf26cf2467519fc4b6defc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68d7cef-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683194145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194145, "uuid": "2b87544a-3b94-4c1a-96a0-557891e1efbb", "comment": "Malware payload", "value": "8936b41b898671a62bc1f80fecd748db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194145, "uuid": "72f9bbb9-9d81-4bbb-a9c0-e74409ffce67", "comment": "Malware payload", "value": "682fc859c6a24ee284bddddc1d2e3d1af32051dfc5d327ded68a45d899c9ede4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194145, "uuid": "ae9b470e-fbce-475d-8d64-af70d598460d", "comment": "Malware payload", "value": "436a31ed9fb3071d46c1d6d8dd46302255278034", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194145, "uuid": "3ad02a4b-f13a-4746-b5e8-dfdd01ffcc3e", "comment": "Malware payload", "value": "6b9ff025fd048637dfe39dc3c3a69d9e60095a47ed1213da93a6cc23723339156159d330222d88142ad7610a3d03d297", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194145, "uuid": "a49ab39b-e50f-4492-85a6-9b1b4e77a234", "value": "T163235A19D3C05AA2F064E730C1668BA4EA3E7A7090B65887FDDFE35A53039604B71DB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194145, "uuid": "c974b63f-7b29-47c5-82c9-a5e7404f29f9", "value": "192:CWtvSpWqf3z+dhG5Pr3lIRiCiT8/PejP00E8TqP3w878EcLQ8Du6hFnNMd4MX7xg:EWqv2Sj3KQXTDjt0wZt3XTnNMd487C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194145, "uuid": "7d40c577-72ef-4cbe-a7af-10b897ca3837", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194145, "uuid": "edb53e53-34e7-47c9-8e39-85dd9ea2c835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194145, "uuid": "dd826f77-cad5-4bdf-ab4f-7866a3035575", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.16784.9175", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56009120-eacc-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683239885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683239885, "uuid": "e24560f5-52fc-4bf9-926c-aa31b996b88b", "comment": "Malware payload (RedLineStealer)", "value": "1f87186feaec8a36881e8e04fab07ced", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683239885, "uuid": "4f216fb4-6963-494b-bfeb-f92143ee0a53", "comment": "Malware payload (RedLineStealer)", "value": "686ccd58ec8dac51b7761795b220121ff120a841fab978f0f4405da6d36934c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683239885, "uuid": "6e3b602e-2460-4d55-8af7-6b505b0ef1ff", "comment": "Malware payload (RedLineStealer)", "value": "eb623a4e75f3ee90b5ab2100f145e72a3829111d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683239885, "uuid": "96805070-869e-4277-a555-8aa79971e2eb", "comment": "Malware payload (RedLineStealer)", "value": "ba0df1ee97c141f608d90d0ee322b90e235e7bf98ffb09826fff141a4c4e701eda6e84cb9c4221aea0491d8e21ed7841", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683239885, "uuid": "6b8418d7-5a98-4a85-8dc0-7c9c47b38467", "value": "T112840253EAD85833E9B127B068F713830F36BCA15978436727856C5A0DB36C5A87273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683239885, "uuid": "265780a5-61ee-427c-a8ef-5676687a5db0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683239885, "uuid": "6e205a91-7ca2-4af8-8fc9-12d4ff5c7747", "value": "6144:KWy+bnr+gp0yN90QEq6N9OJOae195QwFbVR3DbATMNjAW1NfT:GMr8y909NmY1FbVtDkTMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683239885, "uuid": "e8ce9d01-b5bf-47bf-9b59-0d0cb6719adb", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683239885, "uuid": "51b351a0-40b6-4820-b11b-2d63e5813ca1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683239885, "uuid": "aae88475-1dad-4bd9-b232-211b91f4afc3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d65dca0-ea49-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683183687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183687, "uuid": "ad62efbe-0704-48b6-9bed-1cf57e452fea", "comment": "Malware payload (AgentTesla)", "value": "0af77abd30dcc295e73d0062b8f9b5c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183687, "uuid": "87a7b3cc-7346-4097-b02f-a40242db460b", "comment": "Malware payload (AgentTesla)", "value": "6883bb5084322a842f7c83e4d05a7738f1b4dd61d08fe7f9e7bf9beea0f09f2b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183687, "uuid": "c78fae8b-11c6-454e-957c-8d81448422bc", "comment": "Malware payload (AgentTesla)", "value": "a8772bb2d72776ea4793269874d6081360ef1a05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183687, "uuid": "5ffc9748-9fa6-4ab9-9710-82bd34515b49", "comment": "Malware payload (AgentTesla)", "value": "a133e5b4f34d9d5f635d7d71c9db4c2e4cb7b96d6c4c27f5d80d7b80de5e6319fe6e3e4ea0887665cea90745b00ce3ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183687, "uuid": "b10a1436-eaf3-44a8-9686-30a311b2386f", "value": "T129C423742506BD0DE6C35FB86C4310701F2B769A73A6B4768B321730B9BAD52CA9BD70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183687, "uuid": "c428d211-a9ee-4287-9046-9d31141bce73", "value": "12288:GTprmDOG5/LblZyo3JM0C9k9GlCH2fowsPp8Dm4V7tSg:OmDOM/LJZLgk9Gl82rsPp8DtVsg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683183687, "uuid": "42635258-a517-479e-8153-46b753da8967", "value": 586010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683183687, "uuid": "716e35cc-03a2-4735-8ce5-8ad6d7341127", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183687, "uuid": "e03cf1bb-a116-470a-a49f-3a77b34d2f28", "value": "0382635263526532.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59893045-ea49-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1683183627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183627, "uuid": "da78b793-f294-4e54-93ec-f03c8ea28425", "comment": "Malware payload (NanoCore)", "value": "5bc13e5c50c4e4ca3a73c3a2c1b39a87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183627, "uuid": "20117a93-0e19-48c9-a865-2d87cd570f8e", "comment": "Malware payload (NanoCore)", "value": "68cc1de45ab76bcfad4953892e3fa1bdafb6c437d98101308c27607437898cd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183627, "uuid": "0bb9e72b-d003-4a4e-bc67-40899fcf0885", "comment": "Malware payload (NanoCore)", "value": "a5c476f5998e62513a71728abe06cfcb8a42dad2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183627, "uuid": "0fe698df-123a-46d0-a036-3d21f89976e2", "comment": "Malware payload (NanoCore)", "value": "9dbf33cbb1cc6c71772193c0a594352f62f7b1803269eb7ac5127cd1894814da933258e1b0b6cbb329a12c641b5d1e1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183627, "uuid": "4c12dc4f-78ee-4e90-a7aa-7afa683cef3b", "value": "T15964228413F0C5A7F46949B23F764B119F9ADF22378CD52B2784B6D8340EA425B4EB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183627, "uuid": "4afc2fbf-2274-4915-b1d3-33510488253d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183627, "uuid": "471cd41a-3b41-4be9-9d09-57ed8214408b", "value": "6144:/Ya6PJATBOUgUTl+G3iva+70h1+cUhyrDmBHGV2bmK2t1se7pQwLcJem32vGk:/YF8OUgUB+t/70hccUhJBmV2P2t2mCJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683183627, "uuid": "c94700fe-ccf5-4585-bf21-55be792d1c23", "value": 330329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683183627, "uuid": "66b027da-8646-4da0-adc1-9faa06759da5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183627, "uuid": "efcd0515-a12b-4b9b-b490-817e759bd944", "value": "Bank Details PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e167bd2-ea4a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683184037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184037, "uuid": "3d8c4aaf-b98e-4326-b468-beb9cedd6b24", "comment": "Malware payload (Mirai)", "value": "99a45bafcee029d93074c69ef375c15a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184037, "uuid": "4e296595-97f0-482a-bafa-2e1da39bbe79", "comment": "Malware payload (Mirai)", "value": "68d405c21b8d73bee2d3fdcbe4cab40c5596e9da9a0fbbb80cc6c918a90832b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184037, "uuid": "e7968f1c-c788-48ab-9936-ecdee6fc5a11", "comment": "Malware payload (Mirai)", "value": "ffa2136f25ba65c86037b35231ffafdc14bf1364", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184037, "uuid": "2909ddba-4f0d-4f9e-ba03-0310e65cb125", "comment": "Malware payload (Mirai)", "value": "f4217b518f1b9558d99d101d0248deadab004a2baa78fb3a9f5ec3511b4efcc804ef5fea4fcaf3985fd4c1d7b79fa3e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184037, "uuid": "f88ebcc8-c86f-4342-a954-a75e2eb1d75f", "value": "T1ACC31A1798214AB2C0019D7125A766200B53FEB74A8F26D6F92DB9B05B778CF712EFD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184037, "uuid": "6e23ea22-6cd0-4ef4-8431-200cf8eb0bee", "value": "3072:6pV0zwkRneFuei5UetJ8au49QuhsiCk5c2AFhItQtNGGg9TW:6pS0kMLiaetJ8au4l7j6FhItQtoGg9TW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683184037, "uuid": "8d2ccb6e-ec8c-4d2d-84fa-9e3f893cfa04", "value": 124790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683184037, "uuid": "c360cb13-dd8a-492e-b3b6-f58a34a1d004", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184037, "uuid": "77f604b1-bcc9-40a4-a42a-03f61780affc", "value": "99a45bafcee029d93074c69ef375c15a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4251ecbb-ea4a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683184017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184017, "uuid": "b3d0eb53-7aa6-4cd3-a26a-02c8e1ea2acb", "comment": "Malware payload (Mirai)", "value": "b7aefdd868cc7f04c7c765cc6197455b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184017, "uuid": "860eb55a-e7e8-4e6c-aa93-5d790f52a12e", "comment": "Malware payload (Mirai)", "value": "68fc4b52862b5abcf4e485a1bc4c9e9d626227d933064eda76fbe89c8369a1c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184017, "uuid": "0ec2343f-7748-46cd-80a0-4674dc669433", "comment": "Malware payload (Mirai)", "value": "22ee8cbe46340b507a19bf58b7319f89f8db04ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184017, "uuid": "9e4f709a-f32a-43de-b7b3-9349fd1934ea", "comment": "Malware payload (Mirai)", "value": "771a948b05b6841925d28afce7c75376eb5fc0d650991649fb17be073abe614fe0a433bc24e45f6ca66db730c0a7a549", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184017, "uuid": "f42ee6fd-0a7b-4b9c-b8b6-1728ac918fc7", "value": "T100D31967F801CE62F4099A3605D75B10B670EFB74E9321A2B61B3962AE312D63477FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184017, "uuid": "37756c3c-e5b3-4091-8bf2-61926dac700b", "value": "3072:0ulJur9GvG7T7/4irzTOHydzxpGRZgqr2mUDOChmfItQ2dGgg9SW:0mw9d3/4ir/MydVpGRZgqCOChmfItQ2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683184017, "uuid": "739abc2a-e384-4841-9eeb-1433cddf365b", "value": 136286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683184017, "uuid": "14e4ba38-24aa-45a4-864c-9fdc377edb0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184017, "uuid": "8da3982a-0d5c-47de-bca6-e79fb4d883c4", "value": "b7aefdd868cc7f04c7c765cc6197455b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c78b5fd9-ea51-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683187247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187247, "uuid": "f917ab4b-d4e3-42f1-b15a-869dbb1e8f90", "comment": "Malware payload", "value": "e9aec4f91a2d8e52abb5dcc0af2f40a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187247, "uuid": "8a3aa633-7987-4a22-9acb-3f9ebfef6755", "comment": "Malware payload", "value": "6934a6abf678103ddf08daf244b5d5ca065ee27ed460dde3efa25d57ce077c13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187247, "uuid": "770e920a-2c40-4282-838e-309d4998be1b", "comment": "Malware payload", "value": "dd7731edc1e8f477e32761a2a3214a56e7d5fc05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187247, "uuid": "95f05100-06ff-4ed9-b4a7-6cc5fb853c73", "comment": "Malware payload", "value": "33e0481cb2ede55f24de68dbd560e1b95f620035d93da98bfcb00ea92e06012ced6606f6871640a99dcd5ed0aff7b0a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187247, "uuid": "349f9830-4b36-41a0-97e8-87060c0fbd2f", "value": "T13CF20A86F9915F15D6E062BEFA0D128E332B576CF3EF72215F202A6533C6A770A35811", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187247, "uuid": "25b3ad08-b73e-4a65-ac98-d7610ce6ada2", "value": "768:Btn89/bRPgRcdaHo9mVrupIQY9niILsYGNRh3YVulh:Btn8HPgGYHLAILiILVGNRhvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187247, "uuid": "bc315e6c-6f73-411d-983f-3fdaa33e0a77", "value": 36308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187247, "uuid": "4575c335-5a7e-49d8-a49f-8733a61152ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187247, "uuid": "4630fd82-1342-4c9b-9963-83e59771a7d6", "value": "e9aec4f91a2d8e52abb5dcc0af2f40a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8af0d41-ea30-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683173049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683173049, "uuid": "2915f990-921c-4dc1-8d71-697b742707a2", "comment": "Malware payload (RemcosRAT)", "value": "43da6da02ab057b4b4b100c727b3fc69", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683173049, "uuid": "f810bb6f-4986-47e5-8c55-1f1865db82bf", "comment": "Malware payload (RemcosRAT)", "value": "6b4d0ff0d2bb85c989bd090151a64651f0520709840a0b646168166f5ad5f10a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683173049, "uuid": "d123fbe5-b886-4124-ae0d-0b67296036e9", "comment": "Malware payload (RemcosRAT)", "value": "9b9b57d22370bb5c04c31360daeec550ad6f4430", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683173049, "uuid": "4af89af5-4727-44b7-8fc3-64c545b1c368", "comment": "Malware payload (RemcosRAT)", "value": "57cd4264ea6b22f8d1c2fac3e3b38924549c3f0ad0324a9c1afbf932c80650c425a22540cda8be9db944c3a2c63cbc87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683173049, "uuid": "be97f1e8-0e2f-43d0-8ca3-f618d33e0c3c", "value": "T131952302FDC184B2D0620D76453A6F22AA3D7F702FA5B9CF23D8771986716C1EA31766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683173049, "uuid": "ccd5ea52-b904-458f-b7ff-cb36b14c4c1e", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683173049, "uuid": "3937d6fd-aff3-46d7-a497-6c394e3b3de2", "value": "49152:LBF4fConfgEO/xmkAdTojvMwtzKCA7aPWU:1OaonfgEbujUwtz3A7aOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683173049, "uuid": "62ef964a-fecb-4f95-8a6f-84a916cff605", "value": 1895310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683173049, "uuid": "fc322461-840f-4a81-a89c-715c7c37d64b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683173049, "uuid": "594385a2-eef2-4be5-880d-49de3bbfdf3b", "value": "43da6da02ab057b4b4b100c727b3fc69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec6c1a5-ea6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683198937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198937, "uuid": "125b6a20-2c2f-451b-96e4-9a3777b3e2ca", "comment": "Malware payload (RedLineStealer)", "value": "f9c4f59cc3034acec0079ccc1f951de5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198937, "uuid": "b261288d-9b28-48fd-9b56-42210c07cdfa", "comment": "Malware payload (RedLineStealer)", "value": "6b574eaeec32a51c4dac2e7894427e00a19470f357215369c1545528c8659946", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198937, "uuid": "2e1e26fe-ae96-4343-9c88-c7df0ab06a62", "comment": "Malware payload (RedLineStealer)", "value": "307ded1af15fa207749141ac113e61cf54127867", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198937, "uuid": "112b5df3-4948-4a23-96a6-027d8cc515b9", "comment": "Malware payload (RedLineStealer)", "value": "506003d6f1316118c43883931415d0717874ec6c265b56f8aa53ac2eb4a1650c3dd3adcdbf4d5c485e0e8db01ea28c9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198937, "uuid": "1ef3f72f-df36-4eb6-b55f-ee92d5823955", "value": "T19AD41207EBD89072D9A9237115FF43831736BDF229389766238A984A1CB3584F136B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198937, "uuid": "da3c732b-ff71-4102-88f1-095fc2f9011d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198937, "uuid": "78b31deb-0460-4f22-b4cd-f1862c844439", "value": "12288:RMrSy90XAKQcuXPSoX1IVSjo+PL2rdAoyTAFqyLVCaA:nybcuagas12rdAi4yJCaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683198937, "uuid": "dadc7865-59cf-44bf-8f7b-0e7f7451685e", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683198937, "uuid": "90ed2398-bcbb-4447-8444-3cb91af97b25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198937, "uuid": "ee2d78f9-3333-4c92-9221-646f46e597f7", "value": "f9c4f59cc3034acec0079ccc1f951de5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceee8354-ea68-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683197138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197138, "uuid": "d4b1bb15-5c41-454a-9aa2-a4ecf6820a7c", "comment": "Malware payload (RedLineStealer)", "value": "dfdde69d5ce04150a23326acd68475de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197138, "uuid": "e4395307-afc7-4b27-8ccd-c4fedc43d32e", "comment": "Malware payload (RedLineStealer)", "value": "6c5012271c977aba0f33ccf9107d9ba6c2070941a11ae3a35c697b27ae771909", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197138, "uuid": "3cbe1d61-817b-4de8-867e-febae7fe1d3b", "comment": "Malware payload (RedLineStealer)", "value": "0532d54445efdca8ac7de1419622816a4a6eeb8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197138, "uuid": "1e8a1584-8a95-48e8-a0b2-b985ca007817", "comment": "Malware payload (RedLineStealer)", "value": "fa6177948d48ab017277060b9c1d0af405f6de4d4fff14b5368379b492f7cb19f16f403d2b44452f09ee8236f9f21541", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197138, "uuid": "0a694e20-3d95-4102-90e0-5edf19c35812", "value": "T125A40223A7E84472EEB52B7018F657C31B39BCA15E74C32B6745A80A4CB36C4A47572F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197138, "uuid": "767f867a-fd75-4c16-b1a6-6df10638e580", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197138, "uuid": "32ee0553-26fb-4085-b19f-175a98e09036", "value": "12288:4MrWy90Y4Qdz3BsltKznCgNKPNMqcxY5K5o8AU4Xu:uyAQdy6zJMlMqI2K5o834u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683197138, "uuid": "52699808-8fdd-4e0e-bbba-640008294aa0", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683197138, "uuid": "3af9b913-e719-43eb-9fd1-f9ff15d8a599", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197138, "uuid": "9fd35690-0ea7-4e31-923c-aa2209907bfc", "value": "dfdde69d5ce04150a23326acd68475de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf2a17d9-ea71-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683201004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683201004, "uuid": "e5db27ea-1815-4c74-a6c0-20f794314564", "comment": "Malware payload", "value": "1915264ab593e0fb2bc7393d90aaeeb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683201004, "uuid": "4f43929e-a5bc-46e9-98b6-6eb9fd65eab1", "comment": "Malware payload", "value": "6c81bdf1fdd5cfa0877fc564319dd4b7a2a9ea0fd2ec0c873633a85b4592e134", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683201004, "uuid": "1692baa1-16de-4434-9282-92acd174b061", "comment": "Malware payload", "value": "07893ca493d5ca161d30986fa24c44e3f30e9166", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683201004, "uuid": "82a19b97-504a-47b0-b1ca-7d684ba300fd", "comment": "Malware payload", "value": "42505ea1c2503ba50fe2acd2e7eefb10374c020ae0b4f413f825fa738613e595c8cad8986e354055e1bbda290654c951", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683201004, "uuid": "6827f5b9-4c1b-4c9f-adfb-7747075722ae", "value": "T10C946C582BF4C62AF3FD1FB0B475601846B9F919A8BAD71D1D8C50ED2D63B0489813BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683201004, "uuid": "8b64bd18-84d8-4b0e-b3e9-25b00c9cb8d9", "value": "6144:iDoc5GxsHk5ICguDftGL1V+I+x7tBbb0RN0qvzBId2uRIbM:i0c5ShUwI47b0N6tIbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683201004, "uuid": "a096e6bf-b379-450a-b06b-37466da5203e", "value": 432640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683201004, "uuid": "a47e5f23-a0f7-4c81-b3df-695411cf7b91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683201004, "uuid": "d39d418f-0e85-4a58-a020-9e4e8e890340", "value": "6c81bdf1fdd5cfa0877fc564319dd4b7a2a9ea0fd2ec0c873633a85b4592e134", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ae85cc-ea93-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683215303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683215303, "uuid": "bfec18b8-57f0-4c2b-93ea-1e2625eef4eb", "comment": "Malware payload (Mirai)", "value": "48e367e5b9db7478257fc4634694598f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683215303, "uuid": "b75f0e17-2a1a-416a-8257-376af04249d7", "comment": "Malware payload (Mirai)", "value": "6cd0949a8eff63d58b93198cd78407725c26bac36bdf32d107ea645427b1793e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683215303, "uuid": "8020fe7b-126b-4626-94c9-34c5090b0273", "comment": "Malware payload (Mirai)", "value": "6b0a268621c37beb426cbd0cede1096d506f0249", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683215303, "uuid": "0ca217c7-a41f-4ea1-b207-e62227fbddce", "comment": "Malware payload (Mirai)", "value": "06b0ac995b9089c95304699eb9068271537c9627cbd457fba11dbdbf2d0b017994af8a29e9caafc54784030b98156e1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683215303, "uuid": "e965b8a9-3515-49de-ac88-b6bae4c1bc20", "value": "T1DA835B25B93A2E17C0E4A07F42B78329B2F6274E24B4C75DBD720E4EFF186902457976", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683215303, "uuid": "48659270-f0be-4da9-997f-98dff14d0735", "value": "1536:989ZMhSciiTprs0MiJBRv4vK85El7feEf4nIwcJSx5:ciYi22QvUl7feaIcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683215303, "uuid": "ff379dd3-18ab-4a10-8268-17d2e66e1ac3", "value": 85768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683215303, "uuid": "dfe7c861-c8f3-403e-af4a-5e78abe73d2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683215303, "uuid": "5799652a-bba3-4fed-a493-8fcab3b48ff7", "value": "48e367e5b9db7478257fc4634694598f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2735f7ea-ea83-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683208453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208453, "uuid": "8b346c8d-8204-42ab-bdfa-6275137cff8a", "comment": "Malware payload (AgentTesla)", "value": "fb5e07b9e0f97dd86470ceba8d2ab700", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208453, "uuid": "07b37870-e202-4819-adbc-3cdc479c745b", "comment": "Malware payload (AgentTesla)", "value": "6d4d0234cd8da2bfaec22bad4859eb03279e709a5c47c72b4aea19ea9b35088c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208453, "uuid": "8d8a11bb-e776-4c64-b251-44b5fa47dbfb", "comment": "Malware payload (AgentTesla)", "value": "0bc1e8fb74b0e33f18cced140fc305c6a7e40d33", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208453, "uuid": "87e93c1f-057f-4b6e-b7dc-58e7a7914584", "comment": "Malware payload (AgentTesla)", "value": "8df1166906ca13f8ec7065497eb4ac63126642ff16677b451bb09a34fc3dce05394cdd2e0b5232a098bcb5e4235f516a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208453, "uuid": "928d723d-63aa-400e-a23a-2b4550f2c3f3", "value": "T1D534707316FDA6F3E5691B782463061A0F20BF727933DA4D29B479F06332F801626D99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208453, "uuid": "6f2d0eb5-e3c9-4a6b-b698-d50bd7b7b8ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208453, "uuid": "dff6c2b0-e1ef-4826-b213-37e81bd2b5dd", "value": "1536:JPwKlGjV1VXvZcM1HMeyP/a9USa7wOFJBH619WWWD9q:JLEqFP/U5a7wWLpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683208453, "uuid": "083d7e15-054f-4581-a96d-8ef316c8569a", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683208453, "uuid": "20f0cf58-83dd-4491-8c9c-0a0d1e291fc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208453, "uuid": "176b315f-0675-4fa3-b35b-9fd097519fcd", "value": "6d4d0234cd8da2bfaec22bad4859eb03279e709a5c47c72b4aea19ea9b35088c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586a3388-ea56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683189208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189208, "uuid": "f0380598-e7a5-4b2e-82d6-8b5d3f609169", "comment": "Malware payload (AsyncRAT)", "value": "c96277417b22b02300f8573a2ee5cddd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189208, "uuid": "78d6e7a6-3044-4193-8fab-b48fa14291b7", "comment": "Malware payload (AsyncRAT)", "value": "6e06ae867fc67afbe5eee0b92e43dd75b2f116eec1fc956a92559bcec974ffa0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189208, "uuid": "04e0cd31-3d0d-4fb6-b25c-a70359a558c0", "comment": "Malware payload (AsyncRAT)", "value": "c3afa5ff29b260f4e8eea5f35e1ec39309bd5421", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189208, "uuid": "cee5795b-602d-475f-859e-5f209f65a521", "comment": "Malware payload (AsyncRAT)", "value": "0862a61812c1ca914f25c97e46429a36073528679a8075b417cca5a74f4e55163058e197e3ba2c6b0453eddb551df57b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189208, "uuid": "412a528f-b5ab-4544-805a-bcd97cea24e6", "value": "T1B9C51269B475F98AF99942BAC7812CF3EF6C6000E75D388F4E70C156B9C320D6F6A521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189208, "uuid": "b87b4238-b28d-4cd5-9c90-ca3a7c8026f8", "value": "12288:NTYV+u9dWbjVpGNGpKaj8qjhTcDxzV7jqlfhf6yz9OeNi:CVCfVeyjJhmNV6lFLz9OeNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683189208, "uuid": "0a50ee17-5c89-43f9-8cb3-6d81a066a4ff", "value": 2545249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683189208, "uuid": "f1c34698-9181-488d-9348-185c114e44c3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189208, "uuid": "afe548bd-1a7e-45de-a84b-fc41daee01d8", "value": "update.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16f754fa-ea4c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683184804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184804, "uuid": "eaed656e-2366-4771-994d-1bcd46a35c14", "comment": "Malware payload (AsyncRAT)", "value": "4e62537601a223c6a2ee2a93362040fa", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184804, "uuid": "6949c751-6b6a-4148-9953-9d5e779cf7fe", "comment": "Malware payload (AsyncRAT)", "value": "6e0d1cb1133304a618380fcab64b991b98ff1c892525b316ec68173fd3aeca55", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184804, "uuid": "691ebf47-b9c2-4e42-8b23-a1182dcf2259", "comment": "Malware payload (AsyncRAT)", "value": "c6786d0203da8e56311627b0e8df37070158fc57", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184804, "uuid": "496ff717-4719-4d99-bd2d-d570aa99224a", "comment": "Malware payload (AsyncRAT)", "value": "8a401d8f40a3c1f04db507b1de425be8090becfb2c14caf7faa16b36876703956f3a838fa139817d63fb657d3879ccb2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184804, "uuid": "8793ef95-e3e2-41f7-87c2-47a612d3097a", "value": "T194253A4BBCA010B9D4A9D23189B651917B31B8591B3227D73F50B3B82FB2BE85F39354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184804, "uuid": "10702029-5e40-4a85-b974-3794315123e8", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184804, "uuid": "3cfa1d23-6bb8-4180-aeb2-3dfa9ce29e99", "value": "12288:tuUNFThRuf3o53Gsp2hXZlh8+suDv4alfZqby13caYgd2DFhbp:IULhYf3o5DpYlh8huT4gcaYgdUhbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683184804, "uuid": "acb3333b-a0cd-42ce-b2fa-eed84deeb2c8", "value": 986112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683184804, "uuid": "7ccc709b-7466-4b24-b3ae-8f65ab2ca8f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184804, "uuid": "ecbf9172-da4d-454d-a28e-e3d59c50e3e4", "value": "RFQ#000022513.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412947d3-ea67-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1683196471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196471, "uuid": "9fdf84f9-b5ac-48b9-8d14-47638ef8c4a7", "comment": "Malware payload (GCleaner)", "value": "f553d751d3896c577cd3e55317eac6c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196471, "uuid": "f9f92048-d631-4340-b756-3b7f5c00313b", "comment": "Malware payload (GCleaner)", "value": "6ea56da5d33549744187c65f81749be722d2e5d8ae1bc93e0d61d2e8d2fb74cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196471, "uuid": "4dfe823b-2401-4201-a7b4-17136b51dfc9", "comment": "Malware payload (GCleaner)", "value": "2536ef88148327c33b745b977fb35b8d810033a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196471, "uuid": "8cb1a0c4-13e6-41d2-9969-fb6528251b17", "comment": "Malware payload (GCleaner)", "value": "8c706fe74ae472a5e5651ae4e6d78bc219b394cfff060ec2f809216bc9b25cf350664823cf3fd75c5a557b5025781a33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196471, "uuid": "a52f9e31-23dc-4163-9689-10fadc69fce4", "value": "T1339533117EB28AB1D830D7B58CEFCA2086727A367DBD4546626CA9DC36FF2104D0676C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196471, "uuid": "28559ad3-b716-4669-b57c-a3d2d75b985c", "value": "da86ff6d22d7419ae7f10724a403dffd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196471, "uuid": "6d7155d2-8e68-471c-a1d5-cd3d87551cfb", "value": "49152:wmhJjPx0KWf8n+B6i+4iUSFMMVnxR5soB6E52g+nKnAG5cf:wQPx0KAB6i+USqQxRT4aXcf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683196471, "uuid": "26ffc3cf-f67a-4997-92e5-2d1c618ff8da", "value": 1997652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683196471, "uuid": "96e99680-477f-408b-ba35-f82367a3e874", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196471, "uuid": "da1b034b-50a5-49c2-bf74-7697dfd6ed2b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785e69b3-ea58-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683190121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190121, "uuid": "9bb2ed22-0b2e-4784-a3b9-335a2149b121", "comment": "Malware payload (AgentTesla)", "value": "ebb4e9e07c341717dd05adb2d66c8861", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190121, "uuid": "20e76f37-9357-4bda-a6e5-5f127d4d6307", "comment": "Malware payload (AgentTesla)", "value": "6eb58c6ae53d7d73190006a9320d508a491d503e27a947a4bc7ace03fa926d0b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190121, "uuid": "c0565f55-53b8-42a3-a6af-1b8f8d14ac97", "comment": "Malware payload (AgentTesla)", "value": "64dcb3f59dbc55a534efe407154b93a45d2c6b6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190121, "uuid": "e81b9a38-108b-45a3-a744-f8ffd5fc1a37", "comment": "Malware payload (AgentTesla)", "value": "69369ffa6dfcf6ba90c14fd65948faee368e4b7fe7acc3a4dbd0b9d3bad8659045bfb7e43c142877dbb64304b7fcf61c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190121, "uuid": "7ef8417d-f07a-41a6-8f6f-554e34c80c75", "value": "T1E1442384202E16D3AE7B8871B27C1CBA983EABF22B1F7EA54D334D025BD3E251456457", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190121, "uuid": "2105da35-e11a-4487-b35c-07b511902743", "value": "6144:66cyiiXtaYNqDFOaoZv5hr1g8wpDNj/OD8v52Rpk24B20:6Bid6QaoN1gBNb28sbDEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683190121, "uuid": "5f7fbe51-5a05-4e9b-8693-b6859c0c2607", "value": 264634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683190121, "uuid": "b01d12e4-dd16-4fde-9cb2-fffd63e98468", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190121, "uuid": "01ef0fb9-852a-4f5d-a9db-fc7fd4d220f6", "value": "Shipment Notification-\ufffd 6183111.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e54f25-ea58-11ed-b3cf-42010a9c0076", "comment": "Malware payload (BlackMatter)", "timestamp": 1683190281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190281, "uuid": "893ef318-eb32-43c9-8786-c7c0ed372a59", "comment": "Malware payload (BlackMatter)", "value": "dbf629fb174be540dd96a78013261d12", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190281, "uuid": "8b9bddbb-286c-42ed-a715-52bd83abe4be", "comment": "Malware payload (BlackMatter)", "value": "6fe8607c799901f812ac46bf98920005ba08c6f8b1c6850835b170baa0ff95e0", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190281, "uuid": "3f31d3fc-ce09-4123-9a3e-ca4cf2f7166f", "comment": "Malware payload (BlackMatter)", "value": "bc54856409c58f7c930b681f0d693749c84394c8", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190281, "uuid": "8a963230-ef42-41ec-85a0-0711fa4ad237", "comment": "Malware payload (BlackMatter)", "value": "442cdce18d502c0d6d9d59eecece8537131f573630ecca7f771f65ecd9e96f466515befefa237b9ec8122757cda4a1c8", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190281, "uuid": "f1637d67-78af-4f02-9c41-7e535b90155b", "value": "T131E36B21F15ED0B3C47718F21726B17EB3EA4D2C1AA56803E6E51F88BCA59232F0595F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190281, "uuid": "a5ad2ddf-4258-4dbf-85eb-a5df1c36bc14", "value": "914685b69f2ac2ff61b6b0f1883a054d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190281, "uuid": "aa42e36d-aba8-4b1c-8970-fa522c847c56", "value": "3072:FqJogYkcSNm9V7DEAH5y6f3ih+y6UOcRwqSJQNT:Fq2kc4m9tDEAZyw3iet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683190281, "uuid": "fc23fa7b-90f0-4b1e-9098-cfefff32f8a5", "value": 153088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683190281, "uuid": "38000971-727b-4936-94d1-86f133eface6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190281, "uuid": "40f906b6-b35a-4577-a877-31f4e1189a64", "value": "2023-05-03_dbf629fb174be540dd96a78013261d12_darkside", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bcc9579-ea84-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683208864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208864, "uuid": "12c7108e-45b0-4501-9bbb-dab0c53a0a83", "comment": "Malware payload", "value": "22e3e2cd29464e9bd0a377c8d5e1f049", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208864, "uuid": "a15155f9-7a56-4bf6-944f-945409edfe92", "comment": "Malware payload", "value": "71664ca9b4d0ca2030a0bb792ae8d6c6791fb57f71ed061899af6dda9c06630a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208864, "uuid": "84aefc6a-6b4c-417c-901f-6bab1a369783", "comment": "Malware payload", "value": "4a3528be37db1c17e7a35e80e4ce3428acc5c345", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208864, "uuid": "92c43764-a49d-43ed-a06e-c3a9ea7d89e4", "comment": "Malware payload", "value": "c302e9b0d2160bdf17da33f7a293e672498336f111b714d5a139566f2286f5bad069be23985a42d9f6d7fea824a37b35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208864, "uuid": "2d63c9af-2651-4b46-bb4e-7a3dc3958309", "value": "T138B50232369AFED5D76F0D38E48B15400E949CEB9768C1647CC802EBA1B37A4ED71A71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208864, "uuid": "c8bc7d35-7b02-4621-b4f4-c4b34f3bc8a3", "value": "24576:W12+qdrzi/y4grJ3uC3OSCxE+4WS8+04svlvmLBQLQtv2NfQSA5W1JYLKFXY/TRl:gnK0OyEZV4AQxQSoK+TRNlUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683208864, "uuid": "4489b6b1-70d5-465b-9e22-534e964de18b", "value": 2471424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683208864, "uuid": "1694d735-aecf-47da-9e08-268439a90527", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208864, "uuid": "c90ff4ab-e655-4944-93f1-af8b6eeb7a1f", "value": "71664ca9b4d0ca2030a0bb792ae8d6c6791fb57f71ed061899af6dda9c06630a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f633c9d-ea7b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (PureCrypter)", "timestamp": 1683205165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683205165, "uuid": "56e12441-da25-4084-85d0-b0d5ef74be0f", "comment": "Malware payload (PureCrypter)", "value": "2849f57c69217cd0e606b577977f0632", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683205165, "uuid": "49a62811-b4c0-432c-8148-20144c25158d", "comment": "Malware payload (PureCrypter)", "value": "719e904d57152db482078cd357d9f737f7d601e6aface2921710ca19888d40bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683205165, "uuid": "248010be-f32f-4828-83d4-9b4e11e3d008", "comment": "Malware payload (PureCrypter)", "value": "3f96b181552334ef614600ef6fac38bae8e62950", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683205165, "uuid": "6bbbb0c9-972a-4fbd-8468-e8125c7c8339", "comment": "Malware payload (PureCrypter)", "value": "362897afd150f15965ea7251075a8ae607f2f33ff48bc8dfd886c2e535c97a4ea74ffc62b1522da50683f92088ba4be7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683205165, "uuid": "9e8fc22c-31ab-4377-9b5d-fda019386f75", "value": "T1B993F5943B9CDB72D26EDBB2B07601B447789A9E6532EB882CC061E4CBD37406B5117F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683205165, "uuid": "fac97817-7958-4070-be1f-cae3e138ef55", "value": "1536:41H/PCJE7z2OH5kjqSDjiC8KZOoODpceXqG17/QcbEzhINlllCaavDG:z21iODyO7/zbEz6NlllCrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683205165, "uuid": "577aef2f-fd47-41d8-9023-2c909e64eee3", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683205165, "uuid": "e70ba4a1-8810-49e9-b580-7d1d7e24fa24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683205165, "uuid": "4603465a-0055-4f35-b205-0093e510aa69", "value": "719e904d57152db482078cd357d9f737f7d601e6aface2921710ca19888d40bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9561882-ea5c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683192029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683192029, "uuid": "85616fa7-11e1-4ab1-8a98-b5795052e6ac", "comment": "Malware payload (RedLineStealer)", "value": "d706a13d0be486e0c67448667eb5feef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683192029, "uuid": "3919561d-385d-4657-8319-090c1ad73e56", "comment": "Malware payload (RedLineStealer)", "value": "727c5c1e71fe232fce2c77049000cac12c11ce48c0c92e0fd2f2dfa00618120e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683192029, "uuid": "578fe3ba-bc1c-4355-a6e1-f045bc96b1f7", "comment": "Malware payload (RedLineStealer)", "value": "68783e32978b1114075de19c797b7429b047eb3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683192029, "uuid": "5af092cb-eb55-4ae1-92d6-edbbebaea2da", "comment": "Malware payload (RedLineStealer)", "value": "a70b22cc14243c3035c4766a68be1414b251cd65b9e6c288c9c28caadd11813481a87fa657b4f4505b0d07ccdf19da4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683192029, "uuid": "76154cb8-7c63-49b8-b424-6d01b59628b6", "value": "T13AA41212E7E84133DC7627B059F603D30B36BCA69D78836B2756990A0CB2798E572737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683192029, "uuid": "1f8722a6-b3a6-4984-89a9-ca1016f49cb8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683192029, "uuid": "df9019db-9269-4a38-98ca-cb3c7307a9f1", "value": "12288:iMrIy90DaEzC6iD/ntGDxceramWcVHfHnt:WyWaEzhijntqceem1Ht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683192029, "uuid": "2b4648b1-2397-4b7a-91ea-48753d875768", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683192029, "uuid": "10cc855f-13b9-4f9a-a013-4f422607acf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683192029, "uuid": "1ccea450-ff4e-43c0-a28c-2c594789236b", "value": "d706a13d0be486e0c67448667eb5feef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ccb379-eaa2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683221925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683221925, "uuid": "52ad691c-7e58-4e31-9057-10d33be3feb5", "comment": "Malware payload (Formbook)", "value": "6be81113a8be4c9a34e9d8fd9b3dac56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683221925, "uuid": "cde0fb20-77b0-4a1e-9bec-196da1930b4e", "comment": "Malware payload (Formbook)", "value": "72ab6b20fff5f1384506c7a3943c3c8f9d3ce2ecc79197f0ad8274ae1a2150fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683221925, "uuid": "e605a126-be87-411b-9bb3-b1a4ec769228", "comment": "Malware payload (Formbook)", "value": "be06d1f3924dc081c007e710e044a86700de5c3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683221925, "uuid": "ec9833ed-810f-4e89-a265-dee833eda90a", "comment": "Malware payload (Formbook)", "value": "1d02641d7a7fd255864036ca827bd044d2459c512cb1be53bff5cddd0b0d04ea46205bb56574cc703bea6039dd9f4d22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683221925, "uuid": "74b5856d-ca0b-4823-b71b-34e9662835ba", "value": "T1CD05F12233B8BB95ECB683F82708A0016FB57D6167B5D6E84CC6E0CD5155B08FB60B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683221925, "uuid": "e3059b1e-dbff-4e8d-a29b-fa79f60bae55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683221925, "uuid": "c24cda6d-18df-442f-8624-fe99981ce6a6", "value": "12288:+e11KAbEEBEpmll+Zf/6w4mcaMtzXJvSvAiY5Z4nSAgWxU+ajbBMeU/dwsd:zPKcEEPlkRcaWJvSvZCuq+ajVMeU1ws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683221925, "uuid": "caa50419-1f02-4eed-9cfe-d3eadc84ff24", "value": 804864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683221925, "uuid": "bc644af0-ae15-4bd0-9b62-03a47a16561d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683221925, "uuid": "862ce445-dbdf-4b34-944d-a213176ad999", "value": "SecuriteInfo.com.Win32.TrojanX-gen.15089.21504", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39bf9f0-ea74-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683202300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202300, "uuid": "6263db32-7356-4b56-afe8-27571568270b", "comment": "Malware payload", "value": "6f8788bb25c3cca05ce8bdb2e6aac31c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202300, "uuid": "b627a1cc-1d31-479c-a781-26ce0bfdda90", "comment": "Malware payload", "value": "72cba77d7e54c598af26a498d10de8ff80aad5977ef7e682d623ec61f2d9d583", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202300, "uuid": "f82a15f4-daab-40fb-b119-72d38722ee6f", "comment": "Malware payload", "value": "6416bd00e3b23d31c8450d9243a419bf84a9543a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202300, "uuid": "b06d54df-bdbf-483b-8741-2179c43ec2eb", "comment": "Malware payload", "value": "eddcf3d880fb0581447baef5bd7d6486300c027aa44e446806897f998b98f332ce3147c73a4516b4caeea939cc949e1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202300, "uuid": "6e179934-6fe1-43fd-91da-d5f3750339de", "value": "T13E44296E308FD8EFEE614C321FDD7775839399A6C676C3F218AD9430191A0678819E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202300, "uuid": "1a913242-a2cb-4a15-9451-7b15b438d6da", "value": "071307373db47402e881a4d65e0a19ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202300, "uuid": "001f7c6d-b3d0-4b59-8d1b-7f57f0a102a5", "value": "6144:7Ed1+bXsh+vaz8++++++++++t/MVT7HpJzqc+++++++Nd28YtlDn+OY5bIC+vaON:4gXkVJEJ3LXNuyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683202300, "uuid": "b2bf9a69-4218-46df-8806-10b0a68f953d", "value": 259936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683202300, "uuid": "5f9533ba-c919-4abb-a515-9f11fe498d88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202300, "uuid": "a0c5cf38-521d-4061-8417-9bd616931413", "value": "72cba77d7e54c598af26a498d10de8ff80aad5977ef7e682d623ec61f2d9d583", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f38d8e-ea58-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683189931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189931, "uuid": "0a9989e3-9cd0-44e7-973e-543bfae26d7e", "comment": "Malware payload (RedLineStealer)", "value": "f8eb858177aa9334f5dac641740a876d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189931, "uuid": "ecf655ea-616a-48c2-8627-a951b14f185e", "comment": "Malware payload (RedLineStealer)", "value": "735b6c9f76a6353543fbbd902d763b4b61b522f0a24df3de20ce7e70ebb8f874", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189931, "uuid": "c60cd847-3ceb-4a9b-9a28-073714a3ff6e", "comment": "Malware payload (RedLineStealer)", "value": "010de59da046fb3d8fc719b195b902f7fc3e5a62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189931, "uuid": "e63ee4e6-b8fc-483b-b8bb-2b83a9d88f67", "comment": "Malware payload (RedLineStealer)", "value": "b9291c5157c96ea9615c124805316a8083226eca248f62f8d35c2183a9f5c2625d990102ab5facd424532521bcc48f0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189931, "uuid": "f92149d6-1b8a-45e1-afa1-16045c15b8c1", "value": "T11D748D03530EC9BEDE9BA0B9FCC482A56B18A0B97B5FE287BBD45D14056F0D0765072D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189931, "uuid": "274db650-4047-4f51-870a-2ed073f12b73", "value": "d03a32a9d6119786dea4a25b734d4a33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189931, "uuid": "87a7103a-385c-483f-8d98-b31912985e8c", "value": "6144:vdEkh2JJtk1HRLOmD6XctJ4jMzn90w6iqhv+TcIzAi:vdEm2JEhRim6MkjxRphvj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683189931, "uuid": "4f4eb765-0b68-472d-b9c4-a8aff4890730", "value": 345616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683189931, "uuid": "6b379c16-2317-47a6-bb99-50fe48fd6c49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189931, "uuid": "f243603f-c8c5-40f4-af67-d7e262018d5e", "value": "f8eb858177aa9334f5dac641740a876d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da41004-ea58-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683190184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190184, "uuid": "80f33cfd-bb5e-4947-8e7b-81f12c02af0d", "comment": "Malware payload (Mirai)", "value": "5998ca723845401833c0dee7c4dd7049", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190184, "uuid": "545e96ac-1d94-4aa8-b705-fda90f74224c", "comment": "Malware payload (Mirai)", "value": "737d9bcb039cc4b855644d32fcf9efe6ea69f7e6ddb36dcb9e7994cf23d0df3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190184, "uuid": "314859d3-1b41-46bd-9f6b-a80a5d172191", "comment": "Malware payload (Mirai)", "value": "b8e05135d431b6bf0d9247b18ed2f9e022ec7947", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190184, "uuid": "698cc477-9af9-40be-9801-d0c2207e0e95", "comment": "Malware payload (Mirai)", "value": "de1856f8f5162220cc7ce5f63d7f82db7b4e8c2a8916a725ad710b70939ea08729f6392f990a94a7071df25d41558e5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190184, "uuid": "952b9436-c37d-4af3-b7b5-b5e1ad683ee4", "value": "T1FA438D22FC111D62C43142F6B0B0D678C3525EF642E65D766DEEDA4A04FBE49F88E7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190184, "uuid": "335b344c-f4a2-4e89-ba7e-719537dd56f0", "value": "768:OrJJ7s5LUkGDsIzHceVnuwkCXO3NsNSNH1MsuQ9B16nMGCcTtrrygw+IErD:oJ7s5PYyOuwqWN+HjmMqkBar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683190184, "uuid": "1c958f5d-6658-40c2-8f4c-f7f813e00887", "value": 58204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683190184, "uuid": "f807914c-7bad-4f2c-b028-a6248097236a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190184, "uuid": "ae647045-840a-4cb2-86e1-80f56618d821", "value": "5998ca723845401833c0dee7c4dd7049", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5a79fe-ea51-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683187333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187333, "uuid": "e84189ab-f87a-4948-a11f-4616263eebe7", "comment": "Malware payload (Mirai)", "value": "758106fd22c6497972cab95f89e345f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187333, "uuid": "1d6ad504-7dc7-469b-adfe-0a725f666369", "comment": "Malware payload (Mirai)", "value": "73e2b670ea2b2d97a2555df86751f9cf7ee2f9a1c62422e37770d0f89e3852a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187333, "uuid": "ba6cbc33-63b3-4c51-8bec-4647ff68f41e", "comment": "Malware payload (Mirai)", "value": "d32235635239ab01d4886ee4d0595d819757427a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187333, "uuid": "6ae547eb-b623-4d99-a0f4-221e9b93b2fc", "comment": "Malware payload (Mirai)", "value": "b1e4d9c45c318c54d071aff02209e61a108b29b4fc09015269fe16aef027c4c67bd81e3b912c0fc4eba691d470250781", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187333, "uuid": "8e481416-14a8-41d4-87ae-b4935c5712b0", "value": "T13683095AB9815F12C5C602BAFE1E018D371357F8E3EFB2239D106F20B78792B0E66955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187333, "uuid": "edf98734-8076-4556-b5df-114ad6897c34", "value": "1536:bFn66UXeKg73iA2y6Mf6GfiKWZdVarkK08I5iTawWuvHz6r/53YoCwbZnJZ:7UuK/xXZKsdVaZaDuvHz6r/ZBCwbZnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187333, "uuid": "a0b1fc95-e9cd-4e26-a47d-25616cfb8e7e", "value": 83256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187333, "uuid": "14f69d8d-b63f-4e79-b9ce-92862d6e1734", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187333, "uuid": "9cc9cc8e-e871-4758-bbcd-163394940ad3", "value": "758106fd22c6497972cab95f89e345f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9765a934-ea7f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683206924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206924, "uuid": "28c60414-4dd2-420e-820c-bd13f8c883e8", "comment": "Malware payload", "value": "7825301058d249901380497befc719a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206924, "uuid": "f853a4fb-5c2f-48f7-a90a-cc9b14b7da0a", "comment": "Malware payload", "value": "73ecd0a3d8b2472391ad17406e3d29821f9283e6c872067785a4cad263a0ff72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206924, "uuid": "a866ceef-9bca-4333-aa1e-41d80b28137a", "comment": "Malware payload", "value": "061d4576311eb891f9c32f9c4525616085bd0d67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206924, "uuid": "9570ad71-7721-43da-ad39-2eff7294772a", "comment": "Malware payload", "value": "8d8575eb515aa1e16c8d903953d37781e2f34b6f6bd744dfd52d88e34666bbeee99cdbd7de9812a7d2b65b9a8cf6992c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206924, "uuid": "d3a34d15-cef5-4c96-9688-e38bfdfa140e", "value": "T18D245A2C29BA84F6EF348CF0DEF0AB9597671DED874FC5E1846460736998361B90C4A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206924, "uuid": "ae088e64-8319-49c9-95a5-f995f1f40a38", "value": "071307373db47402e881a4d65e0a19ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206924, "uuid": "18239d0c-8582-40b9-803a-624fd455a9d2", "value": "3072:gAjsrWxH5fNcFvkHieyr6AN0FjnDV0w+aciLIz+cmpAphEKpYC+ulkwv/a+rAuEW:DD4F76AN0FjnIpvREmECloOOov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683206924, "uuid": "cb762d7e-23d7-4271-9a54-1331aa01ad19", "value": 225120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683206924, "uuid": "7543e244-ef0f-4e5b-aa2e-6645c4cdd621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206924, "uuid": "6ff7e15c-624d-4107-8382-1df8207c66f5", "value": "73ecd0a3d8b2472391ad17406e3d29821f9283e6c872067785a4cad263a0ff72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd2bf24d-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683194156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194156, "uuid": "1d9aeb14-fc9d-42a0-b9f6-d1e8a6fe4e4e", "comment": "Malware payload", "value": "2b8abb670b363b28f8f7aea7e9274474", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194156, "uuid": "fa7ff70f-ca3f-4b29-ab24-1c4873445089", "comment": "Malware payload", "value": "73f625484ae61201131c6a153d196cc97f68e390fa46c0a3b129edd7444690b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194156, "uuid": "f240ccef-9374-49f0-8960-6a705d5b3292", "comment": "Malware payload", "value": "693dc83b392640f89be294b40d77cd11a2e0c319", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194156, "uuid": "238f2627-fe37-4a2d-9b63-d58ddd0f2b66", "comment": "Malware payload", "value": "6d6be0c8cd48bebb477056cca36d14a99564c6287a64f4ad6215489b0a80abf45b6a3f3c99b2c22f7eabd15b985851e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194156, "uuid": "5d57870e-43ca-4ae6-9b3c-0b170c426163", "value": "T1BBF47F22F2A14433D5632B349C5B86ACA936FF112D28BA477BF93D0C9F7D7413916292", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194156, "uuid": "54f6a261-a770-478c-9e98-6e4ff51edf0c", "value": "12288:6VmIsvvnvnnUqoJ4Wjnw0NrdJY4UUjgQddbJr/ein4dl:WV94C9rdd8sz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194156, "uuid": "ed7c2961-61f8-4196-8e5e-df6436b276bf", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194156, "uuid": "a7bc71ee-ff1a-4414-9487-432dc798fbbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194156, "uuid": "27c687a7-be4c-4e2b-9e67-e036b6675897", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.2401.22856", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a9e57b-ea7d-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683206164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206164, "uuid": "7f7813dc-7fcd-43f6-8965-2737f6ed9732", "comment": "Malware payload", "value": "d610a0ba2dcfba3c400705d46025c0c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206164, "uuid": "cd05183f-196e-4b6f-a889-1c67768c82f3", "comment": "Malware payload", "value": "73f64bc33e3b3672255550ce4ec0f98e1fb399d373b5df80667b70de2bca9773", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206164, "uuid": "28dcfd61-3a78-4444-ae82-0b684408358b", "comment": "Malware payload", "value": "25cc1b47fc21be7adb77c8ed62616f4513dac944", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206164, "uuid": "1e195828-00ec-443b-855c-e7c62052923b", "comment": "Malware payload", "value": "a248fbc250a5f02ac45c1966b947d859447594d68a7123cb91f9e9c91134f69f21a9f171b4b22c3c694b39362890b74d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206164, "uuid": "42e89108-d5f0-4eb2-ad10-a8169d852a6b", "value": "T101445B7D51E7FC4BFE66CCB09EE576A9C7A355688B66CAF01CAF54B03E200628C05427", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206164, "uuid": "4e3e0912-ecf9-4835-a47e-732b9138b179", "value": "071307373db47402e881a4d65e0a19ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206164, "uuid": "740f5280-a917-410e-8e17-44b4367c8686", "value": "3072:D7ipaR15AKQY2FdVYIwydh59Y+MjoG3DGTYVlFfuITzTAY2jw9DNwCV3K28YQFPQ:D7iaRZW/OfAYew9DNV3vTQFPuE+As", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683206164, "uuid": "c353dd95-2953-4804-beb7-f6107c85f2e5", "value": 274784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683206164, "uuid": "2b496993-9857-4ed2-8a30-d3b5320bae6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206164, "uuid": "77bf3115-6c13-4323-a7f6-b756ba39333c", "value": "73f64bc33e3b3672255550ce4ec0f98e1fb399d373b5df80667b70de2bca9773", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82a73df-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683194147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194147, "uuid": "6e1a0c37-a835-485a-8efb-e579f2682590", "comment": "Malware payload", "value": "f9eb08f7235a0ae2c35afa02fe4d9be7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194147, "uuid": "ce0978e3-2dd0-4aee-b3a0-5902d38d3636", "comment": "Malware payload", "value": "7401b772993a5b8e50afc51e4aa002a35312f6b3abcce3f1149d4e257e223ee9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194147, "uuid": "2fa8893b-4e3f-4da4-8014-212620344670", "comment": "Malware payload", "value": "96a512400e1a817a047c148fc720627b79af25ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194147, "uuid": "4ddcf15e-85e9-4ba2-833d-ce6523a0bc73", "comment": "Malware payload", "value": "a037d0541e4bc47417d27ce977234c163045c7fd2847d670e16af87c19fc8b581bd1beb55674da74287fcc9701f9501a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194147, "uuid": "2a63b54b-9699-4b63-9adb-30b8df0ea6d2", "value": "T1E3833AD00A825471C8A28E7DD3A77A3FA6256731119A5F533B10EFA25956073ECF26C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194147, "uuid": "5649c474-6fcd-438c-833d-b72908b574cc", "value": "96:Y9HRsFycj7w3avIgIFEqNdnRPgWBm7nOXOmBK8xtOhPjddp1KCxi5E5m:eGnzMdmDOxQXhJdvLUEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194147, "uuid": "984a7196-c320-4f85-9575-8cd6bd612fd3", "value": 83456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194147, "uuid": "845fabf9-05da-49a2-bbb6-c8e9d23856ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194147, "uuid": "5285fd86-b11c-4c79-b121-f33be49de679", "value": "SecuriteInfo.com.W32.S-909ca299.Eldorado.3284.8964", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d42f75-eab2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683228931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683228931, "uuid": "860c8756-2019-4a5e-8442-72dc67435d1e", "comment": "Malware payload (RedLineStealer)", "value": "da21dbcf0705576a3c9c48a2d0a3870b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683228931, "uuid": "e29be470-d3d0-45aa-ba9c-f6f268b47225", "comment": "Malware payload (RedLineStealer)", "value": "743e18d9ceeaf261e72a9ae93c4f67cc29c29471ee88691cda46722860f6a78b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683228931, "uuid": "f475ea26-3469-4377-889b-af76cdd0f09c", "comment": "Malware payload (RedLineStealer)", "value": "db0166c488ec7f8dfa4a0b9cf664d8c72413014a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683228931, "uuid": "07a2c6cf-73c1-46a1-af47-bad91fdd061a", "comment": "Malware payload (RedLineStealer)", "value": "6a3a962cdc8e8dbade02991f1ec7cf227cffb05457fb69d174c3fbe9ea2d124b6f6d8b4b1dadb7a327caa41f77ef189b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683228931, "uuid": "a93e3f37-9060-41ea-9ddb-98d5c43479ee", "value": "T18EA40257ABE88132DDB427B11CF712D30B36BCA21934836B2B55E84B1C73688A57573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683228931, "uuid": "7a166879-9835-4fb7-aaf7-edba9e016af9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683228931, "uuid": "e03dfb8e-d678-4ea7-a9d0-018b93479b90", "value": "12288:IMrWy900sqKdmtS8ba3yGQp1jmoyH4T1XoCGO:uyfsqKdmNaxQpUjY1GO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683228931, "uuid": "94f3d3bc-9cd2-4472-94d9-38bab7879e26", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683228931, "uuid": "88a2871a-3378-4739-bc98-bf3e6375606b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683228931, "uuid": "c18dcc25-ff75-4fa1-a196-00d00d00e8d4", "value": "da21dbcf0705576a3c9c48a2d0a3870b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4f45a3-ea53-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683187982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187982, "uuid": "68fd877c-7106-4a00-b850-5ef63eda46bf", "comment": "Malware payload (Mirai)", "value": "2e68461837443e8c5489e83780d3c471", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187982, "uuid": "314e97f0-3abe-48c0-8ac4-ffc6f81ddb19", "comment": "Malware payload (Mirai)", "value": "7598398525e2c73edf2aa3cae4f527571c5155e02d98d268273cbf368b402c52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187982, "uuid": "170d4abc-f14e-496c-8ab4-e05e80a41a86", "comment": "Malware payload (Mirai)", "value": "cac3fa289cab3518a39de620425408d6523e663e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187982, "uuid": "68143a71-8bdf-4ce1-a321-f873b334c50e", "comment": "Malware payload (Mirai)", "value": "c305630d4c2fc189a9796fefe94f8b849a12a89a37f38b8f2cc630be18d9f2371f531da829cd2f0d0bc37d9bef872380", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187982, "uuid": "e997f0b5-0ab6-4bbf-9c5e-d7b545cb3c51", "value": "T17CA27484F8411B66CAD1A37FF64C13DE3A3E1364F2DBB3125E205F9137D5AA52936520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187982, "uuid": "3087fab4-0561-408a-a36a-ae869fdc863c", "value": "384:TY17/3/axmlj26ddzq1fDDpW3Um08r5UbzBB8UYoFx4eg:TYB/3/VVPzq1bElTtUL8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187982, "uuid": "d2b4b7c1-9330-405b-b654-aef7041930c2", "value": 22548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187982, "uuid": "b54a4c78-264d-4707-82fe-3175a15daae4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187982, "uuid": "185ac9b3-521a-4626-b8ac-f5b58f5d424a", "value": "2e68461837443e8c5489e83780d3c471", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7926c4-eaac-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683226229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683226229, "uuid": "9a4f92f2-5629-4c2c-af3b-c264666184aa", "comment": "Malware payload (RedLineStealer)", "value": "c81a50d023b9cbf59e8fce655f187e65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683226229, "uuid": "0cfddefc-fd2e-4d87-b9a5-df7ce5ddd996", "comment": "Malware payload (RedLineStealer)", "value": "764d25e84cd5163a37f88253b833b96bb3d5e3ddd548d5c5ec520f83d8b090c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683226229, "uuid": "08b40f3d-3738-4b25-ae10-b7b20ba4d014", "comment": "Malware payload (RedLineStealer)", "value": "1571355345223f72498fd3302f93d490f6a5db22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683226229, "uuid": "747de8e3-e02b-4036-8b57-87f2a3d54997", "comment": "Malware payload (RedLineStealer)", "value": "388600b2fd9cb4a787cd1f5bd70e6c3af8680d64310a9f6a526c801cd68df6f0ab429750c0b93ce9b086bb3c3ea5114a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683226229, "uuid": "5743bbd4-f5d1-4bba-9a23-2fdf64b01b08", "value": "T18464F113E6E98072D9B127B118F707C31F36BDB19D78436B3A85A88E1C72694A931377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683226229, "uuid": "6d1e0b9a-fe11-4293-8c80-74ec9cec6433", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683226229, "uuid": "a2ead944-607a-4c29-a2eb-174fcf8c2653", "value": "6144:K3y+bnr+tp0yN90QE2lEY+zbPsY4JN/gvSsJj+elFZ4m:xMrNy90kb+z3eNMJj+85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683226229, "uuid": "29fd3239-60f1-4019-a6f5-59f584626852", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683226229, "uuid": "d5e1860c-4be0-42f5-9edb-bf1e0ab73fc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683226229, "uuid": "47c0ab85-5895-4966-a9cd-a0129da32499", "value": "c81a50d023b9cbf59e8fce655f187e65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91fbc43-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683194149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194149, "uuid": "ca1d95a9-5a01-430b-a5b1-6346c93880bb", "comment": "Malware payload", "value": "b8020d92e5e261b9dce6195034acf01f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194149, "uuid": "5d0d62f3-a7a8-4b11-ab87-b38f40784266", "comment": "Malware payload", "value": "764db5d2b7959e748a1f226e02c3550443f8f72e1307d7452bd4d25fa73771bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194149, "uuid": "3aeee243-f833-42f5-9498-775dcd822661", "comment": "Malware payload", "value": "10d42ee362559eafdb9c364e99333389df049741", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194149, "uuid": "14b9a246-78a2-43a9-b36e-d74bf2b820c3", "comment": "Malware payload", "value": "7243fd715b74a4589564f6db55bbfc2873614758d4b784937f5ce148cb9c1f1a108f1bed256f9d4d9796e7cadc74d3e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194149, "uuid": "c3715045-e9c0-4e1b-801a-4f9a020c743e", "value": "T1EBC36C0AD786CDB2C4448A30249D73B6E27BFB696B61B2D6CB4B1E743CB14317A05C76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194149, "uuid": "9c229493-5306-4447-ab18-09c2b61479c8", "value": "1536:m7IQAt81w1QGy8u7qb3rf8SCmEh0Rui9RXMCYiIh3:m7IjWW1QGyx7qb3rf8kAijc7iA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194149, "uuid": "6797042a-3442-4682-b31f-3fe9fd1af896", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194149, "uuid": "64c346e1-8005-4aa3-8463-ab9de6e13f52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194149, "uuid": "23e9651e-714f-43ea-a6a9-0781580619ec", "value": "SecuriteInfo.com.Trojan-Dropper.32309.9729", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd0ca60-ea41-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683180384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180384, "uuid": "4299fc0f-1349-4735-9a72-6ea1e29e0427", "comment": "Malware payload", "value": "b7e88f9f57137b39269a26d7380851ea", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180384, "uuid": "d79441e9-2963-4aae-acc8-d8cea9ffa03b", "comment": "Malware payload", "value": "767640e4be0ad1dc04332cbaa7485d425feebf3e8665af6b9922b09cc98e1a74", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180384, "uuid": "964299ee-a3a5-416b-a1f7-95030d14c02c", "comment": "Malware payload", "value": "db32e2761ce37b791a41312355c1caf1c13ae113", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180384, "uuid": "c319100d-c7ba-43b7-bad2-e3d71149a30e", "comment": "Malware payload", "value": "8709dd8f57ed3d7a4eb040da29bf8e514da23655d09ee1527fb6c2c77894d589b96252e1adb7b6cba458030e6561d2cf", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180384, "uuid": "2c566ea0-23d1-4d7b-a089-21237f5a9b9c", "value": "T15C81D43A6B58C847C68BC7B0D09C7E5A0562F13E86CB2AC6B7B9F87009674291936404", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180384, "uuid": "891a66c5-71a4-4022-9181-a81c248c5f18", "value": "96:7TYK9l62iJPo1swaGHooG+0znul0N7ecVDEAaVGXQgXuXW6K:7TYQRito1xsoGtLuQ7ectcG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683180384, "uuid": "5d658f7e-57db-4d99-bc79-c62924dec474", "value": 3857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683180384, "uuid": "58423e22-9e36-46c0-8695-9250be34256b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180384, "uuid": "2d6771fe-1b7a-44ed-b697-b19f44ca793c", "value": "PO#035499.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882e6096-ea50-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683186712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186712, "uuid": "a8efa7aa-dd1d-4375-a61f-9b2910246a95", "comment": "Malware payload (AgentTesla)", "value": "63522881c7f2d5dbe6b461047659ac9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186712, "uuid": "af2ffeb9-7609-4454-a372-3658b848fb3f", "comment": "Malware payload (AgentTesla)", "value": "7681b3e36910fd04d90febb8fe222537db5fa8cb2c699c19a4a6eb3470e71292", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186712, "uuid": "a9a1edec-3f5e-4cf7-83bc-0769b808e3ec", "comment": "Malware payload (AgentTesla)", "value": "aa53f792ba72c44f29037f1986e610637fd42c25", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186712, "uuid": "d30095dd-1417-41a0-a9a2-ec3f211b3b05", "comment": "Malware payload (AgentTesla)", "value": "fed1e3e8aa2be7c36d4d82638189ea3b5397b0c76ff7e46a083225b45fb7e844d8459b5332faa819d6def417140008fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186712, "uuid": "37235282-3e35-4ce8-8f86-099112511128", "value": "T1F7C47C3C29BA5627C176C2758BE49827F1509D6F7011EEA994D333BA0752B8339C327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186712, "uuid": "04c67c7c-786f-4d74-8c98-d19377f8a3fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186712, "uuid": "bf8ddef3-a494-4254-8d5e-05cf12733236", "value": "6144:jIp9pFljrmLenAomLYcMYmxWohuyOhS/7ZzF+r8oVhU+8ka0SN87592ymGOZLquY:UpbKqnAo+M9xWoeDrLhUka4v2ZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683186712, "uuid": "702bb337-90ba-439a-8364-8b0a7198edcc", "value": 584704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683186712, "uuid": "4b74beb7-207f-4377-baa3-ff2e51d6fd4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186712, "uuid": "81e1ee48-746a-4bf5-a514-cc11a551df45", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4093abe6-eaad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683226535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683226535, "uuid": "a75b028d-8376-432a-9f1d-44dc7048948e", "comment": "Malware payload (RedLineStealer)", "value": "ae8562ebc5dc40917e51d77fd114d93f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683226535, "uuid": "7d413bda-481a-43e8-be61-1ba0f439a180", "comment": "Malware payload (RedLineStealer)", "value": "76d130ec0928e7e8f483829e1c01500f2087af54f7f964bf6e727f9e181ce74f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683226535, "uuid": "54be8296-8620-4380-8e34-0f19a8188e2e", "comment": "Malware payload (RedLineStealer)", "value": "6b29f0eb11ed28ac463aa3ac75450407d56a5230", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683226535, "uuid": "edbac5da-1645-4c06-8f58-d03ba22eaa7b", "comment": "Malware payload (RedLineStealer)", "value": "1bd3b6281025d5f3b3d829ebb551723693c3a8ed25e505dcb6e9294e07d2b22fa74ecbd4a4ec618c45acc86dcda85a6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683226535, "uuid": "8249e3d6-7240-4440-931e-e1dfc20aaeb8", "value": "T117A40263A6D48132EDB617B158F707830B327CA49D78973B2B89595E1C73784A83633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683226535, "uuid": "5fcf3a05-3793-48ee-ace6-be0e9f47617e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683226535, "uuid": "019364ba-f753-4ee5-b895-17828ffee3db", "value": "6144:KYy+bnr+ap0yN90QEFIXJfg9zkvUgYhZmWlEYVzbPsrnJQVrivCxQtoeUSHrRCa0:IMrWy90MJfQ+VYjFbVzMJCnQT3r+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683226535, "uuid": "e631c92a-d20c-4d06-ba96-bbe0748b7307", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683226535, "uuid": "589e3d0f-3249-4eff-8720-23730aa1978f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683226535, "uuid": "2e0fa18a-ed73-4d56-8c70-902aadaacbb9", "value": "ae8562ebc5dc40917e51d77fd114d93f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a622810-ea1a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683163361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163361, "uuid": "17518fbc-22d0-47ac-ad05-f79bea0cd92f", "comment": "Malware payload (RedLineStealer)", "value": "ddb75b897acd2c4e681a55f303b34602", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163361, "uuid": "1f49afa8-3c89-4b73-aafa-98f9bef2f3ad", "comment": "Malware payload (RedLineStealer)", "value": "776774ccd8ce43f597affe3ea6aeda4edb187c2544b79f4b819de71e62dae948", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163361, "uuid": "5db8a141-869b-4d02-bc8b-c483e7eb3bbf", "comment": "Malware payload (RedLineStealer)", "value": "013c1690fe5d7cf3682e997a38a749854fb17f90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163361, "uuid": "4172846f-daac-44f5-b2e3-098ff0dea1f1", "comment": "Malware payload (RedLineStealer)", "value": "6b6c42e0de59d2bb5ce28c89ddc829498e1af32ee7d08367e211a8825903db6479fe9df1befe870b06e8d36917d9bfc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163361, "uuid": "0125a49b-b794-4559-9811-290d96fc82cb", "value": "T18B452316F6E44172EDA237B059FA47C31F39BC909978826B72055A7F0DB36C9287231B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163361, "uuid": "0108668c-9763-46fc-946a-c718b170693b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163361, "uuid": "f40c6334-b50e-4e91-ae4b-d284618be295", "value": "24576:wy3Jleyeg8/EU9LzqBll/0mVT7dG1DhiOi9Gc6cA7APv5mkxj:33reydK4/LT7diDg56cGmmkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683163361, "uuid": "2dd4bcdd-dd12-46a3-b654-07a8876b24b8", "value": 1276928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683163361, "uuid": "ee99da38-4bb1-4f7c-8dd0-5e1227a4283e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163361, "uuid": "42cb997a-05f9-44dc-8001-a728f34b27ff", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eafa5b76-ea55-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683189025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189025, "uuid": "cfca4cc5-9add-4c29-ace0-df8a6920deb3", "comment": "Malware payload (RedLineStealer)", "value": "2a7650ca338fdb9165b567afbdf1f46e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189025, "uuid": "930d3a0b-80ca-4fa8-8547-bdd6ea72e80d", "comment": "Malware payload (RedLineStealer)", "value": "779f4c2d67fccb8a9a9240454df126be3dd6b3fb9ca62b981d35822c9e9e61c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189025, "uuid": "d971e6bf-51cf-4358-b97c-8d259cdca6d2", "comment": "Malware payload (RedLineStealer)", "value": "ad963cb627409de663226056ef5f826e173b81f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189025, "uuid": "8f236a6c-0fed-4631-bb9d-351eaaf0b496", "comment": "Malware payload (RedLineStealer)", "value": "bface69bea233021c13ddcfa318340d0458d1da7b5de22670c86205d3a0e7eb8a31fe4135ed55b6ba2b2682602f92188", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189025, "uuid": "c58bb410-0069-4897-912c-da41fb67ba60", "value": "T150C41212FAE85036DDB21BB058FA13931B36BDE2987483172685D95D2DB36D0E83137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189025, "uuid": "c2df5a5f-117d-4dc0-bdf2-c0e28d9e6d49", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189025, "uuid": "8523433e-0a46-4baa-be32-95226d72bc1a", "value": "12288:GMrFy90Q30FgQZPMq7cajlw/MicayDP3ds69nmtk:jyhkFgI7fuAnDPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683189025, "uuid": "a1f11deb-67ef-4186-b706-b1e6c2626ea0", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683189025, "uuid": "891465f6-069f-495f-9ba4-59f8f31e07d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189025, "uuid": "ef4def87-bd79-491f-a5fd-85d095715a26", "value": "2a7650ca338fdb9165b567afbdf1f46e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072e370c-ea51-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683186925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186925, "uuid": "6bdd42eb-8b24-4ca1-8056-c627c5d28d79", "comment": "Malware payload (RedLineStealer)", "value": "32916c9d40edcdd53de74522d436df89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186925, "uuid": "ae03dec0-0cf8-43cd-9083-28c1da4b9631", "comment": "Malware payload (RedLineStealer)", "value": "77db7cd9e4f2ac402a07827f41de516c2138fc7972a9cc76fe6eac392429283c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186925, "uuid": "386d72ac-2c19-415e-963a-10c82fdf1799", "comment": "Malware payload (RedLineStealer)", "value": "502de0f948504d0ad621990f5cbe331168a81f4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186925, "uuid": "476158af-fcb0-433f-ba53-9bc185137c08", "comment": "Malware payload (RedLineStealer)", "value": "3de53d2e699bacd52a72e8699f4eab8271f1bb561c34c53538d08bc419d6123ca9cff217b755e4ffaa7e6bbea04a18d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186925, "uuid": "bf063ed2-5e5d-491a-bd30-378a53063afd", "value": "T142752303B2DC4471EDAA2B7109F7639B1B32BD978C358A5F3F42814A0EB22915475B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186925, "uuid": "eff1762b-3078-45f7-97c8-dcdc999f8164", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186925, "uuid": "e4106b63-7365-40a8-b8c2-c762bdfff352", "value": "24576:/yUp09So4kHOapvf6ymZqdiEDxumZP73acemeLmIGLskE0GBH6TwB/iL:KUp0A8HOIiy731P73nemuTGLZ/G16/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683186925, "uuid": "63f90f6f-55cc-4834-b0f5-edd8a9e56c42", "value": 1616896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683186925, "uuid": "284d6c80-2b13-4f94-b765-096ba8503c6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186925, "uuid": "0ce4a834-4075-4be0-922c-949c7ca9a22a", "value": "32916c9d40edcdd53de74522d436df89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce4da05c-eacd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683240516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683240516, "uuid": "7e5c0ea3-c0ae-4dc8-a597-5a8afbcfba3c", "comment": "Malware payload (RedLineStealer)", "value": "8f3ae1a86ecae1feaaf87e2a0a5047cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683240516, "uuid": "34c82834-26c4-4c36-b6b8-70e3fdc7a867", "comment": "Malware payload (RedLineStealer)", "value": "77dcb21bde4c1aee18f2ae4a5129d51cf2dc4b1747eae543ead0a5563bd8aa90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683240516, "uuid": "2fe23fec-4c2a-444b-b057-64114c4b6f6b", "comment": "Malware payload (RedLineStealer)", "value": "d645223379fa16917360fb90b1d33a37aee6b9c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683240516, "uuid": "61466dc3-7233-45ad-8b5e-045be155e76c", "comment": "Malware payload (RedLineStealer)", "value": "970d2cd099d244f93b0c3fff371bce60873433446a88236d6a6ec8e220c4d5e32d66df63bc9f18902cf6d71130c93738", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683240516, "uuid": "d1453f39-a894-44f9-92ad-b27edaf40e00", "value": "T1F0943B5352E13D98FA264F729E1EC6ECB70EF1508F59376A22199E1F04B12B2C173B85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683240516, "uuid": "de443100-5326-451f-a2cd-6294c8829c8e", "value": "405d30f2af5701980296932df5084009", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683240516, "uuid": "acaa5851-097a-4a6b-b6b8-381a2ea63657", "value": "6144:U5xMv6WLFzuYVJqlsf13WJf2GtOvt7g4bE7t:4xC6o1LVzf13gfjOV8wER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683240516, "uuid": "cbbda6ae-591d-49b8-b4aa-a596c43d1c93", "value": 420352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683240516, "uuid": "99b2e224-bdb0-4f02-b7d7-1127690e370d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683240516, "uuid": "627ed591-e03a-46f6-b9d0-0c248cca73dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a133271-ea8a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683211545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683211545, "uuid": "3e7a3543-8b59-40bb-9106-bf4c307201ff", "comment": "Malware payload (Amadey)", "value": "54f53357b293cf76139150658b542c8a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683211545, "uuid": "c9140f64-17a8-41d4-9cc3-74a4d86dd8cb", "comment": "Malware payload (Amadey)", "value": "7909f994ad368b74ba6df0c215c7ea02c04807a63217019b456eeab4c9bf6f33", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683211545, "uuid": "558c1dfb-4b17-45a2-8d43-7d7b0cc2ac86", "comment": "Malware payload (Amadey)", "value": "859f09c5229bb26a22e7418a1881469a8625e6c8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683211545, "uuid": "d9746c53-b76a-4efa-8c01-56b9c3fc1b07", "comment": "Malware payload (Amadey)", "value": "2c27de8c31aebc09e68bf8f1e0c732b8a533858d67c46d0e0bd03424d7b1b9fac996599f776eff4f2eddb623d9c40f86", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683211545, "uuid": "99ffd2ae-86b5-4f4f-b5a1-0d84a2edd797", "value": "T112F41242BBE85133E8B02B7088F213931E36BD52ACB9D35F22C9A95E1C73251653537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683211545, "uuid": "07f682d8-f857-42fe-92d2-3f47d7861435", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683211545, "uuid": "974ac2af-0a0b-4cee-815c-57b0fa6f306b", "value": "12288:fMr/y90yNmlyk1G1WYaBh3o+gUocPKdwEfERwaxWgHSxrC:EyOGZaBh3ofxBwRR5xWgylC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683211545, "uuid": "4ffdbc7a-fbc7-442f-a3bb-9c33a6393de6", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683211545, "uuid": "795bd6b0-c4d5-428b-8d1d-bcab01080073", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683211545, "uuid": "5eb69d43-97eb-4a3d-a0f1-c29d16fe02a6", "value": "54f53357b293cf76139150658b542c8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f556b7-ea4e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683185715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683185715, "uuid": "b0a72bb8-e962-49f9-992a-e640e4ffdda8", "comment": "Malware payload (AgentTesla)", "value": "17c3bbffc1bd127c4ce726f4b40791ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683185715, "uuid": "2247ade4-3002-4034-b49f-0ac9de12c548", "comment": "Malware payload (AgentTesla)", "value": "7a06d8aeb3e91c50bb2b2ae3e309fcbc2a01e7871c834508273401ffeb806359", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683185715, "uuid": "a94b0e98-3570-4c7d-bcc8-5589ce8065d9", "comment": "Malware payload (AgentTesla)", "value": "a05d1dbb89ffd70c9f38a263355817650d09ecf5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683185715, "uuid": "12dcf068-aa2e-454a-938b-db41966721a5", "comment": "Malware payload (AgentTesla)", "value": "9779d5b7abf7c46a7e2ba581e2e57fc2f35a6b6c5f9d2a7c8f617ca0dbf4e6148220800478c0759427cf2d9ccaa6bf73", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683185715, "uuid": "f8d73af4-3937-44a9-b5a1-693be5bd7cbd", "value": "T1B9E48C569014C82EFE56EB71C1B5FFE4A6F1FD7394D5142227793888EAB9F021E8C128", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683185715, "uuid": "1ab4718b-400b-48f3-bfc0-7ff474c3d626", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683185715, "uuid": "6542b705-2991-40e1-ad2a-c926be5e1672", "value": "12288:aOBoVOxnueUElgvvxsXxs2egQVtb/iWlui8YjJMhqrLF46C7YBmmF1118r/tvDfp:OO3UElyshsx/HuL8rLF46C7YomF111OT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683185715, "uuid": "d2b0f0bc-d37d-4e00-86a3-24a2aa5c2a58", "value": 686080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683185715, "uuid": "2d82e2d5-5473-494c-927f-79dad7ff5607", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683185715, "uuid": "3db6089b-9f43-42e2-8c94-ba3a18be24c0", "value": "Purchase Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e37c0879-ea94-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683216071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683216071, "uuid": "dffd27a8-4494-4695-9fac-953cbc1e74f1", "comment": "Malware payload (RedLineStealer)", "value": "0a94cdc7f14c7b50dc7425297141a021", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683216071, "uuid": "1d9eab48-65f3-44dc-a07a-134cf8597d64", "comment": "Malware payload (RedLineStealer)", "value": "7b7ee1f873f81bc52e0b8491408a75a2baf5a2ba90be5fbab270de2925144548", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683216071, "uuid": "33dc00de-aed1-4549-ad76-2e0d1c9c8b0f", "comment": "Malware payload (RedLineStealer)", "value": "6950b29e230fa26f6d5b49498efd9f53d2ccb5f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683216071, "uuid": "013b71e7-5bf6-450f-84d1-0937f1ba7be9", "comment": "Malware payload (RedLineStealer)", "value": "19e45c1fbb05224d5a8acfcb60b4272d805b0081adced57eb54455695dfdf47eccfa7dc9e96b2013ff7b027e47e0047a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683216071, "uuid": "848a28b5-625f-4011-870d-f9647ce864a5", "value": "T195F4125292E88132E9F65B715DFB17830B3AFCA1EC3853563B9A585D0CB31D4A43236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683216071, "uuid": "b65a407b-3630-4708-9815-e8a80e252470", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683216071, "uuid": "8c2f0719-71bf-4114-8ae7-72784f61bfc9", "value": "12288:mMrRy90RkU1/M0fvK0QxHxI9nu/Y8Sv/s5am8aHdI/GIkYBN9:fyCkU1ZMjiuAGfHykYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683216071, "uuid": "b670e595-8803-457c-82a8-345d63d9bbf2", "value": 723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683216071, "uuid": "9c3e3898-1ea2-468b-b44d-86adfdb7fca5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683216071, "uuid": "b4b0a664-c60b-48b3-9cad-4822a997131c", "value": "0a94cdc7f14c7b50dc7425297141a021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "207f416b-ea68-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683196846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196846, "uuid": "9f68f166-2cc6-4f22-bba2-60ee4359a36b", "comment": "Malware payload (RedLineStealer)", "value": "1fa8172068c383b6742fc50897149954", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196846, "uuid": "41b4d3d9-7cee-4ebb-a7ed-8f5867889a10", "comment": "Malware payload (RedLineStealer)", "value": "7c4ebcaf1d2abc959792b8b81738f776175f652083e7b921ea3140a5a882293d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196846, "uuid": "b7db3b32-86e6-4fae-b24b-cfce01a0289d", "comment": "Malware payload (RedLineStealer)", "value": "910afa70b47c0f020fa6014490e7350a137e6e45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196846, "uuid": "48000bd7-9914-4c6f-a5b9-099e2eb20854", "comment": "Malware payload (RedLineStealer)", "value": "eb44a0a5e7646fbac827d7b1e75e0f539cdda3b8968a245ce00738ac45add73c0a432a87786fe0fe397b86a53a4be459", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196846, "uuid": "6b14e196-0550-4ced-8a05-759d9b1d5054", "value": "T1D675333663D68422DAF6533004FB57932F357C628C6C83562767A98D2DB38C84E75B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196846, "uuid": "f0a87b38-ceb0-456a-a8f6-85ba42ab0f63", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196846, "uuid": "636da2ee-829c-4041-b83c-d26b26595eb7", "value": "49152:2hv2vRUGSl+xlI+RdQMhjY9UD+iHOTkfJNao:yKRUGU+xmudQcju1s8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683196846, "uuid": "a6e36a16-522e-4067-ab30-45cb4c20a546", "value": 1620480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683196846, "uuid": "4aa48b53-ade8-42b6-87ff-86d3ee5d90bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196846, "uuid": "d7489721-2deb-4c40-b325-6b2f0982dc47", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413d2e87-ea50-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683186593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186593, "uuid": "227c849c-6f61-4474-b3fb-2c01c498708c", "comment": "Malware payload (Gafgyt)", "value": "6878198993856de67fe309b01edf0fe2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186593, "uuid": "619aa19a-6f08-4132-b451-26d9d1f4e80f", "comment": "Malware payload (Gafgyt)", "value": "7cca2600e4098841bc412ab5240c4b966f4d2a8a326c4e4117179b8225f59276", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186593, "uuid": "31274c0d-5d46-4a03-9593-6f175d9bd1cb", "comment": "Malware payload (Gafgyt)", "value": "cfeb334cdcc414d981696a468d51df1354d1ba44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186593, "uuid": "bb4842f0-b82b-48fd-b870-7cd6567e666e", "comment": "Malware payload (Gafgyt)", "value": "e6bab9204de5d6701804b29daa139c3dc74f607b6b4452f8a44e418e5b7e3827187cf97557030baaf7b022207b172747", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186593, "uuid": "be4345e7-393d-4f1b-a4e6-05bff0e754ee", "value": "T1D9632A026741CAB3D4831AFA06E79B250633F83A1E16DF56F32D7CF45B15188B22B769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186593, "uuid": "ef1479a1-ca12-46a5-ac24-2424308b1a8f", "value": "1536:MYVYPCdH1jUdOn4JymPWBSgSh1MtN4r/NbHBDSDmd+l2OZ/fufYEZ:MYUCdH1gdikrEHM1I+rVbJSDmMl2OZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683186593, "uuid": "da7aed88-ec42-4870-a5e5-aedd09a245f8", "value": 68252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683186593, "uuid": "8b135b3c-6c00-44cf-b99e-de4b32e06f56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186593, "uuid": "72858700-5bbb-4555-880a-2148f398df22", "value": "6878198993856de67fe309b01edf0fe2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23cff041-ea50-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683186543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186543, "uuid": "0a8952f4-41bc-4528-8346-480b084f24fc", "comment": "Malware payload (Gafgyt)", "value": "5dbcce122f45444960173860aaf93428", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186543, "uuid": "8d30c9ae-9373-4456-a3fa-3975c8996976", "comment": "Malware payload (Gafgyt)", "value": "7d564bea9b2ffa6dd549ba2eea66a60c7f517483e12dac718d4b11f8fb68b482", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186543, "uuid": "ea8e28c8-2d3a-4b12-9dfc-dc296b2cca88", "comment": "Malware payload (Gafgyt)", "value": "f957dff50be6eca65b7fb40a450d080186ec02c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186543, "uuid": "e332cee1-1efa-47a0-aa10-916438c014c6", "comment": "Malware payload (Gafgyt)", "value": "22a7204947f3030d33953f38558a0cc2e2e6f34a1cf967f62daf8014cbf42e1a41c2e07266325c4d17f0aa8e4e860811", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186543, "uuid": "37f1651b-1595-480b-b55b-56b91731196c", "value": "T184F2D14CF1AD1912EEBF7CB26925C3996FF10F9AA2C8FDD11285972022568117708EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186543, "uuid": "c4c1dae5-b0ca-47fc-a799-f4c659e6b69d", "value": "768:6Ryd4PkzP26gQUPf9ioCn3FoHHFW/q+r8r2iKP4uVcqgw09xJo1Qm1X:Gtk5gLbC1xS+F/4u+qgw09Iem1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683186543, "uuid": "9a533e62-323d-4116-b28b-ccc1eb8c81fa", "value": 35748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683186543, "uuid": "b5638f7f-226a-439a-b2c2-c2ff66a04b39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186543, "uuid": "00c7b0ad-c1e2-4428-80af-845c7d30968f", "value": "5dbcce122f45444960173860aaf93428", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0a3287-ea4f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683186320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186320, "uuid": "ec7b4867-40b6-4b8d-b382-a8f9e5ba945d", "comment": "Malware payload (RedLineStealer)", "value": "f3aaf72abb2344eb48ca5f103646c06c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186320, "uuid": "77c00524-8a3b-4ee6-a4c9-588a4e7a81de", "comment": "Malware payload (RedLineStealer)", "value": "7df38a5b248b4f35e4e122ff54e0adc6a90a78f437b05992e6eee0941ac4776a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186320, "uuid": "fc315c44-0462-4983-93cc-99cbd8910987", "comment": "Malware payload (RedLineStealer)", "value": "4a7e2812a467a010c5629be3ff40dc041e9d6ea2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186320, "uuid": "73b39bde-12de-4606-8e0d-5b0c9d3efb64", "comment": "Malware payload (RedLineStealer)", "value": "8992e1c504df89fe1a639b91e994b8ea302b1f8f9f19ed050e17b0d63c7893367b261817e3c48985382d4ebf83207c69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186320, "uuid": "3e62e121-6640-4cf5-8854-0fa140b5f9a3", "value": "T1CFC4122296E98033D8B52774ADFB56830A39BC6198B4D35F23856C9E1CF27D0A935337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186320, "uuid": "6014e2e4-2818-406b-8b97-8cd2da24757b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186320, "uuid": "04bd4e27-d783-4849-952a-969faaf46049", "value": "12288:0Mruy90UVWZIqYbnvZrvWhaBM/g+hOlh3McorbH0ME3:yylIwbvkaBM/g+hYE0d3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683186320, "uuid": "ce140912-4b01-401e-8c7c-17314a8d40e5", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683186320, "uuid": "acac2491-bae3-4071-a25a-ff0ee74d3d50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186320, "uuid": "f8ec4c64-dbaa-428e-9138-3e79f3d5f49d", "value": "f3aaf72abb2344eb48ca5f103646c06c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f076450-ea7c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1683205514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683205514, "uuid": "dddf7ba5-7bfb-4907-b2f1-90311954d955", "comment": "Malware payload (zgRAT)", "value": "7d4779a7d8f81b5daeb1792ec877391e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683205514, "uuid": "c4144a44-86e5-4561-8faf-82870c708662", "comment": "Malware payload (zgRAT)", "value": "7efd463e5e5dc8813ac8699a062f4db75e2d15458ece544b81743d9c8e8a714f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683205514, "uuid": "631509cf-db72-4f85-bca1-2349cec97b29", "comment": "Malware payload (zgRAT)", "value": "ef73ec252b42e8137402a9b8fa2c4a7ae416ce3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683205514, "uuid": "282f922c-91e3-4393-886d-346aa0a4dd90", "comment": "Malware payload (zgRAT)", "value": "540b7b45f73a31e7eb8fb25eb203cda6b8825a6a89bffdf8b359d92ea6f02c11317d70bd7abf8155cfa2f07307a521fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683205514, "uuid": "03dda504-d309-472f-a6a1-dd7675a4f0ef", "value": "T17F050209B154AA5EC44ACCB5D5EB5D2093E29E832333C3476653229A0F0E7DBDE452EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683205514, "uuid": "1a2df46d-2d66-44db-9bc7-124cf3285ca5", "value": "24576:C3i3g80SQKFakJ0CW9qFPCGjrtpMteMGUv:Cy3g80SQKskyGFlwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683205514, "uuid": "2fe11ce1-f5cc-4ac8-a17c-0f3a454cfbfb", "value": 827464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683205514, "uuid": "5599222f-ab15-4ac8-8535-a92587d5b48b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683205514, "uuid": "e090dcae-06e3-4ab0-9cf6-182dbdfb7658", "value": "New Order 24-23394.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a690faaf-ea58-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683190199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190199, "uuid": "e481b6e9-eca5-4db0-924d-b704e13d4dc4", "comment": "Malware payload (Mirai)", "value": "da1dd85a4c0caad250e12ceb09a7ebec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190199, "uuid": "2364b24c-e089-41fd-95f4-f2852e019085", "comment": "Malware payload (Mirai)", "value": "7f295bcbb274edcdf9b6f927ca1bdb48ae7052d72d14563794c13073a811bfad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190199, "uuid": "77eeb22f-8c4e-4256-885a-9bffb5743d01", "comment": "Malware payload (Mirai)", "value": "a42dd1975668a14540656802322b0b84a631865d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190199, "uuid": "9d5507c7-cc04-4079-84b9-0d5683e4717b", "comment": "Malware payload (Mirai)", "value": "d5f5a9eb0e5721df2412ada3a75e8796ecedbdc704785172d1583787c3bff607efc67ac0e7c56c6c160be2e753a10658", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190199, "uuid": "7f50977c-1c10-4d19-b060-76d5e4c12e49", "value": "T17133F2E0E373EB12E26251AB080A49DF0F0E1BE8916E3515D33DD99C15DA8144BFDACE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190199, "uuid": "716c67bd-48f7-49c0-9d3b-fe792a8b13ff", "value": "768:fPyuZr6HxkmEt3VY92uqUZlKOzzOTMoUH27J+nus9q3UELVVhRLRP5/JqpecU:Jq43VTU6OGg6+nu1LVVhRNRgpecU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683190199, "uuid": "dd153859-2dde-4110-b044-080a92325690", "value": 53672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683190199, "uuid": "f2f20026-a4cf-4f9f-ad1f-29bed7b1bf84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190199, "uuid": "a02620dc-dad4-4634-9c76-00c9509fa32b", "value": "da1dd85a4c0caad250e12ceb09a7ebec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac5ec64-ea53-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683188031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188031, "uuid": "1c24b46f-dfe1-43fb-8836-d84f35edb725", "comment": "Malware payload", "value": "e5eb107fe50f47b353b9bc7687d1905f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188031, "uuid": "9b55d480-45ee-4ce1-9b78-6e3c7467e45f", "comment": "Malware payload", "value": "7fcf9653d7bad148de3e8431f899679032162e89235ec0a93642f75a7be98643", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188031, "uuid": "84fac5dd-c2af-4354-acfc-0e6b1d5a9064", "comment": "Malware payload", "value": "6b82debdd2b5007a5a97c8c36bc7e0a390b6afa6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188031, "uuid": "632af659-2d10-4f49-9df0-874cc5d7991e", "comment": "Malware payload", "value": "7d50086b2098efee1235917243f207fbe9be4714b1f3b8e2abf6a0ab528fea1b09fbc1a09c049e37972423367fda9404", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188031, "uuid": "a907c257-7f9c-46f2-83af-68e11fb5d923", "value": "T1A8E34B05E7408B57C0D2277AF7DF424A33339B54A3EB33099928ABF43BC27A95E26515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188031, "uuid": "587b0f95-6a6e-4611-bd82-1e728f8dc442", "value": "3072:Ib2NQviuoSKTe1a83P0+BCaJQM/9ISWHFwmhwfCHQC2W:Q2NQv9oVTe1a6lBCaqM/9wlwmhwfCwCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683188031, "uuid": "e01d830c-dfaf-4dfd-89f0-7d1e4267cca0", "value": 144778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683188031, "uuid": "a94e59d8-6a17-4403-ab52-47f8c5422a6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188031, "uuid": "6d16befb-248c-40b7-b91a-e0401474515c", "value": "e5eb107fe50f47b353b9bc7687d1905f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0586ea-ea35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683175065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683175065, "uuid": "8c6191e0-34e0-47df-94bf-3540f7d02318", "comment": "Malware payload (RedLineStealer)", "value": "a03ac67b723ab520e723bfb5ce7ee63a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683175065, "uuid": "240d67f1-e3fe-44be-a79d-bd5902291b8a", "comment": "Malware payload (RedLineStealer)", "value": "809eb24c5a3bc2678f535a943a6d6a1be2ff4639222e95bb95526c1bfce05d97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683175065, "uuid": "d04ec8b7-86c7-49f5-b25f-b80d8e3426d5", "comment": "Malware payload (RedLineStealer)", "value": "48fbd7438e862c61bc5b83c6fb18ffd9083fecf0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683175065, "uuid": "6b0ea2ff-ba71-4a16-88e6-209afad11c04", "comment": "Malware payload (RedLineStealer)", "value": "421e10fe25412c0fdf096ff07c19c6308baea4c120c221f7247bf94162f5e684536c64abf966cae470503090fc5985bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683175065, "uuid": "d9b7cf52-9b6c-45ab-9855-e0cbd307ead7", "value": "T128753343A2D95169DCF92FB049FE12530F3AFC428E38426B6B06899F09739943D7172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683175065, "uuid": "bb645866-1e67-47ef-8725-dd15c32edce3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683175065, "uuid": "93380e8f-951c-4acb-ae0d-5591d7e80408", "value": "24576:xyms97P3IhtNPX8ttwLgVF/vJaKm8LxKXJlN3qpVomI+DYyS2H5J7GMhUfOJlbp4:k3wrMEKUKd67eVomH5dHvGMhW4Xc8pw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683175065, "uuid": "58ca3e50-9488-4682-b540-ddd0f31859a3", "value": 1552384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683175065, "uuid": "da074547-564e-44d5-ac51-9392a5cb29a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683175065, "uuid": "91739d2e-c4dc-4369-88bd-ea98f8c0b497", "value": "a03ac67b723ab520e723bfb5ce7ee63a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9a219a-ea6e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683199607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199607, "uuid": "8fb2c381-3822-4e1d-9aff-c3b075ad8de9", "comment": "Malware payload (AsyncRAT)", "value": "50d6b300ce22da9f608b15b41a388c11", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199607, "uuid": "e809f73a-e3e0-4a6e-80d6-4215e1b7a28c", "comment": "Malware payload (AsyncRAT)", "value": "817c463f2b2d6ad916bd11bdc8e81e232b443d333cb02a3943d28f11d206ccc3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199607, "uuid": "791ac1d8-2477-499c-a8f5-7b3a59fa20d3", "comment": "Malware payload (AsyncRAT)", "value": "9ebe111a35e3d719f517139abfa6ccc11555812f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199607, "uuid": "7b144ed4-0bdc-4d50-ab6f-5fcf317cd770", "comment": "Malware payload (AsyncRAT)", "value": "8ddacc339d36cbb710366f28a9b3b6930022e467113b5e8af9706eb046f7c5ed6412b7b91d053c10392a6f7a50c5cac8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199607, "uuid": "d3bf3a42-7af5-45a7-b85e-7fa77c611ee5", "value": "T144232B003BE8822BF2BE5F7869F26145467AF2633603D54D1CC452DB5713FC69A42AEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199607, "uuid": "984f8327-d003-4ba4-8859-6f7951134d76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199607, "uuid": "ac33ab72-bcd5-4efc-a3ae-74a948bff5a3", "value": "768:vuwCfTg46YbWUn8jjmo2qrDKjGKG6PIyzjbFgX3iyS48JvaBLBDZSx:vuwCfTgp/2OKYDy3bCXSydbdSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683199607, "uuid": "a6055390-d0c3-4274-a0cb-d1aaac59bfee", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683199607, "uuid": "504a6076-a152-4753-b48c-522c6f52548d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199607, "uuid": "6bb58444-8783-4da6-a443-c9e3de873085", "value": "payload1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a86303-eab3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683229231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683229231, "uuid": "8bd785c3-d022-4233-aa6c-50d6dbb37d3b", "comment": "Malware payload (RedLineStealer)", "value": "89e327d5d7c89d6864029c0719244e13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683229231, "uuid": "eee966ae-2f2c-4d64-b1f1-3a547815631d", "comment": "Malware payload (RedLineStealer)", "value": "81de0e1fbe3aa1236df011ba6be29673c3343d7fee3246e0a99dd713da8d89ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683229231, "uuid": "bd46a55f-bfbf-40b1-bb11-57e0315c2541", "comment": "Malware payload (RedLineStealer)", "value": "6e6fc65e476e5a1d757770f9983459acf663a769", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683229231, "uuid": "0d4bbdc5-4e4d-4e03-ae89-b66632add93a", "comment": "Malware payload (RedLineStealer)", "value": "ae5db48992efc874ec0bb7c1549a5b8594a1759071116aa550fc6c756aa6495a7e07859055d77459e39015290706274b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683229231, "uuid": "045bdca7-a02c-40a1-a66c-e97008497be8", "value": "T16D84F1476BE85033ECF427B019F603831E36BCA25D74836B2789A85A0DB3695B57137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683229231, "uuid": "bc4dc984-9e93-46e7-8120-1546261f8730", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683229231, "uuid": "21f2e26a-5b1b-45c6-bd17-fcaf219ec768", "value": "6144:K+y+bnr+Rp0yN90QEtDVJRIP/W7QJ6si3gYKHRPqV9qCoAkTKBLRlpKUiuA7Sj:+Mrpy903DVJRI0r+PqV9RoAkT4fphiup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683229231, "uuid": "72b20391-ab4b-4273-8aa4-857f1c54645c", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683229231, "uuid": "cc0b95d7-5694-45fd-8620-637acf425a2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683229231, "uuid": "07a35a65-5db7-4e8c-918b-a5517f0c13e0", "value": "89e327d5d7c89d6864029c0719244e13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15b7479-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683194163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194163, "uuid": "a83178ee-e030-4164-97e9-bc2de95f06d1", "comment": "Malware payload", "value": "754c6dd3f10579b467ca1ebd5a751cd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194163, "uuid": "ec81d382-2bbb-4eb5-bfd3-c1448451417e", "comment": "Malware payload", "value": "83a53690796de5780a8b73f021586574219b403c18f1371bc118f55384903ca7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194163, "uuid": "ec46248a-13fe-4029-b873-42465f227e18", "comment": "Malware payload", "value": "cd6652da1a4884e51ed70d7d005c2aa53d5c9284", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194163, "uuid": "deb88914-3b1c-46fb-943a-698622eecef7", "comment": "Malware payload", "value": "a7aa3cace3c9a4ebf542e3b0143fd97053f5f79410f411295be8271b86a2f9c871f4978b16b659866618b69e67d2deed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194163, "uuid": "1f358d88-df79-49fa-b4f4-462a004bafd1", "value": "T194B13AD7B614242BC4D5867807D393A0BCBA6834C9B9D60BA4D4E30F7C95350BD16FE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194163, "uuid": "04a28bc2-bd42-429e-ab98-9fccd4efbdcc", "value": "48150c09e4e291e147a416f3401fdc4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194163, "uuid": "076dada6-ee7a-4135-aaad-5700b56fcc2f", "value": "96:P+wg+y2nOWVRyLwTWQOA3khJluU4Ap/b9ikq9H4:P+w3pI413kFAAZ9i1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194163, "uuid": "92da7683-82d8-43b9-b00f-7a083f5e9918", "value": 5152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194163, "uuid": "10ac52d2-29f4-48e4-9cc2-36d3d1a2f523", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194163, "uuid": "df74904b-63ec-43e9-93dd-20007f4c6dda", "value": "SecuriteInfo.com.Trojan.Siggen8.48936.16618.1009", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d32254f-ea50-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683186586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186586, "uuid": "044826d9-2e7f-4c35-b2c4-f7144c27ff95", "comment": "Malware payload (Gafgyt)", "value": "4c386a5692022fbbe0286e3531b16643", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186586, "uuid": "0c71e0ea-1d47-4794-8a34-6b34cedab627", "comment": "Malware payload (Gafgyt)", "value": "83deee68edcd5797f4133c850243e3218b6ee5989468ca60422db1bf1e53e73f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186586, "uuid": "d7cc3bae-b096-4857-887b-334b4892b9d9", "comment": "Malware payload (Gafgyt)", "value": "cb93848efc0b615f22a64cbb0c604fe064351c51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186586, "uuid": "cd3ef867-c2c4-4a88-b1c7-ee42f4cc1004", "comment": "Malware payload (Gafgyt)", "value": "cdfca9649e70f8d059b4635d7cd852155792cb0f60e297231a4ce94a717aad9e6630f873628a789dbd2784a43026cc13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186586, "uuid": "ba19db9c-b4bc-47e7-89cb-36c860f2f48f", "value": "T12613F110772DF5A2CB360C3CEDBA0A4D78FA85ACF1C973761994F284DA611474EB6C42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186586, "uuid": "956b0a95-4331-4fa2-9f04-ea3610cc137f", "value": "768:385lx7CS3fDmaD7L0Xw/x1fcGA/XyJWP77QWJEWOEPww9q3UELmJWoGH4gdS/d:3a77Lm+L00/q/XyY77QWIZLBoi4gEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683186586, "uuid": "a147d587-3a48-42dd-a624-78e531a21e32", "value": 45220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683186586, "uuid": "ad1748e8-44c8-49f3-b3a6-31d2010bb5a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186586, "uuid": "95ae892f-a7e9-4574-8a97-f487a043cd1a", "value": "4c386a5692022fbbe0286e3531b16643", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a10ee47-ea68-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683197023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197023, "uuid": "35b7ed0c-ff18-4179-b265-aba9bba7008a", "comment": "Malware payload (AgentTesla)", "value": "1d649a5852458298d8c6d2f5ab5bd275", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197023, "uuid": "ad7c6d89-2499-49c0-96a2-9dcc91dc0eaa", "comment": "Malware payload (AgentTesla)", "value": "85356ef96af996a05fb53ecdaf9b2559a05d0fc23874e8b97a64a46a28ad498c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197023, "uuid": "042ff359-b3a8-45de-83e5-cf01f14e2eed", "comment": "Malware payload (AgentTesla)", "value": "713e5b43a96891820992795ccf6e0fd53274f536", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197023, "uuid": "160493d0-8426-458b-bc08-2799896b49e6", "comment": "Malware payload (AgentTesla)", "value": "9ae10e385a32fbaf77ed4c66d912fd70abbd3b07bf7f60bdc5b4985b197d74fa85fcca576c770ea524b4d9ca0746fd8b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197023, "uuid": "9240b365-1952-4e71-9d2b-e3698897e212", "value": "T14ED4AD535065CE4FFE2AEBB0D1B4FF55A6F1F07364D190241BB92189CAA9F021E8C52E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197023, "uuid": "1577d7e3-7416-476f-911a-affd4fa1dc36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197023, "uuid": "584e32cc-5383-414d-a42b-935d09ccbc8b", "value": "12288:LwMKcrQ58Hbp0dr5RRr5X4ou/897mjft1CegQVt:LUcgdNlNTdWfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683197023, "uuid": "62f97554-be2c-4555-ba08-10353d98a697", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683197023, "uuid": "6fa9e4dc-417a-41de-81ba-e3d50a4375ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197023, "uuid": "b71e4bd1-e608-4196-bc37-772816bd49a2", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d8d6b5-ea7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683204800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683204800, "uuid": "d5a5de67-1110-42e2-a1ff-14175588028f", "comment": "Malware payload", "value": "78d797a0334960e8c713d84b32b89a81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683204800, "uuid": "3e266d3f-9f0e-4f3e-baff-838ed4d1f884", "comment": "Malware payload", "value": "86300a69cc977719c780c5d8c54737ee11677ee81acb78b1838bf59323915478", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683204800, "uuid": "1c92d650-518b-45dd-9acc-fa82bb2e2bdb", "comment": "Malware payload", "value": "88063fa0f93e8e4f2a9c96ca02cdb96bc4d621b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683204800, "uuid": "76cf5ae0-9178-4fea-8bdc-d0644e3daf72", "comment": "Malware payload", "value": "50b885ddde0b985ace251e544a4f218d9d2694c236ee97f2013510dca3c1f4380be875f3087888e5bb77181ae8ff8ba8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683204800, "uuid": "7f6aa2ee-b9d5-447c-8ceb-77e177f738c5", "value": "T1CD342A6E60DB950BFD29CCBA7EE4B652C7661754CBD7C2F0096A71202A340DFCC0A5B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683204800, "uuid": "ec3d81c4-e43b-42d7-aa34-1fd0dd8c0808", "value": "071307373db47402e881a4d65e0a19ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683204800, "uuid": "fbb58b91-85c3-46fa-b46e-3b770ee500b4", "value": "3072:Gp5ZzzBwAOBtnrsUcEzCVXt6x4RC65I7z49r6P2pL1kjdX4AaBL7W5nD1wNQqxBX:G5oKf5APdjdoDwD1HM4rOho0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683204800, "uuid": "ae9eabc3-9d31-4b88-a351-12227c63e390", "value": 249696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683204800, "uuid": "db454986-7bac-4872-9846-769a45ea6a05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683204800, "uuid": "47d867e5-3e10-4fd3-b7db-97cb920372a8", "value": "86300a69cc977719c780c5d8c54737ee11677ee81acb78b1838bf59323915478", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9dad78a-ea4e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683186017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186017, "uuid": "f2b9a0b1-d730-4a59-9037-9c63e393900d", "comment": "Malware payload (RedLineStealer)", "value": "59e7f32d80f3edf5908d45953df41132", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186017, "uuid": "56d2640a-ffe4-4a30-b610-835fd91f41e7", "comment": "Malware payload (RedLineStealer)", "value": "87404457717ec0fa22fc856eca66f7188b70a9013bcca89e7633ccb4c450bd89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186017, "uuid": "801b9abb-a491-4114-86b5-e31648efe118", "comment": "Malware payload (RedLineStealer)", "value": "8df78d7eaaa0d26f6c44fdba9b59b3c07452c83b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186017, "uuid": "9b0315a7-ef6f-4b36-9200-47c98766e287", "comment": "Malware payload (RedLineStealer)", "value": "2b38cca53c001c5a0417374ec91841b63d84195ca2620e0ee3c84932209648753a44938d0d549b1965b55ecdc2f92b61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186017, "uuid": "dfb12a80-a6a5-4094-b95a-7ae746c2c4f9", "value": "T18C752312B5D8E026CCA11BB0A8F516D73B367D229D3C93A31647996B1DB3AD4A43433F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186017, "uuid": "f8a0fb29-866c-454a-8335-fb71b4c87817", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186017, "uuid": "a7067c56-6512-481d-8ed1-da27754c6dd2", "value": "24576:EyxHK+fRZ2bAakSa+szHTLwzkNqvPlX5mATjFR4DG3xEphCrMuRbHtc+TA78Jeix:TxqqaAaQ3PklpBfFRcG3xEphkPBccPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683186017, "uuid": "b6180074-fac0-4c37-b858-7ec79f9c6c66", "value": 1550336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683186017, "uuid": "e9a6bf3d-33b1-418a-bad7-1ee958b8d798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186017, "uuid": "39df054e-e589-4251-a81b-024f88fe9b6b", "value": "59e7f32d80f3edf5908d45953df41132.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1959b13-eaa2-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683222027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683222027, "uuid": "1433d853-5f50-4ccb-8135-5005aec7b68a", "comment": "Malware payload (Amadey)", "value": "ae334f9c06fba1aed1dabd8778cfa184", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683222027, "uuid": "bf50faec-f833-4be5-8539-8da1b860e363", "comment": "Malware payload (Amadey)", "value": "8746fa4bd81cd03456f129e177c8a3e3201e39a4c185ed5341502e3975751825", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683222027, "uuid": "34b85e68-b47d-4c5a-acd7-1b4a961bad62", "comment": "Malware payload (Amadey)", "value": "b3f95000480ecce5f5903a489d2bee1dd20d4e9b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683222027, "uuid": "4d9cc820-b15b-465d-8d8b-e8dcf4f2f53b", "comment": "Malware payload (Amadey)", "value": "932c0beabf3ec8a6f80c0ce961b856b157024997fed178373ef020b212efa5932e06f57e2145f3c7821e203e3a4de76f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683222027, "uuid": "ec32c850-23e1-42ac-b1ab-8d99e91c5e12", "value": "T12735231AE7D80062D8F60B31A8F70397073ABDA5E834925BB795B94B0C722C5B871777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683222027, "uuid": "eaf2dd02-cfbc-4c6b-b031-09598933d7f7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683222027, "uuid": "b51e7c44-d308-45fe-9056-26a56001b0c1", "value": "24576:WyOXwY91jsb0FSiGMV5I6Kx08hdwYZFBeOxL7k:lOgY91jk0FSC5Ix08hpFBeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683222027, "uuid": "2272e857-4d85-4960-90ba-88f9bd29a56c", "value": 1124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683222027, "uuid": "8d417787-d05c-4e58-bb29-5eaa557d0a9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683222027, "uuid": "5463d01f-81be-4e97-b0e7-ce76ec6b0f25", "value": "ae334f9c06fba1aed1dabd8778cfa184.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f637a6a5-eaad-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1683226839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683226839, "uuid": "d00b01b9-7113-4197-9a45-8cce9bad2a7e", "comment": "Malware payload (AveMariaRAT)", "value": "e8d355ce1c914bb08549edec8272d65c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683226839, "uuid": "a72911a6-07d9-4c09-a0ba-db970c1991cb", "comment": "Malware payload (AveMariaRAT)", "value": "87ec8dcb44c20195f72ea0d6d2ac3572a9241bb1e0c7f770d8d13e65a4cf9155", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683226839, "uuid": "bc15ca89-f448-44d7-84f9-5e0a5d653156", "comment": "Malware payload (AveMariaRAT)", "value": "f805ebed65f5ba1be8bf400c4df3df95acc6325f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683226839, "uuid": "248eeff0-6e9d-42fe-98a0-cfea67d6682f", "comment": "Malware payload (AveMariaRAT)", "value": "c1efbc2db65b13ceb801d4a412d3406f63cd7665af0341cc0e272f1215ad9db452dcf31c31282f2c25676f329077ce7e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683226839, "uuid": "969fcec6-00f6-4290-b903-af1d8b0be3aa", "value": "T16CF4E1263379BB95ECF683FC6618A000AFB46D2453B6E6E84DC6A0CD5144F18FB50B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683226839, "uuid": "23e2cba7-7b36-4c27-9c5e-3624601652aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683226839, "uuid": "dba10047-5c18-4887-b7e1-667a4fa9001f", "value": "12288:OE11KkHRfqdoUL6oqfY7wfHMqJpr4g+5ToLPurCZiGk:lPKkHRfMoUL0fY7nqH+5ToqrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683226839, "uuid": "8e5180bf-e057-4c8f-b14b-6f52c225c8ab", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683226839, "uuid": "35cdc2c7-ce02-4322-86eb-5ab88a596b44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683226839, "uuid": "11ae894e-bc05-45af-b94f-3df632b95bd7", "value": "e8d355ce1c914bb08549edec8272d65c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1d8c9e-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683194159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194159, "uuid": "36f16904-3e9b-4df8-97d9-9a0f9de69d15", "comment": "Malware payload (Gafgyt)", "value": "24e8300810ce9bc37cd1ec5a5a0b977b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194159, "uuid": "b647737c-72e8-4287-b6df-04b60835c4f0", "comment": "Malware payload (Gafgyt)", "value": "880d03374e5b676372dcd97cf801134c552e3000a2dfda67ec566c3b75682078", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194159, "uuid": "54c54315-790f-4f64-acb2-822ac34c325c", "comment": "Malware payload (Gafgyt)", "value": "926cc3a5b3dfe3591159cf82bd3db951e79e4f3b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194159, "uuid": "0b8292eb-38e9-4c54-bcb1-0797d7ba4765", "comment": "Malware payload (Gafgyt)", "value": "a464e19ec32fb1e5b9abc5dcadbc2ab928dbb27555dfb84b0a01b110c99b0dd04ea5867fb46905f71e8c0b241dada150", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194159, "uuid": "752a47bc-cf6e-4f5d-b43f-55bd0b9d15f5", "value": "T173921BA9C9353F79D296F470E03426AA53A2600E8B5F0BD5071D9A52954FBCDF22F338", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194159, "uuid": "7cc4d5a0-e7ff-4dfb-a6a2-0aeae288bee6", "value": "384:Xes6lJiCQ55nEt9h/XdEEywYxDVzGLuz09FIEYgRlm4/m61Dot/iqBsSv:/kJiCQvEt9h/aEywYZz0TITgbmCoNis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194159, "uuid": "8c17649a-470f-49d4-bd4f-3b59fad47191", "value": 20212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194159, "uuid": "54f6b216-2be0-4348-a9c2-95f716cb0393", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194159, "uuid": "27e3fcc1-6f99-48e7-9c17-5f0efa6f0127", "value": "SecuriteInfo.com.ELF.Mirai-CDA.14688.23929", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7bee7bd-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683194173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194173, "uuid": "f601090f-69db-4acb-bab1-f04c151f5031", "comment": "Malware payload", "value": "7e05447f9630936edb05f358d32f31b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194173, "uuid": "97c7aa59-47a8-4a0d-8cd3-c5bc8ca183d1", "comment": "Malware payload", "value": "88a951915718243c52f744594072830e29f229f49009117f640cb7cc47aeea1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194173, "uuid": "1a70c38f-2de0-4ffc-a44c-712846b88a80", "comment": "Malware payload", "value": "d3a9ce9cd075ec38ceceddf0b03d254f56b1f22e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194173, "uuid": "da21011c-8b17-4ad8-a836-c69d9d46824a", "comment": "Malware payload", "value": "0af594f5c6ebd3dcd5ab0e7be4ed9b9e5bafc39b1def016d29d40395d6dd6685187b25fa88e2e2fde37cb2ed1a84b266", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194173, "uuid": "3043b976-f73b-4bed-9b20-68fdd229656b", "value": "T15B1523414BA2C030E212C2342F3BD6611B7B7E3A2D79B74B737E765E9E3B6516902B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194173, "uuid": "32d355c7-2e8e-4f54-a4ff-27a82b25136a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194173, "uuid": "abb69b17-fedd-4660-b09e-ea563411e5e4", "value": "24576:Q20uy0/on+yNu/igtE/OJQfqCa3Qp1KPJTf4:Q27hybj/Qgmr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194173, "uuid": "8beb5a15-9979-498f-9b5d-f41f24f8396c", "value": 955598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194173, "uuid": "303dbda9-59b7-4940-857f-6c69b452d883", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194173, "uuid": "3edbd01f-fde5-4384-81ca-c3d9e8cfcda6", "value": "SecuriteInfo.com.Adware.Relevant.149.1548.21976", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e6d482-ea58-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683190177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190177, "uuid": "ceca9486-c547-4fae-9972-ea5bf573f436", "comment": "Malware payload (Mirai)", "value": "fc4a250ac4c05713a36985e988cbb93f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190177, "uuid": "400b2418-7a88-497d-be8d-b9c9017531b4", "comment": "Malware payload (Mirai)", "value": "88b3f6cd30a25ed7ac8ad1a7bb10f22b0aabf46b474e82931b9fe817193b2360", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190177, "uuid": "d42a8b98-b33d-40d9-8cc2-892cba5f8b04", "comment": "Malware payload (Mirai)", "value": "277feb74b4c2ce7674c686286abf27a1b24fdeb6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190177, "uuid": "23721ae8-e8e2-4133-b889-d53cd4600008", "comment": "Malware payload (Mirai)", "value": "29e12d8741ddbe428f458deae7499276efc2797921fd436f0ce0971e42321aeabc38e93f3b9b51298a6ee2bda6448cee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190177, "uuid": "6e563c5c-5bb0-497d-b7f0-1bf8140cbbe6", "value": "T13E539EB9C4E8ED98C6684578B714C93DD723900465D33DFAEB46CAA7800BAEDF0097B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190177, "uuid": "b862b993-9cb4-486b-bc58-097e42b24a5a", "value": "1536://BMsvJvJabwtlw3bqSsH6aOIy/Cfs32j/JQZI1qhC8Aa:/JMSR893O6aO+f+uWZIYhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683190177, "uuid": "1dad9684-0369-4e01-bf6f-862025e26856", "value": 66368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683190177, "uuid": "e6e67809-7c4d-4a18-9b28-307e798eaa64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190177, "uuid": "5f36d5f7-0dd3-4628-a1fa-614d66f0e1cb", "value": "fc4a250ac4c05713a36985e988cbb93f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a49ed148-ea41-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683180317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180317, "uuid": "27c3c356-efda-41f0-b164-c929419a3e16", "comment": "Malware payload (Loki)", "value": "959be48362a0ea1e909a8c5bceeeeb51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180317, "uuid": "a42de3ac-31c7-4ae7-b9a2-b2162ddd52c2", "comment": "Malware payload (Loki)", "value": "894cd5c6a63bd35486dd0e8e51a7562a8abd6655d405a588dfedc262b2d3713f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180317, "uuid": "9bb041fc-5f77-47a9-b53c-3fd25ab64cb6", "comment": "Malware payload (Loki)", "value": "8ab780ffcb18d9541be1dcadec306c6888c7768a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180317, "uuid": "7a010ef2-12a0-4039-88c5-31d9ca80853c", "comment": "Malware payload (Loki)", "value": "5913dd2f2e499f753236bd54fb926886806e9e55aa00a5aed4bc96d960726d18a1dd7dc73e3e5ce1ef41e54e97b4431d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180317, "uuid": "bf696509-8dbc-4981-ac9d-0271cb5d3b0d", "value": "T103D4D0E021BA8792D03A87F01078F85013F671AB75EEDE160F9670D95D9AF502E89B4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180317, "uuid": "b2b876ff-3518-43d1-9a9c-cafac0831fc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180317, "uuid": "fdca838c-cb2d-4362-8634-8c3b4b696230", "value": "12288:jzni4Iy/u8q57SoXnJpmJG05vdb1xMZAIoWof0q:jzg57SSQDoAIoWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683180317, "uuid": "944738fe-7502-4ecb-8514-741f7efead79", "value": 633856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683180317, "uuid": "5f11d190-07bd-40eb-bfde-3726c2a6528c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180317, "uuid": "7c455611-2b5d-412b-9dfe-c357c41a97af", "value": "959be48362a0ea1e909a8c5bceeeeb51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e41d5bc5-eaaa-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Expiro)", "timestamp": 1683225521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683225521, "uuid": "ba2e88b2-6ba8-49dc-b150-e6e681c5e93b", "comment": "Malware payload (Expiro)", "value": "3d1072986b88dc6184e40ba0df6acfc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683225521, "uuid": "0a1c19bc-1895-43b9-895d-e2b53bcb9617", "comment": "Malware payload (Expiro)", "value": "8992b94e147a940a1da05b11631e28202c50840902fa372690485b49c415e4b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683225521, "uuid": "a926a8c6-5700-4de4-b188-d7adf6887b35", "comment": "Malware payload (Expiro)", "value": "3dced4443af3c9591c948c827ac5b02bd0d31029", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683225521, "uuid": "b74e33ef-9c3b-4ae5-9ade-f7ce7141c0fc", "comment": "Malware payload (Expiro)", "value": "3439fb22577d56359e5d336d351874534cdbffad6ba0eb87562a2bb3d57c0328036ef58814d84862e97e85a65ea7fd30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683225521, "uuid": "d0c4da9c-ab5c-4755-aeec-920490f87ce9", "value": "T1D475122127A6BB91ECF6C3F83608E400AFB16C5457BAE6DC4CC7A0DD5154F19FA10AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683225521, "uuid": "199722f1-b09c-4c85-98d6-d15ef368d81b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683225521, "uuid": "584d7f64-17f4-4b39-987c-42e58800b821", "value": "24576:rPKokfY5HGAg4y2oLeeHlQFwSohxt3jIwYg94ZIgUZ8K5BEuww4sXpA5jp9DTS2I:LZWY5mz4yJSfu/9IwYgeJuw7sX0jpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683225521, "uuid": "0f99e3ab-4b04-4721-9479-375b271ddc7f", "value": 1656832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683225521, "uuid": "3a47f4d0-1b9a-45e1-bd63-be4d0a6ec27d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683225521, "uuid": "6bbef7bb-9679-4a72-b3fd-479a1d4971f8", "value": "SecuriteInfo.com.Win32.TrojanX-gen.29310.32138", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9945c6-ea8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683212569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683212569, "uuid": "9c227f27-a216-4919-a94b-a48b7e009671", "comment": "Malware payload (Mirai)", "value": "d4ce6a8367d840118afdb064c639cc74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683212569, "uuid": "3e10ff64-3ee1-40a8-a7e1-e2b9ab95b85e", "comment": "Malware payload (Mirai)", "value": "89ded71040f0f0b728b5ce4d9c0affd87bae2e227068b515fc8099f6ea310ffc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683212569, "uuid": "a85606eb-98fe-4063-9b11-62b574351846", "comment": "Malware payload (Mirai)", "value": "85cf4120be8faf5c3736a7045d4a5921fe5ab542", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683212569, "uuid": "f61bfc15-1d2f-44c6-818a-4fd89ed74052", "comment": "Malware payload (Mirai)", "value": "722d97de3eed3166dbc9c140b4e9245360e1a950a7bb3bebefda846974b421e1378bb87f3579ea8702242bac6078ad12", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683212569, "uuid": "57b9661b-650b-47af-9d1d-dd4a95818b5d", "value": "T10A03E1AED4697E9EDCBC153D884403645E19B1C21E42E2071B575E02BD32D4FA1AE8BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683212569, "uuid": "00a00754-4432-4e57-902c-b608775b83ba", "value": "768:8cFiyluiEduvR0MrPNjIvSGb22VjGqxQLZUiBxTQFTT9nsd6WMI:vFdY4ynbV6BLh7QRT9nUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683212569, "uuid": "84f0ce43-aba6-49ff-b3c0-e580244446a0", "value": 38072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683212569, "uuid": "61bdd294-37f4-483e-8909-2b23f7d3c460", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683212569, "uuid": "7f63cc9c-f9b5-4b50-99ea-d31c41b29470", "value": "d4ce6a8367d840118afdb064c639cc74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0602de68-ea51-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683186923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186923, "uuid": "4ac21117-3fed-4fa1-a94d-1ff0c33a73fb", "comment": "Malware payload (RedLineStealer)", "value": "60f261a0098b9ed917b75ee574113587", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186923, "uuid": "1344395f-681f-494d-99b7-83c553977120", "comment": "Malware payload (RedLineStealer)", "value": "8af5c42ff6ea9de106b2ac5aaae5c9e55124b78f27335180b457937f7f661226", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186923, "uuid": "f006a2f5-47ab-4e1a-bd62-acd9efa23b9d", "comment": "Malware payload (RedLineStealer)", "value": "1ccf2f0293c80fa42a9b9797ce127b361ca77986", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186923, "uuid": "ca0ab186-df2d-4b77-9036-31764380fc78", "comment": "Malware payload (RedLineStealer)", "value": "bbb3e28923d49db58398a5a791e6ef3dee3fb1bbcffe8cbce0d8cd12df63c48d68818d0cedab4a0be534ed66d9f6f6f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186923, "uuid": "932e6154-5451-4479-99da-1df6f8d96567", "value": "T1C4C41253BBD95472D8B2677428F707831B3ABC615934825723D9E95E2C726E0BA3033B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186923, "uuid": "773f79ec-92d3-42f1-841f-5c5d1bdefb03", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186923, "uuid": "b7c93abe-79c2-4dbb-9c9d-8173c5f2c617", "value": "12288:aMray90EtIfBnJSabVH4GwIOXdmC2gw1GN+JwW:kyFtDaRHCXsC2X1Xz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683186923, "uuid": "f9c9c18c-a394-4be8-91b0-8ed88a1778eb", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683186923, "uuid": "bfe1c47b-4a89-4a62-b5f1-4973b2ecb6fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186923, "uuid": "c6e89c9f-fbca-4157-a2b0-1ff52f777786", "value": "60f261a0098b9ed917b75ee574113587.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d0d26d1-ea24-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683167822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683167822, "uuid": "fdccaf53-74e2-4a86-bc8f-cf25261776eb", "comment": "Malware payload (AgentTesla)", "value": "6467462fb36a84a23dd64622c6a3e881", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683167822, "uuid": "f4d36f94-f56e-4aa7-a755-cb6c47141f9f", "comment": "Malware payload (AgentTesla)", "value": "8b320cdcd15331e662f378903444dac92fb1f331083f1872ca4454cc0f8ad0db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683167822, "uuid": "ca57a63e-2d06-414f-830a-bd3eba98cf15", "comment": "Malware payload (AgentTesla)", "value": "677713764eeb829e58aada5b9361e07b8fa0c6a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683167822, "uuid": "b73c2b37-65a6-437a-9492-002997410283", "comment": "Malware payload (AgentTesla)", "value": "c687467502aada51e85bff91e152712d8149ccb0b8194209293471e32b1deafc6186718bd328d06aaf511ae023ab2d57", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683167822, "uuid": "46be2458-ca73-458a-a239-903befba71af", "value": "T1C44413043068C4E3DDB34A306A3D0AB799F9FA22256DAB5B0B204F4E7F72A515C1E753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683167822, "uuid": "a9a77bad-44b7-4615-898f-68f067e763e5", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683167822, "uuid": "202cffcd-e6e2-4d63-b932-0d175c40beb9", "value": "6144:/Ya6nLtB2taYNqtFOaoZv5Nr1g8wHDNj/OD8x52Gpk24B2V:/YdT06Kaot1g7Nb28aEDEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683167822, "uuid": "1768b307-7728-4f8c-b74d-0f1a76180127", "value": 278535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683167822, "uuid": "b801c068-0847-44a7-a8d6-b1ff80edbb2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683167822, "uuid": "6963fa61-d669-472e-b72c-ccb6f81dd283", "value": "SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.192.28982", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2575e89f-ea57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683189552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189552, "uuid": "eb47c2d7-9012-4332-8e40-974ada028513", "comment": "Malware payload (Mirai)", "value": "748e07c58558ae26fca1c50405f0c3f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189552, "uuid": "ceb3de3a-1251-4d09-b28b-909ec47d30c1", "comment": "Malware payload (Mirai)", "value": "8b5eaaa76245e3bca4f6ac313dc3055466ee13695a1702125baf7830bda8200a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189552, "uuid": "5fb887f4-3c0e-4a10-a257-713676f3cf3c", "comment": "Malware payload (Mirai)", "value": "ec04ee737b06971ca73d73c3e6c7152f752cc79d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189552, "uuid": "2512d5db-d959-4b01-b150-e1b5068dfad7", "comment": "Malware payload (Mirai)", "value": "a7ea6bc08678afd35778643aba52bdb9990e246e787640dda0a594fbd41c11c4fb36919b3bf44d41f4beaec77a4d1558", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189552, "uuid": "30be780b-95bf-46fb-9ee3-40d319368793", "value": "T191733A42F8C1A612C5C5167BFA0E128D332653ACD2EF7213DE259F623BE755A0E7B412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189552, "uuid": "7e3519bf-3949-4a99-93ad-01474a54a4e7", "value": "1536:6ib708fC+zPcYaRXpvIv27dVVgobsFtxZ/r2GcIWdTvo0B:ft3YYaR5IvobyCsFtxZz2GcIIo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683189552, "uuid": "54239a33-f1dd-45a6-82a9-e40cb4f561bc", "value": 74964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683189552, "uuid": "688d905f-b2bf-4988-bad1-822a30a556d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189552, "uuid": "34be7d3a-4f2b-4c22-adf3-cde3df05dfda", "value": "748e07c58558ae26fca1c50405f0c3f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e2e1f7-ea80-11ed-b3cf-42010a9c0076", "comment": "Malware payload (PureCrypter)", "timestamp": 1683207438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683207438, "uuid": "e612c218-ec5c-4d8c-8ce9-557b4298ca26", "comment": "Malware payload (PureCrypter)", "value": "febf7a067510c71b9daffd896423d8d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683207438, "uuid": "54e922e3-4bcc-449c-94d6-937ed29319b6", "comment": "Malware payload (PureCrypter)", "value": "8c2c914f972040bcb9c5c74138eb9da4f536870b2f8351b0d050d2f208b66043", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683207438, "uuid": "0c6e9235-c0c2-454e-a057-8bac501dcc82", "comment": "Malware payload (PureCrypter)", "value": "192648bf8ec8aa58e5fd8fc086a728ad5b2cf373", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683207438, "uuid": "61b0e4c5-e702-4fd2-bf93-265739f58c82", "comment": "Malware payload (PureCrypter)", "value": "8fe7888acf71644d6e8a4ae806325a4bb2fca902130e93179461a4eaf318f6197b3b8fcf2130750618dc0a86752431f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683207438, "uuid": "48045870-2ef9-43ce-9c46-b14a594a39ba", "value": "T19BD3C406A759C622F69F6B36DCD6483403B8DDD2B693E60B69CD33D54433BA6CE0124E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683207438, "uuid": "99166d9c-a967-463a-9d6d-fd134e090bff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683207438, "uuid": "5142b47c-b0a6-42ea-a9da-dbae04c895bb", "value": "1536:hFL66GzZ2CpMM3Uvwv4eTOFanvbNyhNkRoH9UiBTTz:+XzUCpMAbaknJyhNwqq27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683207438, "uuid": "21dab6a5-3042-439f-8d67-fb5581ba9ebf", "value": 134656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683207438, "uuid": "f0f1d93d-3ffc-43c7-8f4a-6888aebe98a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683207438, "uuid": "43637ca3-1e3a-4792-bb3d-e6d5f7597891", "value": "8c2c914f972040bcb9c5c74138eb9da4f536870b2f8351b0d050d2f208b66043", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6de835-ea8f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683213559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683213559, "uuid": "77a6f9ba-384f-4773-a09d-7af56d874a1d", "comment": "Malware payload", "value": "3319b2905dc2024e429e1eae0314eb1c", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683213559, "uuid": "9bdafc16-3675-4972-9802-b319ba9e433b", "comment": "Malware payload", "value": "8d5245341d4fa1ea648894837e573e3fd0cef8ce5de9f38f49abdd4af7a8fe49", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683213559, "uuid": "f61422a5-927a-4b55-aa7b-8a568ed4cceb", "comment": "Malware payload", "value": "829401a6d4061bd41dc07a56005f80a05c46a732", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683213559, "uuid": "0fe3da89-197f-445e-b570-70e7f8f29d3a", "comment": "Malware payload", "value": "4d67029e68ad6b773c44657775b07ce088d5e5718c4dc4377dde2182e7de53c0b7b95634d15fb326d9016edb3fdd61c1", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683213559, "uuid": "7fa49457-de0b-458f-9a74-21bc073c6bf2", "value": "T1F6D423C720B17D92575FEB123B52BC0F177665ABF14580A6BA6FB6C0060AFEDC934422", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683213559, "uuid": "89157d2c-1253-4a11-b87b-1b7569d4942a", "value": "12288:kBohxt6Pn0FjVVGAV4R9JHKiKfUTSjn6hGBhDhN1Yx6ZYCXUGV:kqjt6P0F/3wJxKfh6hY9YGHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683213559, "uuid": "67c0c371-1e51-4e8d-89f3-c9b55a30f952", "value": 619861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683213559, "uuid": "576f51fa-f30a-4fad-b5f1-da3719b55982", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683213559, "uuid": "b75d2930-1092-4e3b-a734-f8222468c85c", "value": "doc2023054900020000091.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86612359-ea46-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683182414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683182414, "uuid": "974f6559-059f-427d-9ffa-2b8e04ce7093", "comment": "Malware payload (RedLineStealer)", "value": "c7f3d7e1bcca5a6925b1b0762f871e99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683182414, "uuid": "e70cda8e-7c93-45f3-a6d3-caa416c2099b", "comment": "Malware payload (RedLineStealer)", "value": "8dad64d50dae279010dd6d487290efd3049f5f5f3d268ba94f80311ec943e50b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683182414, "uuid": "10da1315-5b3c-405c-91a6-3245fc0403be", "comment": "Malware payload (RedLineStealer)", "value": "a157a60fc48887a08bed0ff175cae033508e812e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683182414, "uuid": "8a85c16c-786f-42e1-9c32-6a721cc7466b", "comment": "Malware payload (RedLineStealer)", "value": "1fc000920512c87ec0b0ba6159b27e32b37746eb08f2bb2ebfe575e0c1d82c8d3dbcd11cdea9929ea5466d7c26b3b8f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683182414, "uuid": "de729e71-fe78-456a-81d3-576dde6f3bd7", "value": "T1F7C41213ABE84033DDB6277058FA02931B36BCA26D78932B5341995E4DB36D1D83277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683182414, "uuid": "3f350159-46c4-44f3-85c0-e274d4c2db5d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683182414, "uuid": "55eb7aa9-6ef0-4b32-9e99-97f7981070cc", "value": "12288:CMrNy90AcvKfwk8jtoYtGYZx3adYQVHxC7zB:vyicngZYYZx1Ft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683182414, "uuid": "a8eae370-369f-429f-a838-17649a1716e1", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683182414, "uuid": "4a9910b5-9c97-495e-9822-7dce54149558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683182414, "uuid": "ffdeb41a-b9b8-4d4f-8d7a-c76cecc61277", "value": "c7f3d7e1bcca5a6925b1b0762f871e99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5e6eb73-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683194143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194143, "uuid": "094efc5f-a6cc-477e-b0b8-58e27d9e6b5c", "comment": "Malware payload", "value": "0ffa793413cebd1e493b33d0d1569d3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194143, "uuid": "6609f3b0-826a-4416-bccc-7b22cf288dd7", "comment": "Malware payload", "value": "8df509bdb6423c2034a00b18074c4ffa3e735d119883e04af6c4e1ae578ff8da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194143, "uuid": "0cffb39f-1fe2-4b7b-82ff-2a6bdc82bdb0", "comment": "Malware payload", "value": "c9592de91aa5f2c8a9e8b4d31e143d13aeb13d79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194143, "uuid": "8c0069a1-4dd5-4983-9bf6-a72243e0f432", "comment": "Malware payload", "value": "7d1602a3d8f8c4025b32f1404a2b5eb82255248d43ab6fe55ed5bb5f439c22c29e8a9822af1fad3fe6ac7d075fd8f861", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194143, "uuid": "f343fce8-a0d7-4033-b3ad-20712af249ec", "value": "T18F827B9AB314C9AEC19405361C23CAF872217D3E9D295E073BE8AB1F3E32715EC05A56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194143, "uuid": "48cd1428-310c-4d2d-8b4d-0276e7d05a05", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194143, "uuid": "e709f2c3-d5fa-4cfc-b9ce-5f2e3aadb5a4", "value": "384:pLDTs8hsF6qtK8lzQ8+Sych3mYvCPHxh0:pLXVhaTtDE8VfCPHxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194143, "uuid": "ac29003b-2a9c-4bab-a506-157ba12b53e4", "value": 18097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194143, "uuid": "b7dd0ce9-2b95-4ac8-bea0-558469690e67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194143, "uuid": "24529a99-485f-4ac8-8639-a262c63cace6", "value": "SecuriteInfo.com.HEUR.14641.12528", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28778cf7-ea50-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683186551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186551, "uuid": "40a0fddc-6745-4519-8028-0b2dde5b4aa6", "comment": "Malware payload (Mirai)", "value": "a17d88506e956ad07ea1b846a72f2b50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186551, "uuid": "c96d8363-6079-44fc-83a6-0418ccf56f64", "comment": "Malware payload (Mirai)", "value": "8e1ae4cc4d2c6ba52b425832e718b7f25a7264130ea9fccf1410c27bfdf70d7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186551, "uuid": "b3e5c82d-d33d-44cd-b42a-11de3221a254", "comment": "Malware payload (Mirai)", "value": "5f0f3e97d0f2782218bd46b056810657245d7a13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186551, "uuid": "7ad0e64b-59b6-4fc4-a5b7-c0aae5ebb5d8", "comment": "Malware payload (Mirai)", "value": "2a8318d9c24de89c2ac79d7b4ee4b114a399e5f328196c4d5be668c49d9d8d59c2021d08d532a17c8128c2edd1148021", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186551, "uuid": "77b6178c-d01c-4632-a855-9ab335386880", "value": "T1D0439E33DA1A2D14C14A827030788E757B53E1C842E67EB65AE1C2BAD443A9DF94DFF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186551, "uuid": "3e78f271-5263-4550-96fb-0fbbadd72cb2", "value": "1536:A/a5MuHEQxJ/FUFYxkawwgKFTwSJjTMjUI5sCgZwbZnN5:EaMukQx8FYrdnFrjTMDstZwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683186551, "uuid": "519e4a40-49dc-4146-a0ec-eecb53016fa0", "value": 60328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683186551, "uuid": "4e443968-9c28-4b14-a604-fefab709b4f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186551, "uuid": "c5df9b12-81a3-47f6-b214-0c0654ecb98e", "value": "a17d88506e956ad07ea1b846a72f2b50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c6a76f-ea6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683198633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198633, "uuid": "25a1ebe7-a833-4a9f-b0bd-7a484f5c8a1c", "comment": "Malware payload (Amadey)", "value": "074a41628cb177f7bf07c2f52da35ab8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198633, "uuid": "72f2fd7b-13f9-489c-8c1a-44eb7e0cbe0f", "comment": "Malware payload (Amadey)", "value": "91a87ffd327cd92737682257f1fe3f48f246b96c2e59faaeea42a924f5b9f24c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198633, "uuid": "c3be0401-04ff-4306-ab67-0fce026115e4", "comment": "Malware payload (Amadey)", "value": "db79dccd2b870011822af6e61ad19beba6de5f65", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198633, "uuid": "890c2dd9-ac1a-46c9-a394-da1ff6a417e0", "comment": "Malware payload (Amadey)", "value": "65fb2314fb278e6a88822a356868de33709a9f947e3a8ed6b98dc8d7fb9d5ddafb8ee199252f57a43a551cc6a42e6fde", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198633, "uuid": "48415606-1b4f-4fee-b43a-1d68d4926c0f", "value": "T1B8F412132BE890B3E5F927B098F603931F36BC60993C91673659690F1D73A84B4717AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198633, "uuid": "62955c87-829d-40c6-8074-cbc365864c75", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198633, "uuid": "8f132750-6039-4002-99e7-069b97d47f16", "value": "12288:uMrpy90uGy4gxZAFvA8hw3Tj+IY9Bm7h7cddVuGpVl75O2wr9nkaG3/:nyYT9qUwDj+NBm7hYQ+V5OOaG3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683198633, "uuid": "69f6df71-fd4f-416a-949a-21a6a1284f4d", "value": 726016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683198633, "uuid": "b89eda2c-b893-43f8-bc02-56026556996e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198633, "uuid": "4fe97e1a-4569-4ec3-8260-9af591d7b99d", "value": "074a41628cb177f7bf07c2f52da35ab8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "507da56f-ea50-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683186618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186618, "uuid": "89b4be99-794a-4f18-be8b-083a94f3033c", "comment": "Malware payload (RedLineStealer)", "value": "d3dc541ec3e985943277604003194ee3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186618, "uuid": "9f2f4dcf-6423-47de-a5d0-a637bd346e26", "comment": "Malware payload (RedLineStealer)", "value": "91edaf65442a0d2cce04a878cd582df3a37da3ae3225c2a881337c5661d97846", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186618, "uuid": "f2e82891-255d-410a-a99b-d3df263b4e2b", "comment": "Malware payload (RedLineStealer)", "value": "0d04b6570cf97890e4c280b7ce5fadc8d0461e2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186618, "uuid": "c52b0afa-58f1-4621-a6d2-583f7399ed0e", "comment": "Malware payload (RedLineStealer)", "value": "a635396cc91e8487f0b569d3ebf0b414a36c41586c8c398773ec5a8c621a81dca5723693a542d484b10b49e89cd130ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186618, "uuid": "c5fe4451-4b4a-4317-b2af-404f329d73aa", "value": "T126653393F3D0017ACA715BF069FB15971776BD229A70425F2B945CEA8DF2A807830793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186618, "uuid": "2b119fb8-7353-4d58-96d5-88ab7740b028", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186618, "uuid": "a9aacc6e-d459-4509-bde3-8e6267515629", "value": "24576:8y53cKISP5fCxNX71UjDj344sZ31JPeshxSIJqpnQxwSjbITAjwOWaF8AvwHg99j:rlIw5axNX7SD74bHPthx/JqpsETAjTWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683186618, "uuid": "48f7f4ab-9150-47be-a501-26db65395fea", "value": 1537024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683186618, "uuid": "82cf7534-956a-4873-8fd0-263025e49cec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186618, "uuid": "a3a5cf3d-b94c-42f8-8692-111cc2b93a78", "value": "d3dc541ec3e985943277604003194ee3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d0a8e51-ea2f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683172385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683172385, "uuid": "df8249ec-f367-48f0-842c-437383970346", "comment": "Malware payload", "value": "a302aa3335abca0d18e9ada71e8e12b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683172385, "uuid": "9c818cf2-8e23-4b85-9fe5-5496246387f0", "comment": "Malware payload", "value": "9206df8f28b1540fa4f76fc385b2d786fadaef5cf7b0e24e5218ff7fff0fcbad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683172385, "uuid": "13e4b562-4cb9-4e55-b984-49045e713fed", "comment": "Malware payload", "value": "aea639eb0b83dd2717e758146d38e3211b09374c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683172385, "uuid": "34667f6a-8763-4645-ba60-f83ef2a74784", "comment": "Malware payload", "value": "506dd5337328d3368ef92ba11c52aa8b59a491ee0c5d71607bff7738e1ef3b4acb7f0fe11d9d169abe9e79c3dba7aa0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683172385, "uuid": "fb11b594-532c-4047-b2d1-8f2ad3999f83", "value": "T14AA502331E8AFEDDABBD0D68D8822E045E545CBB61B4D178FC48558E18E9640EEF5CB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683172385, "uuid": "f530eb5f-ad0a-4d46-bf76-60ccf162689b", "value": "24576:OGI7CJnZQ0IR3+6SdKdE5YERWjS7qZZY801aZvoQYkjpcSAiskBZzLiPgquSVIOb:OsJnZ2SK1Y80m68w7V5pPfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683172385, "uuid": "6432103e-c1e3-4d79-8c57-4db47483cd46", "value": 2148352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683172385, "uuid": "d6618426-0acc-4013-b424-67d5412d0660", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683172385, "uuid": "c3cfcaad-eec4-4221-9da3-899fc22ca150", "value": "a302aa3335abca0d18e9ada71e8e12b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b2a4d6-ea65-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683195541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195541, "uuid": "3657055b-44c6-4d65-b15e-5ddb203f8073", "comment": "Malware payload (Mirai)", "value": "24b923862a5e92038b93fbb6055d47ea", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195541, "uuid": "84b165e2-2369-4068-be3c-86958c37cb8c", "comment": "Malware payload (Mirai)", "value": "920f0d8be6f53b0cf95f393664d99288af0fafca06a826f520c1d77160b7c5f6", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195541, "uuid": "cb60558d-e0e0-472d-a0ed-d2cacc9fb1b1", "comment": "Malware payload (Mirai)", "value": "f82fdcd4f27fc3ac895b0b20262793d06cdceb99", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195541, "uuid": "6c405dbd-2f90-4a2c-98bb-06afbb2a6e66", "comment": "Malware payload (Mirai)", "value": "1cb114e21eaa0d8e670dbea22b9dc81ee51f0b6e7f05face0c49112b84772d44197a0bb60c2c20bf73c88eedd1278030", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195541, "uuid": "edbc7700-4753-4975-b057-1185bd8ccdc7", "value": "T1CD734B07B681C1FCC459C1784B6BB23AD53275BE0239B2AAA7D8FF232C09E605F1D955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195541, "uuid": "906f5bf7-833d-4222-9e27-df1580da8aa7", "value": "1536:HosfX5Z+J75f5CHOQCDdZAkNbU5moHkmOuiqi3AN52bhVx:I4+J7XyxCLAkNEkEji3+2bhVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683195541, "uuid": "1a708b8b-9fa6-451d-af0d-add3b042a63b", "value": 76960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683195541, "uuid": "7d72fedf-0ff0-4d95-b776-56788ab89bc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195541, "uuid": "c0b0bb46-041f-4f7a-836a-2a04193af0f2", "value": "24b923862a5e92038b93fbb6055d47ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "197c6cc3-ea68-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683196834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196834, "uuid": "49818e01-a0cc-4f85-bf73-c6b1ebf50bd6", "comment": "Malware payload (Amadey)", "value": "f91412881bf7949887fac77caa487aea", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196834, "uuid": "dac452c3-fd62-4147-a9d2-a5d957460dad", "comment": "Malware payload (Amadey)", "value": "92756cf2371ff7e78b9fc1d4a6eaad9282341b2093bc6d062c30f9b85d07842f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196834, "uuid": "d03fa5fb-39e2-4c22-9199-8c9b9644672a", "comment": "Malware payload (Amadey)", "value": "5801baa82d6fd079bd90a4f7541924d3bb13fb65", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196834, "uuid": "2d1d7f01-81a2-40cd-88bd-35c07308fdec", "comment": "Malware payload (Amadey)", "value": "e58714b8d8726e41649ad925ea550d1e20e3885234fbdb2a8ed62172d72bdc002e2ff897b0321e08b0a236c6bdec5690", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196834, "uuid": "af21ceba-9831-413f-aba7-987cf0690d2f", "value": "T1C1D4120766D99133EDB52BB008F742D70B31BEA12DB9836A2742AC1D0DB36C476357B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196834, "uuid": "d9e8b1ae-3cff-4c17-a890-c1f509257b7e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196834, "uuid": "2b9c3d1e-d5f4-4dce-833e-d722e2f3d864", "value": "12288:0Mrvy903eLwy7g1maF7pTqffjXnMDmCIz5IH+nQ/+eLxBj/:7yMes0avMbMDdI6+ncDxh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683196834, "uuid": "7b38f8da-6a53-4736-84c8-6b78134dfd89", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683196834, "uuid": "8dcfe0a6-d915-4ca9-add9-b31356995571", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196834, "uuid": "5310dc4c-cfdc-4144-8240-f71dba2657fd", "value": "f91412881bf7949887fac77caa487aea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de776f55-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683194158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194158, "uuid": "785d983e-ce87-429a-bb4b-bab6c67f1a0a", "comment": "Malware payload", "value": "ec3988d5b29604b869c1b9157084a4dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194158, "uuid": "b16550ce-acd2-4e8d-b6bb-0fd91178746c", "comment": "Malware payload", "value": "92c2b82118cfdfce34051820cdead8a637e8b5599bf8e77285483fea97d7784c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194158, "uuid": "2d44b7da-ba2e-4ecb-b0fb-0214aa864611", "comment": "Malware payload", "value": "1fb2a55ea9ef6aa6141cbd5dbe53559f4c6c39ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194158, "uuid": "0b195fd9-b8fd-4f4c-b533-a087e80e5cb4", "comment": "Malware payload", "value": "76295626b7395cc48f597ebb924ab42ea6caa6e5237d37aa572edbf57f03f02b6d86d83ada85970c926de09f5a842cac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194158, "uuid": "afeb67e4-d320-4332-9cdf-b813ae9e6268", "value": "T1DE92B66737F0C2B0E2E5D27403E5053178BFA2F0717FDA4EE8B1235619A1921FE18A09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194158, "uuid": "42a39300-3c93-4b42-bcc0-a429a902586f", "value": "48:gxK6qZHShyNze/czuCPAlyQgvmNIvSI9P4EvsfoVJAe4eSoF7qsa043c2G+:YRG6EDPiyZmNI6NEvumAVoF7haFZG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194158, "uuid": "bc3eccc5-10c4-4c04-ac20-84525398feff", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194158, "uuid": "170a7279-a079-46cf-9fcc-02525955a915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194158, "uuid": "168a6cc8-cf22-4754-a82e-5358bea2069f", "value": "SecuriteInfo.com.Win32.Evo-gen.12621.6760", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6425d42e-ea35-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683175055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683175055, "uuid": "4430b554-f626-4710-ace3-649fec3d6195", "comment": "Malware payload", "value": "5ee93a1d15d2d02268cf4755b7b5d7db", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683175055, "uuid": "7f361ac5-4046-4afe-94a1-467bcc460c91", "comment": "Malware payload", "value": "93abfd8f744453b14b83135adf604235e93c901c54a8a95ec0d463035c4b5ac3", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683175055, "uuid": "715cf80c-bf1b-4f3a-9498-bc52dfd14621", "comment": "Malware payload", "value": "ba91217aad5342da36c024f73684cf8973c363a4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683175055, "uuid": "fa5df2aa-5d24-4e2e-a8f9-ce443fadb778", "comment": "Malware payload", "value": "1d1753a1c2436c2d7a677125aac6596d54b8af09f981f9ca7188c6a4d212becd200003fa0ef63ec31d5a4032e098dd87", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683175055, "uuid": "6880a91b-48dc-4a3f-9248-932285edcc33", "value": "T1809280565B8C4C51F26AE8BB465EE00E09BCF23230C255C4BD9CE6B07B3D54E4B6B5B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683175055, "uuid": "b2ea73a1-f44c-45a1-a0f8-e321da734361", "value": "384:D6bod5AFqFx3f2uigjhsXh0Xw5ZYnHo1nWJiRkQdszqPdv1G0seNIn:FHAFqj3fjXsXhssZYHEzRkQdV9HNIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683175055, "uuid": "d5e66501-9823-4ca2-a341-07b7a83ce879", "value": 20521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683175055, "uuid": "f581d2dd-201b-489a-a753-c7846469e4d9", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683175055, "uuid": "6af7d048-f141-459c-91cb-85a4c93fb02d", "value": "5ee93a1d15d2d02268cf4755b7b5d7db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "059ab6bb-ea99-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683217846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683217846, "uuid": "3b3cd641-9d6e-4a32-8f80-36204aae7adf", "comment": "Malware payload (RedLineStealer)", "value": "aa7daba1657a62aac426317f4a069db1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683217846, "uuid": "9bb5f0b3-e9a7-41ba-8d06-897d631f5ead", "comment": "Malware payload (RedLineStealer)", "value": "9404c1b483cfb08ebefacedc12657788826b8c36f59dc379efde17c1ce5eb59a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683217846, "uuid": "daf26af7-74b7-4388-aba8-c80da34e0588", "comment": "Malware payload (RedLineStealer)", "value": "370a1c790d3e3dfd7b4cc535e225eb53667689e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683217846, "uuid": "836630a2-16dc-4f9f-9cf5-5a4c5960a590", "comment": "Malware payload (RedLineStealer)", "value": "22d224c7bc73d73bce562422bbe0060283c960b926f4530c1ed780f399238fcf1de46174cc32c8ce999723ffc2350e30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683217846, "uuid": "3fa8dc67-f604-4e15-8c46-a9a277d20352", "value": "T1D2452316B6EDA872DCF517705DBB13931A353C76AC74428BA285F94E0CB33A0A53437A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683217846, "uuid": "fd98af5e-f20b-468a-9b81-862f9ea407c8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683217846, "uuid": "04597386-6d60-4526-a6b6-a353564d81db", "value": "24576:OyfOWI5DowpDRdt7iBnfYFvBzmYiydvb1mf+HRN:doR77iBkvBzmZydT1mf+HR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683217846, "uuid": "8f35622f-4eaa-4b4f-ae4f-1358b4890641", "value": 1233408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683217846, "uuid": "afb315a6-2fef-49a0-8fbc-c33fd0f074e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683217846, "uuid": "af4c9947-e23d-460e-b746-764a26d0bf8e", "value": "aa7daba1657a62aac426317f4a069db1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05aa55b-ea4b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683184685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184685, "uuid": "598033e5-707d-4910-841c-52a87d98a009", "comment": "Malware payload (Mirai)", "value": "ae419ee6e66e84062bd42f93ec832451", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184685, "uuid": "18b2b272-b8a5-4024-a810-0e65f488ed6c", "comment": "Malware payload (Mirai)", "value": "95d46525f69cfadd4830742ec5f4b4ac6bb2f232e751753313daaacf3a2e1aa2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184685, "uuid": "941a514d-7a3d-483f-8ac9-0882f7fbc419", "comment": "Malware payload (Mirai)", "value": "f6fdfabbbb8311d584cabf36ac2195cdaa7f4b0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184685, "uuid": "a9caf5f7-581a-4933-b5f1-57e2c6dd9e2f", "comment": "Malware payload (Mirai)", "value": "b2f9823b438bdad32faa04c499ba8f51fdbfd2f7322b21c00b7490ae4f481d238e8208ca9c22ae3a40001c5b8d52776e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184685, "uuid": "c5f6663a-71bd-446c-a0b7-dfd55f2d1b39", "value": "T152436BC4E643DCB2D8171631147BAF37BA76E2E91224E746D3A8A736EC51702E016EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184685, "uuid": "f5fe01eb-a46a-455c-9f5f-97902616505e", "value": "1536:BF14yTUx6AhcHIOROP9PvEqRaSblcMUiBVFrVwBwbZnm:B/4yTUxdaIOgP9sqRt5cMlrHSwbZnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683184685, "uuid": "0ec2a49d-8058-41e4-b2be-50aa5e59566c", "value": 59088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683184685, "uuid": "3a4826b4-83e4-47e0-ac08-b1ca84a90201", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184685, "uuid": "ed0e2f5c-4a41-4fac-86b3-fb228597fff9", "value": "skid.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "696b3d43-ea83-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683208564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208564, "uuid": "3a4a5bea-126f-48dd-89e1-d62a53317faf", "comment": "Malware payload", "value": "6ad68761818d52e3574e1e25eeb8c0f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208564, "uuid": "d68bfae0-ad27-4e12-8e69-b017dfff9df8", "comment": "Malware payload", "value": "96f2114d042da95fe77648abe1467db6a9d5857f54d01dbfa5dff2836b610871", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208564, "uuid": "34924580-6f3c-4538-9520-0a551f2712e4", "comment": "Malware payload", "value": "9dfdea3e189fed07426c3a898ca34e053e3fa770", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208564, "uuid": "a73fd777-1997-469d-ad9a-24bd6882b7c4", "comment": "Malware payload", "value": "b13468518eb4595f9d6137d0af93eb59bc799ca78a314a7fc11015f7adfaf86ca9d3526e2d8e1459bb99da6e2917b698", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208564, "uuid": "53dea8b1-d501-4e3c-86de-14bfad304db2", "value": "T124B4F0043BA1D80BC6518A3158E3FB79AB6CFE512F024617D718770E7EB2E795809F4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208564, "uuid": "af80ba8b-c330-43c3-aa4c-612bf526c888", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208564, "uuid": "716450ae-71b2-4529-8baa-ef1118d361d4", "value": "12288:Snx774fvp0ANoMiP4Yxl20wB6DnggUCV+:SnJkp0aiPx3wB6DngTCV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683208564, "uuid": "06896b85-030c-4ea8-b260-0fccd6a9637d", "value": 498704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683208564, "uuid": "f299718c-9671-4c2c-8152-12ad95038802", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208564, "uuid": "069f0827-122f-4b16-ba2c-ac126a892745", "value": "96f2114d042da95fe77648abe1467db6a9d5857f54d01dbfa5dff2836b610871", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1600f7f-ea19-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1683163239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163239, "uuid": "1b16c6bb-b65c-4c53-80ea-fd0a674e8a56", "comment": "Malware payload (CoinMiner)", "value": "39e8e89d11f4c2beb1dc272240968ee2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163239, "uuid": "6dd2280d-049d-43d5-9945-30e6413b3d75", "comment": "Malware payload (CoinMiner)", "value": "975930a23c07c68020d761cbc929b9c5f8cc88c21ee69b5fd2b1c7b4940ae9b5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163239, "uuid": "404bb1b2-7742-4321-a099-27fa5794386a", "comment": "Malware payload (CoinMiner)", "value": "fcacd9e35b7f74165c7c85df55f413af3177c462", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163239, "uuid": "03db3df3-0ab0-4dd5-a897-8975208756c4", "comment": "Malware payload (CoinMiner)", "value": "66663f94dcdc77de910b7b590eee5c2850e86c9ad9428882d400920cb74869ba6db3423eb921d228c34aa9908ed5e3ec", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163239, "uuid": "83bda27d-6703-46d8-ad80-dcf05490e9f4", "value": "T10CA533C934BA7595D03893B49CF706332431BCA1C7B991EF16A8E0B98E325C5B176B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163239, "uuid": "14496e67-5a22-4928-b53d-ebdfaba5aace", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163239, "uuid": "9c1cf3a2-a958-48a1-b947-06be7d2a02e1", "value": "49152:HvQktXR6UE2TlbnUj5vKhCin0lJ1vBjE9+bnY0:PptgkUdvKA1pj1bn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683163239, "uuid": "180bcb78-a043-4d46-9a18-f6171ebc2dc0", "value": 2266112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683163239, "uuid": "f3b1188a-6092-4d7f-a00e-d5681b571e3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163239, "uuid": "ab2ad368-9d96-4431-ba1e-fdd9e79487ed", "value": "setup.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39385cae-ea0f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1683158662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683158662, "uuid": "c116464e-af3d-4aed-9271-14f68017b450", "comment": "Malware payload (njrat)", "value": "005ea0c9163384f16cccf381e9946234", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683158662, "uuid": "70459e26-6e10-4ed8-b94d-f2251f03aa3b", "comment": "Malware payload (njrat)", "value": "98491ddd60532cad07c379bed85ccfaef008c3b1f4aa6a78c0655a386f9cda3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683158662, "uuid": "e52c1ab4-9a46-4931-b6b5-9ee0c161e5e6", "comment": "Malware payload (njrat)", "value": "3ab7f1dbe2fd821ba5950876ad53c3cf4de52c20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683158662, "uuid": "94fec069-766b-4ff1-8d28-aa71f54ebcf5", "comment": "Malware payload (njrat)", "value": "df9f9b866117114a5d9f7732af5f761c10cd6fb9ca70b5cc9de11972638456e06899f697e40e102a4b05e9dbaaaff8af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683158662, "uuid": "fc383222-9c23-4d71-9a1f-e8db03c45098", "value": "T107E208067BE98215D6BC1AFC8CB313214772E3838532EB6F5CDC98CA4B676D04645EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683158662, "uuid": "214362d7-76f8-4f2b-be65-fcd6339a5b4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683158662, "uuid": "8fe99a2b-1bb3-4093-97c7-b03c7342fc01", "value": "384:P0bUe5XB4e0X2OSSYw0Q0mS03AWTxtTUFQqzFiObbF:kT9BulSi55dcbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683158662, "uuid": "688dc283-687c-48ac-b0ee-1add91a0edeb", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683158662, "uuid": "16d9831d-fb88-4675-ad7b-819b088f3a1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683158662, "uuid": "c040f15b-a4d4-42ce-99e4-f71ff199fea4", "value": "xXnhJskuuQco.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d470d84-ea9d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683219630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683219630, "uuid": "7bc7746c-0598-4274-b05f-a786f25836ac", "comment": "Malware payload (RedLineStealer)", "value": "5246c60b38402e056cc8388ad58d4f69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683219630, "uuid": "b91c114b-6575-4bc0-beb9-1a831f402674", "comment": "Malware payload (RedLineStealer)", "value": "99299c2563ef3a8663badcb93808257adb9023ad559b19379cb20ed77d1263d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683219630, "uuid": "d9f867bf-e43e-4495-8c7d-f073257332a1", "comment": "Malware payload (RedLineStealer)", "value": "d5316ceed1e5adcab2552f7f52c08bda605c4bef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683219630, "uuid": "9aa48c70-09e0-4fd1-8f71-20f8fbee59c2", "comment": "Malware payload (RedLineStealer)", "value": "15007581421daa388c9317deecf7640fee5e42a7b3dcd46edf8f6fa826e93a928ee8728278ca7f2334a32b22ef859785", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683219630, "uuid": "acd4d8f2-4a08-4217-bb4a-54cd0cd19dac", "value": "T1A6452316EEF85463ECB42BB054F613871A3C3C91DD28812EA799694B1DB36E1B431B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683219630, "uuid": "4cfd2fa6-cbb2-4a20-b82d-9fde50e8876e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683219630, "uuid": "fbd5c5ec-874a-4e15-97ea-2c3370697d5e", "value": "24576:gy2FgolpH28eZIwWHR7+trnQDYlVBnDUU3dqH7/:n6Ru8eZZCRKNVBnDOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683219630, "uuid": "ce1f5832-b32c-4e66-bd12-e0e2bada6ba8", "value": 1233920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683219630, "uuid": "fd27dfb2-ddbe-4a0b-9f9c-f7e9fa524e57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683219630, "uuid": "cb8490cb-f1d7-4ffd-ac22-a50181bbf549", "value": "5246c60b38402e056cc8388ad58d4f69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b31aef80-eac5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683237035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683237035, "uuid": "30ee4b0e-8b2a-4e9a-955a-c41555ff7e77", "comment": "Malware payload (Amadey)", "value": "e59f30ac820ea021f3fa045aaed4fdf4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683237035, "uuid": "a3a9f365-2b7a-4d53-a059-1fb5c906c8e1", "comment": "Malware payload (Amadey)", "value": "9980ff61b4b54597cbc2ec2cfe111f78fa461ac0806cf05b5ab18dbc09e8737f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683237035, "uuid": "d3f23e7a-2645-4d94-af47-58fe6f403130", "comment": "Malware payload (Amadey)", "value": "635d53805796a58290d68613fe0f08edee053058", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683237035, "uuid": "b52370e9-1f1c-4fd4-b872-8901c339ac7f", "comment": "Malware payload (Amadey)", "value": "85a074a9dda113b030d81491bdef93f8b73a6d6a058e511459a06dac8d2a2dd88a730e428a0aed26a702802a122948df", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683237035, "uuid": "06d6bab0-511b-4d89-844f-039d22b065dc", "value": "T1C1840202AAD88033EDB52BB089F603D30F357DA16D38876B2745A95E0C726D5B47276F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683237035, "uuid": "02e0a633-8610-4b24-8694-36f78f35629d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683237035, "uuid": "16cb0ce4-4469-4baa-a075-fdd5d9aa9676", "value": "6144:Kpy+bnr+5p0yN90QERmWkWanZNdPR5d46kqab7aQUUArvkI15gY2BIzzq:HMrBy90nk4Vqab7dUXrf1j24q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683237035, "uuid": "00f8fdae-d547-4d86-a4f9-4bef2b889c7f", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683237035, "uuid": "91de9561-ec92-4b42-82da-12776723e9e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683237035, "uuid": "be52e42f-b88f-468c-a455-8b2096e166c3", "value": "e59f30ac820ea021f3fa045aaed4fdf4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f9ee43-ea8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683212558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683212558, "uuid": "ed42af4e-4215-4d77-8612-52827c34fdb3", "comment": "Malware payload (Mirai)", "value": "1a0f8f55380228888f2b0e4e8351d80d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683212558, "uuid": "69c07819-f994-4620-9646-0cc2700cda52", "comment": "Malware payload (Mirai)", "value": "99b522c4348e1e0817202511c77100cf41968167278a21995ce87443cd51684a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683212558, "uuid": "6f1cee1c-2356-4524-af99-4a316c7b4f94", "comment": "Malware payload (Mirai)", "value": "7973ae939a43ee7cb2daf960fe069c740177782a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683212558, "uuid": "f35aa32e-4015-41e1-9eaf-838b1aaeed7e", "comment": "Malware payload (Mirai)", "value": "da0c0cfed4448a01bcef062f06d7fc73f4809eb029ef8fb37a490c39956aef6470c2fbccf76decd0861be8c65a1ab3fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683212558, "uuid": "60983b8a-5663-44b4-91ae-a39837e72c9a", "value": "T1B1F2E1B161B55D46C3EA207E2D777A1C9D126325C305D6BFAECE019A8CF5F311B28293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683212558, "uuid": "4d4790c3-be8d-4ec7-b361-5a440ed5a020", "value": "768:GJ0zhfy/monj/s0YmgRCIRzhN8o7Nb1lZJqqI+0PTBwnbcuyD7Ufyqi:GahYDn7s0YHDPJb1xRI+wwnouy8qqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683212558, "uuid": "856ab8ce-b03a-47ce-9447-b82de8135b26", "value": 36468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683212558, "uuid": "12f3fe60-4e0c-474a-9748-f103c09e055e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683212558, "uuid": "32be78ec-4e8f-4e39-91f5-003ec051e2b7", "value": "1a0f8f55380228888f2b0e4e8351d80d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e789a84-ea7a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683204707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683204707, "uuid": "91e578f7-a74a-4eaf-afa9-c2342f82bfbb", "comment": "Malware payload", "value": "7819eb5db7e7bf81d983479ccac38534", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683204707, "uuid": "732c1191-b4b8-4772-bf5d-d2569160da74", "comment": "Malware payload", "value": "9a1760f10fbe72e43f9937d8b9c47d08e53866a87c5cc629c12b065cf051527e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683204707, "uuid": "12e1dd6a-700a-4dec-9004-b7bc9ac4f4ae", "comment": "Malware payload", "value": "c99acb304b4313a41a622fb2554ff5ef58401aff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683204707, "uuid": "41f123d1-ccab-4a49-a667-e2cc46dffba6", "comment": "Malware payload", "value": "34b0da3f23ce38462813f7f3ecac7bcc49eb93707c035d006bde20b9d5df3fd568fb25a7beefab29dc3ed9c39be8f935", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683204707, "uuid": "7bde0a1e-6b78-4f73-9831-0b4fd5072f36", "value": "T1424418ADF0EB740FED259C301EF87614979722988A9BC2F008D950B138922B6DDF553B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683204707, "uuid": "13b3ed99-eea0-4a4d-9f3c-36901a84c756", "value": "071307373db47402e881a4d65e0a19ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683204707, "uuid": "ed14d8b0-e66a-4074-8e6c-46bad5132ac0", "value": "3072:2Iyj9YNaUYqwBb57Ft8hDGwjUQ2wvWAWoI4IY2VgCmrfEfCK4OLLfSZB7es7/9jn:2EayogIyIOfg4OLLfSZFes701uZfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683204707, "uuid": "e808aa66-4656-406e-b51c-cb6e489ba029", "value": 264032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683204707, "uuid": "89092a24-6eb7-41f9-80a4-bb7c3e3ec2a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683204707, "uuid": "22db3ade-9f36-4433-a4f1-902c98be2bd6", "value": "9a1760f10fbe72e43f9937d8b9c47d08e53866a87c5cc629c12b065cf051527e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b34abbf-eace-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683240726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683240726, "uuid": "6540a30f-4d42-4a07-b820-87d72f7a06d3", "comment": "Malware payload", "value": "93abd548c5a42d6caee374c355e68de6", "object_relation": "md5", "Tag": [ { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683240726, "uuid": "dea83084-2d6a-427c-8399-e4bdb086b7d4", "comment": "Malware payload", "value": "9a181e1f73f017322fb204b4f39b3787a206e83df9f7161d311f7e1a9513ef73", "object_relation": "sha256", "Tag": [ { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683240726, "uuid": "2db17fe1-33f5-40c9-92cd-2908cfaecb2f", "comment": "Malware payload", "value": "20d25ed6e3e4015861f764c886e9293a1a30deb8", "object_relation": "sha1", "Tag": [ { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683240726, "uuid": "d39d6eeb-3f52-40c0-8f07-61e9ca3ded9e", "comment": "Malware payload", "value": "c314da9140ca9ce7635ac7a40722ed91e19f9255eeeaa5647254669c51110c003dd78ca6f612edf2487bf3dca7437206", "object_relation": "sha3-384", "Tag": [ { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683240726, "uuid": "51ab2218-8040-4a8a-84e1-8c5fe39f6956", "value": "T190E556D17B84C223DA5309324E6B93D86769FCA0AE31B0877761B71E5B78ED36D21342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683240726, "uuid": "61d06305-18af-4a02-868e-6f11ae14c112", "value": "49152:SpdSlZmy0YGrxnwhzGMPuD3CNfIXuDvN9/vNeWjSc/eMn5WcP:Sp2rynwh6MPuD3CNweDv/v1jSJMnwc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683240726, "uuid": "9486e4d6-7f3f-415d-8fbb-6d38805b5163", "value": 3309568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683240726, "uuid": "a12f154c-ad09-4c19-8719-bb7a5574464e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683240726, "uuid": "b2250a23-5a13-4f5f-9828-425224070466", "value": "install.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52317ece-ea80-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683207237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683207237, "uuid": "42c3fe3c-e9d7-4d91-a81c-e155803ec915", "comment": "Malware payload (Formbook)", "value": "bef8f8b24bcc2cfbc9a8514e9170750c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683207237, "uuid": "143cc3e3-4dc6-462b-ac44-361851c508d0", "comment": "Malware payload (Formbook)", "value": "9b2e05373198bfa063d54ff638d844588e31039c27be226a91deade5c0b2bf48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683207237, "uuid": "ab5fba5b-5137-45f2-987d-c7e39ce610c3", "comment": "Malware payload (Formbook)", "value": "ce67e2d662d2326e47bbbe4cf622d2300c210ba7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683207237, "uuid": "289ff48f-c62d-40db-9809-a4dec5802059", "comment": "Malware payload (Formbook)", "value": "5dfacb08f612ce71b16a94eddc1d1cbdfaeb3cf0f1d959c9967b02774dca5cb7c60aa93c2e4603de60a832f3b16d674a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683207237, "uuid": "f6c8fb45-1f1d-4353-9e49-5509c418b88e", "value": "T1DFE40216F64ACC19D7C29FF06A10885BC1D3AC4CE91045B2BE63B6BE3B3435278ED694", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683207237, "uuid": "cd445631-e1f0-42ec-8cfe-637ca00ce349", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683207237, "uuid": "49264d1c-1696-44e8-8665-749ceefd8ea2", "value": "12288:QqECucXU4xRUFWCfnYVBt6RyVp0oEeUdnrHTc+Oj9MoEzH:ACucEaUFWCPYVBEAYeI9OBMDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683207237, "uuid": "89d94301-1815-4b28-bed7-5a0238509253", "value": 697988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683207237, "uuid": "a1693c7e-9aaa-4fdf-b005-f462bdbdd77b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683207237, "uuid": "22800299-7089-43eb-8da5-05f5f8aa68d9", "value": "9b2e05373198bfa063d54ff638d844588e31039c27be226a91deade5c0b2bf48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e02c51-ea6a-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683197742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197742, "uuid": "0c3325ec-82e4-4ce4-88b4-68dd7d1a7f50", "comment": "Malware payload", "value": "ca3378ab6ac9890e3dcd33f54f22fc62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197742, "uuid": "218acac3-2e74-4644-95a4-6d603a7778be", "comment": "Malware payload", "value": "9c6affc5d10886c7305c3232bf931ded04ece7f4f7001c12cb1a5ea0e59fb4be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197742, "uuid": "92b1b0c1-ba92-403b-8488-320ce4cc3e1a", "comment": "Malware payload", "value": "eead6d235703f9b40d74fc4315a8f4f5b365d164", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197742, "uuid": "68d4b4ff-7d2d-47fa-9a1e-b612ac19c8f2", "comment": "Malware payload", "value": "0dcba15ef2a17e109efc682f225a5676a17c1b13d7b6e406f23bdb4c468e35a148f45bbd8c63dd3aeb729773e2f693e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197742, "uuid": "f45a9d9b-a808-4361-a182-6344a7aebd94", "value": "T1DBD4F7D2B7E44A93E66E0777CC7128508AB4BD536A17F78F0D40309A1833795BD2B62B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197742, "uuid": "8fae0a7d-eb65-4b40-bb4d-082a19c26a3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197742, "uuid": "470b60c8-cf5f-450f-82f2-53e6cedba503", "value": "12288:i83Orev3N3L5u+/ivdPOHxLVv623w5V903/Q:pJLTxLhq5E3/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683197742, "uuid": "21a989ea-8a3b-4762-be1e-9e0147901c00", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683197742, "uuid": "4f4fab7e-6173-4cde-a0af-8df5fc505be5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197742, "uuid": "733d9c1d-846f-41d3-948f-f5ece5666ac8", "value": "9c6affc5d10886c7305c3232bf931ded04ece7f4f7001c12cb1a5ea0e59fb4be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a15b3539-ea4c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683185036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683185036, "uuid": "a329450f-5253-4f72-bf4c-309e085aa26e", "comment": "Malware payload (Mirai)", "value": "eeef4829a7ee2d9e3a14e14b1df870a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683185036, "uuid": "967a502f-f01f-467b-aec3-899683a94907", "comment": "Malware payload (Mirai)", "value": "9cc78e45692ac0abb22bb438f7915e5fd4f78ec078aa52ceb2b704787fd63f4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683185036, "uuid": "bc1d48e6-23c0-49c0-b078-90c5d3d5a341", "comment": "Malware payload (Mirai)", "value": "89bc0b2548ed093f92e72c45a96c0a3c9d990f01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683185036, "uuid": "b084fbdc-5fe9-4aa6-a8e7-2c32377bdd16", "comment": "Malware payload (Mirai)", "value": "21a70b807e3936cc5ded2a4bbec23207e9d93d4a85eadff29e22d2a13eb280afdd9cb6f946d00827c6b2f09bea1573e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683185036, "uuid": "96b3d8e6-89ae-4310-a280-b046339a7b2b", "value": "T112A2D019BF58828BC832797455D9E5D21297FCA1F29DCC4A2940C15FF0A33A96474E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683185036, "uuid": "d728db13-be23-4e84-8929-0b3ded8db480", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTx:798o08kxofBE+ZkXaITbp2F2TWul0c51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683185036, "uuid": "b38d42f3-d400-4273-b5a4-fd89b056d3d8", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683185036, "uuid": "d3bdb064-ce4d-4a28-abb7-802d9b948374", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683185036, "uuid": "eaf11096-dfd4-4bd4-b650-f07afd56370b", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93928577-ea53-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683188019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188019, "uuid": "63fb035b-938f-44cb-9ad1-f4fa7614bd50", "comment": "Malware payload (Gafgyt)", "value": "9fa5c9748817c744906acd8a64fccd03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188019, "uuid": "12fca4b4-9d3d-41ab-9828-d5ecd2745aa6", "comment": "Malware payload (Gafgyt)", "value": "9d0e0d8dd07403c42c06ac687002b6e02d8cae96dbaae2b2acaec0219b36c517", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188019, "uuid": "7335860d-0d13-4a5f-9e17-ea2df4053d57", "comment": "Malware payload (Gafgyt)", "value": "27b9fdf6fda93e8ef32447150eefb26bb109e25b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188019, "uuid": "04e1721e-cdf8-4fa1-b764-2c28cc50f730", "comment": "Malware payload (Gafgyt)", "value": "0570b3d7eb232dbec7fbf3fd70a372dc08257f8853e702d743c0b789e3e3ed3014dae41aff9f9b2ca998d3294e8312e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188019, "uuid": "477d4ce7-ffc8-42f7-858e-b667b4ab6df0", "value": "T1ECF2F1C2F28CA45DE9CB1337055F90CFEF74BC97864762A236428670BCA25435EF9658", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188019, "uuid": "1281b944-992a-41fd-a295-0bfc0e9ec1dc", "value": "768:jNj3rAEn15H2bXVPAnWJZaEV85PhnFobve4zBjobsZg0v:jR3rWXV4nbTzFazBjoQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683188019, "uuid": "eb58291c-ec65-44e2-be0c-ad09b42d8a3d", "value": 37268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683188019, "uuid": "4ea86881-b0db-4511-9dc3-34704b4bcded", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188019, "uuid": "2bc594bb-a719-4164-a099-001f47b26a89", "value": "9fa5c9748817c744906acd8a64fccd03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122e9b96-ea4d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683185225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683185225, "uuid": "7ea714e3-8633-4cb2-ae99-af3c06b8cbe7", "comment": "Malware payload (Gafgyt)", "value": "5c0725e31a378ec68b30906cbe83d47b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683185225, "uuid": "9d7309c9-9898-4789-ade1-acecaa27c38c", "comment": "Malware payload (Gafgyt)", "value": "9d38372ef5827f6c89a9c7ce68679b9d9ca557fabd594791207c17200272d385", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683185225, "uuid": "d5921578-9b90-43d3-9ffe-da34dc134ce5", "comment": "Malware payload (Gafgyt)", "value": "1f34d25d2161e4f39b4209e10d85598afe7bef7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683185225, "uuid": "6bfd5dac-47be-445b-9625-621a42893e35", "comment": "Malware payload (Gafgyt)", "value": "a9c50fe1428d32e0f2b666d6cfc49c9ee85ce26e81ba94441a43a3bee98810e57d1f7398faa7387235f221397ab127b5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683185225, "uuid": "8e784374-8f08-4427-870c-7a0c75ad7499", "value": "T16B735C136991CB7BC4C747F92BDB952144A3F83E1F32620A73D8BDA92B1A9C82D5D301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683185225, "uuid": "cd77a406-de02-4bec-9c14-2462a718d4d5", "value": "1536:E7IZuQa/+1iDnD+Q8bQ8O32Ls0FnswNbzvmA+JbOm/coZ3ymj:KAaG1ItqQH2LDnsEbzvm/JbOmEoZimj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683185225, "uuid": "15892048-c119-4183-b7b4-e3247b71184e", "value": 80455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683185225, "uuid": "4c6747fb-f297-4948-9541-84bb0b56712a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683185225, "uuid": "f5d100a0-0a1c-46a3-8b48-81d8a3cc31f7", "value": "Demon.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bdbc71a-eacb-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1683239573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683239573, "uuid": "4f27240d-a881-4c78-a34a-9a1bc6cf1eea", "comment": "Malware payload (Fabookie)", "value": "81ba29ef50c3f6e6ce6fe4df6923dcba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683239573, "uuid": "d2f8512e-fa1d-48c2-8599-f513c90c55d0", "comment": "Malware payload (Fabookie)", "value": "9d4727c8d6ee3f645f9a77c512b84b0742d7502a15aeffcdd15366e6cb488c1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683239573, "uuid": "4e24e37c-4f64-4e26-81cb-3e4aa6d9febb", "comment": "Malware payload (Fabookie)", "value": "f1770e8706ecb05a9621442e1e1f9f95d543caf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683239573, "uuid": "e5466fa8-bda7-456e-88c7-4648455d22eb", "comment": "Malware payload (Fabookie)", "value": "5e6b9675ec26d98df395ee699eafcc6ce07c0ed9e1212bd526ea3b1fd861ebc21f49a319a94c1db4ca68c45d0c3fa1fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683239573, "uuid": "aaad89f4-3d4c-407e-a855-4669574ff6d7", "value": "T1D9D4DF80B39196D9C4B88430C593CE71CA317C64DB28569BB6D4BB7F2F32AB1653731A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683239573, "uuid": "01fa7144-6e02-46f9-bb69-cac5923cb125", "value": "4673ad56625d375f2efee239af061364", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683239573, "uuid": "dcc5dadf-8c95-4eb8-ab40-69f55d2ac5ee", "value": "12288:G72WD3/jvKx8Xr3lRkRc4YFwjsWOfRg6gtPbcTTn7qxerx7:qD3/rgWr3/kRc4l6g6gtPbcHn7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683239573, "uuid": "b0abf97f-1ddb-4141-ac00-3355101e428a", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683239573, "uuid": "408ea1f2-cbb8-47f4-be39-54b11922caae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683239573, "uuid": "c62cbc74-27c1-4861-94d7-1f5e4c09d9e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c48156-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683194170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194170, "uuid": "b9f4df05-9976-4910-9770-100bee64537d", "comment": "Malware payload", "value": "da94508552302df575e7ad0736c9fb99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194170, "uuid": "9457054a-0050-4e48-bf8c-64060e7fab98", "comment": "Malware payload", "value": "9ebdcc2177985cf7ce1afed7e0f8c288a079b15c358b491b135adb8d8597d78a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194170, "uuid": "09fb774b-855b-421c-9dfe-434a509018dd", "comment": "Malware payload", "value": "884e09503929a806af0b2787c3640a43bdae6232", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194170, "uuid": "ae02430e-be86-4db2-862f-60c853833c2b", "comment": "Malware payload", "value": "200d18561691e9b02078f307f1ac257ab2db0b01ef4fe1a91de9fbc13f3d263b6e86df476cb3399797e32ced5e406169", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194170, "uuid": "2eb5db3c-8aab-493c-8507-3c95ce5811f2", "value": "T15EA38D02D6D381FACCC547B0149CEEB6933FEF546B34D1878719ADA60A76942E0C8D7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194170, "uuid": "465adc92-070d-40c5-a436-b47afc8cf50f", "value": "1536:egXyX5+N2KWZzDgKJWHEjRdrEf8iShP+6oA631X+kbSumTu2IMu:egX6+NWzDgKJWkjrrR7hoA6lVLmS2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194170, "uuid": "06529e92-705f-4d98-b0e3-188e02a259ab", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194170, "uuid": "c0c85ede-5d49-4c58-b7e7-3297530b6a03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194170, "uuid": "dba55edc-cb41-4ac9-88a4-14d6cc17cc6f", "value": "SecuriteInfo.com.Trojan-Dropper.11964.26768", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f352da-ea8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683212590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683212590, "uuid": "86681278-7d9b-46cc-91a3-d213ff8432ec", "comment": "Malware payload (Mirai)", "value": "4f43bc7969083495903ca237b1678e6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683212590, "uuid": "fd32b7a3-f7f2-4744-b637-a0071c709cec", "comment": "Malware payload (Mirai)", "value": "9f2a4e7401f66ef6dd571ffb68d352610efa6195a8fb1a768b97bc51632c7b39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683212590, "uuid": "db26b14b-a6dd-4cd0-8b4c-79556b826873", "comment": "Malware payload (Mirai)", "value": "0fe91ec43982b6c4c3edc4424567f7342f7cfe2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683212590, "uuid": "2233e5ce-97c9-4d8e-99c2-91ac5547b96a", "comment": "Malware payload (Mirai)", "value": "54574776795f794e5bbdfcc1dc1931c9a0c588ee75f43526db92f25c2903b553abc616abc39865dc3c18c463c61d8af3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683212590, "uuid": "2dfaf614-21b4-4237-9a5c-b977134c3bb9", "value": "T1EB9319B81995F37CE9F150B9E84310DA28610A1C379CD1E379C3547AFFB8B087269E5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683212590, "uuid": "b6bc9b8c-0df8-4563-ac23-15621a4b4628", "value": "1536:lQHPNhpOTtsHT/WUXHaCw9iqLgaRW9yVlqN/W1ZBZv+16why:GH1hpOuHTd6CwwiY9ymN/WxZm16w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683212590, "uuid": "7ea44bb6-f8c3-4742-a3fb-9558e1651023", "value": 91588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683212590, "uuid": "c4522b09-308c-48c2-82be-289d08a980fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683212590, "uuid": "b82f7497-ff32-414e-a3be-6591d61a8d2a", "value": "4f43bc7969083495903ca237b1678e6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a08dfb-ead7-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683244547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683244547, "uuid": "c4271f7d-6d43-4a67-9d24-38a77b74c380", "comment": "Malware payload (RedLineStealer)", "value": "a8eb0c43338b47ef0d00006e3e8b3b8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683244547, "uuid": "6334a2ab-1c1b-454d-9234-67b44bbdf6c1", "comment": "Malware payload (RedLineStealer)", "value": "a03ec9dfddae31e0d2de314032036a51ef460821bb06ed0b264a556c67bd561d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683244547, "uuid": "cade0d99-f4e7-44a9-b695-b6bb05bde7c3", "comment": "Malware payload (RedLineStealer)", "value": "afcd1c7a3bb7881ff4adfa9a299465f7d87e2045", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683244547, "uuid": "e75ddbe2-836a-483f-aaff-2968faabb545", "comment": "Malware payload (RedLineStealer)", "value": "c19a3047d8ba53e6a1dd347124af8930020acbec66bffec8bd4eac5446e1745d14d2cb0e48713acbdcedc066ccf1cc17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683244547, "uuid": "1ba4031f-ffef-429a-a4e1-d397f69c0717", "value": "T13984F153E7E85432EDF51B7098F613831B367CA28DB4935B2745A99E0C72A80AC3177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683244547, "uuid": "f523bed1-f57c-4beb-962d-7f70ab0da55a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683244547, "uuid": "9853427d-7bd1-4a83-a218-83186ad1809e", "value": "6144:KGy+bnr+jp0yN90QEG7SumO6qDGCteWPRF7Z3/FtPbnigTApVn3rf8Ql:6MrXy90Y7VRhSCr1/bjnigef8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683244547, "uuid": "f6d3b247-5a46-449c-976e-3c290feb8661", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683244547, "uuid": "c1b2a9ac-6bf0-4bc4-bd20-753f6f00d8fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683244547, "uuid": "28273f9c-64de-4e84-a5ae-eb03feb7e8e0", "value": "a8eb0c43338b47ef0d00006e3e8b3b8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "774ebe24-ea3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683178093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683178093, "uuid": "c18e6a97-39c9-4187-94da-40736fc00076", "comment": "Malware payload (Amadey)", "value": "c8e1bf44ffcf39ba318a50b8aa5884a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683178093, "uuid": "0a274772-1185-41a7-9026-d31d59921562", "comment": "Malware payload (Amadey)", "value": "a0ff39d79052423460d782d27fd57d2998700e9c2a7aad4bc9669f5b9a736cfc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683178093, "uuid": "6c0881f2-e795-409d-b836-302d58e866f6", "comment": "Malware payload (Amadey)", "value": "a953cf8b82edfcbafd6bd0072f0718107c79d5d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683178093, "uuid": "f04721ef-862d-4dbc-9380-555a70007893", "comment": "Malware payload (Amadey)", "value": "143a67c34d59b9967d2b46bd5bd73faa8d84e10aaf0e21cfdf3f311218bbc695387b3eb36f8e1e8d8d22d8a52ea5daff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683178093, "uuid": "25ce76ff-8585-4a69-83bb-de04bea1799c", "value": "T1BCA41216FBDC4432E8B527B01AFA01C31A3AFC916938477B7785681A0C736D4A97277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683178093, "uuid": "0b361e38-203a-49c7-abf9-d5577b6d13f1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683178093, "uuid": "9e0e332b-c7a7-4ece-881c-dd78e7caab8f", "value": "12288:BMrgy90A4duGbwVnv7fdGfHi8PrnaSWui:hyFm0VvxWLT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683178093, "uuid": "42790eaf-a462-48b3-83c5-a3c079991f5b", "value": 491520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683178093, "uuid": "a87f45cf-abff-4a5d-8b41-dc3b142e945f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683178093, "uuid": "78d41f70-d3d1-4529-b804-b348e69e43b5", "value": "c8e1bf44ffcf39ba318a50b8aa5884a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bcb5b53-ea35-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683175041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683175041, "uuid": "8af4999f-5781-4df1-82f8-8d2a3c400a2d", "comment": "Malware payload (RedLineStealer)", "value": "4c4257e691e7d7c43102d0fde19b6ef6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683175041, "uuid": "3ffab90f-3890-49dc-b663-c17ba457b01d", "comment": "Malware payload (RedLineStealer)", "value": "a134c27ea8c8496f0ccb2735216a50c34f6a851adc886833cc210e3d3fe0f710", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683175041, "uuid": "9c7bbd93-c87c-4da6-8238-d95c596d0043", "comment": "Malware payload (RedLineStealer)", "value": "2005a2a21eadd5d949f18ad96df347556a92bd26", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683175041, "uuid": "3473bb17-1f0b-4482-8011-ae9d474283ca", "comment": "Malware payload (RedLineStealer)", "value": "dd9183a32a134be05f9fd1e3e30d489449e70ad2a157f506858cf24ddc45ccc79cadfcd4c572079fa9855b01c12fa7fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683175041, "uuid": "4bb3bfac-0d94-47ed-96ba-304b3f9d0802", "value": "T176C41223FAEC5133E8B11B7048FA13C31A367DA25938875B6B659D9A1C73984B43173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683175041, "uuid": "640cf36c-87e8-434a-9b89-ce241fb59568", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683175041, "uuid": "f791ceab-2388-461c-9d06-80a2258efb5c", "value": "12288:EMrNy90s/csftjF03+fPApSvK3fv57d3awlGdjCzuy8OK:hyp/PfY3iYQvK3fvlxGZCzuy8OK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683175041, "uuid": "90de2df5-5a52-4cb9-b4b7-444fbe0afd65", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683175041, "uuid": "50770b77-845f-42ea-b959-40a699fc591e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683175041, "uuid": "b3920d1d-68d4-44d3-955d-b9c3a554e7a3", "value": "4c4257e691e7d7c43102d0fde19b6ef6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3dbcf1b-ea42-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1683180799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180799, "uuid": "9fd3624d-4789-4464-882a-325a74a27eda", "comment": "Malware payload (GuLoader)", "value": "abc5618b5fb509686c4f56438d71c315", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180799, "uuid": "57d1f6a9-2e81-4123-91bc-e1c249564f1a", "comment": "Malware payload (GuLoader)", "value": "a2eaac349a954d541baa7ecebb64870e6ff3bf161d5901b74821f49ce45337d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180799, "uuid": "8e4aeec4-0f9a-4849-85a0-480f517e591d", "comment": "Malware payload (GuLoader)", "value": "e65eee9add5f43a4ae6471dee42008727cc060f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180799, "uuid": "69cd04b9-0dc7-4430-bf19-4d9bdb413ea6", "comment": "Malware payload (GuLoader)", "value": "18d9b5f599622d2e2486a8957f6e3ddf8657964c267dde85627e496d79426d76804e079768133f346ec2fd115f4be1e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180799, "uuid": "4d3497d4-8011-4cd4-b71c-b98c0a0d717d", "value": "T1996412B675D38857D78556B0CFB1CA37E7B9EB400C37469B3BA02F17B9243229E08199", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180799, "uuid": "33497161-7981-4e10-bce4-18d98a1e5829", "value": "4f67aeda01a0484282e8c59006b0b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180799, "uuid": "26305274-5cda-4c1c-9a30-da92b409664c", "value": "6144:K1onEmMMMMMjMMMMMMMVm674BZiOoG67WoTXb0ZEQkOZIFujo1XN+KOI:2odMMMMMjMMMMMMMVmA0QOsvbfCISS4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683180799, "uuid": "98965ec2-97ce-44ad-9d8a-81a7c4cbab21", "value": 306896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683180799, "uuid": "baa52568-c8ec-406a-b28a-abbba06db1db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180799, "uuid": "ca16a5d0-3c3b-425f-8269-c9a4bcbc39f3", "value": "new order S-01091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "969bad11-ea48-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683183300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183300, "uuid": "291774ea-8979-47f7-ac22-f939e7abe34b", "comment": "Malware payload (Mirai)", "value": "eca6310f9a2cc54e3a1d5054f3ca27ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183300, "uuid": "a003db94-25ed-47f8-84f8-b544fc4883b4", "comment": "Malware payload (Mirai)", "value": "a2fd539fe2d83f1f9e82ec0da351bb2d9603f371a635310ffed219efd37ee412", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183300, "uuid": "a7d21f1c-6d62-43fd-b198-fce25f2a2b4b", "comment": "Malware payload (Mirai)", "value": "f6f5d70ab1901382bb3889b1614a580213d7c2ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183300, "uuid": "60e4e662-c1a5-4b13-9f30-acb6f7887885", "comment": "Malware payload (Mirai)", "value": "8d289813405d03cb5b31285a7fa74c38d536ede1722193fa6f25b35c54d7be56f158d8ce27948bb7f5598bf6bf3f9cb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183300, "uuid": "fb1d3a53-7117-4ac1-8f2b-fb0c61edcfa2", "value": "T1AE436C84E743DCB2D8171631107BAF37BA72E6E91224E746E7A8A636EC51702D017E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183300, "uuid": "8d13783d-5fab-4bb8-978a-c280308b37eb", "value": "1536:7sV4STUx6ghctVlOOPvnUw+NF4ygl8s0ih1Fr13wbZnG:7Q4STUx98VldvnF+NFD48sFrn3wbZnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683183300, "uuid": "58894905-2e19-474d-8bbe-90020d7e3d58", "value": 59056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683183300, "uuid": "ac18ac7e-117f-41d6-be95-d21206637db6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183300, "uuid": "46029544-8bd8-4f52-9dd5-96d8d2ab94ae", "value": "skid.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227e1c7b-ea53-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683187830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187830, "uuid": "dac4eb20-2b91-4aa7-a5f9-b65c168139fb", "comment": "Malware payload (AgentTesla)", "value": "1fc441a44d3e2689c9dea07509fdbde9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187830, "uuid": "c3eb4d99-5ad7-413d-9843-6a33c43b5ccb", "comment": "Malware payload (AgentTesla)", "value": "a517db8ece77f35369bd371892dfad880c7cd9b7e2a936c6ef6b99d19ed83f78", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187830, "uuid": "cd130600-f10e-46bc-bfed-c215b87649a7", "comment": "Malware payload (AgentTesla)", "value": "600cfa9ea8d73e7fea4b937a8fdf10b07b1541e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187830, "uuid": "101d18bd-b945-4458-819a-8e36a1407d0d", "comment": "Malware payload (AgentTesla)", "value": "f8d9443d14a0939ef3a91e8bca8e1070a5bb6cbbc6ee552c0e3f11513baefac5eb6c48bf798c966b71e003e309a7ecee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187830, "uuid": "36c7374d-3b78-43b8-a1ee-ff8fe33ec1e1", "value": "T152F33BD1E24485D9DCA917B19C7B8C2015A37EBEACF0921DA4EE763947B33D30097A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187830, "uuid": "1c1f1bc5-4cdd-4a4d-b0d2-c2a032c08bae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187830, "uuid": "947f4442-87a2-488f-b465-f281b4b35e2a", "value": "3072:AQO9OaOQhRHdYu49jiSm64Gh1iZuTku94uQ142C5UJG8VX3m+RwYYfAv3THehoYs:SGeYeSmOmBJGgMoXRZouOYB1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187830, "uuid": "8427cdea-26bf-493d-aeed-145dd096bc1b", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187830, "uuid": "7448af63-6cd3-419a-a2a6-42078be152f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187830, "uuid": "c0fb98db-3778-46df-82f2-06b679448993", "value": "prodotti elencati.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f3ee565-ea1a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1683163558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163558, "uuid": "7e7666b8-3ff3-46cf-821c-f376de15ade8", "comment": "Malware payload (Rhadamanthys)", "value": "55ea906adf2a596446187015428919b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163558, "uuid": "183ae9b8-140e-4dca-a616-2beb04dcd3bd", "comment": "Malware payload (Rhadamanthys)", "value": "a56cffd6ef0070340131ce0f797bfcf31496d73e135e3c651f112e936391add8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163558, "uuid": "b138a87c-a54c-4f7f-ad78-df335879ce21", "comment": "Malware payload (Rhadamanthys)", "value": "c983d7b42ae0c39b8e32f0c8dc56c5d8fd0eb2e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163558, "uuid": "93a3729c-4cbc-475d-bef8-41575647e077", "comment": "Malware payload (Rhadamanthys)", "value": "eeb19381c75c5f3e4d450adc36c0fcb5556c6885b82ec8b29aed1f37733697125e3f7c3a687c3b01077509256b4c9345", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163558, "uuid": "bb8cb1cc-85cd-47a6-8acf-0c1d46692643", "value": "T1DF74AF0372D0A835FA26CA314E1AC6F46E1EFC65BF1567EF12446A1F4D712E2E672312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163558, "uuid": "bde34b41-65fd-4463-8e38-ac8dfeec5007", "value": "2d39bee49f300ea90fe79768115a52cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163558, "uuid": "d07708f2-14d4-4d4d-9d04-a7d95246b39b", "value": "6144:XWN536qhrNyxLQdvuSksg7LwFJl2VjaFtY6yQGir0:C53HhrNybSpoCJlmWY6yQDr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683163558, "uuid": "42e7f89b-0285-4d3a-98fe-bcf4e5f7b754", "value": 344576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683163558, "uuid": "d5ccd2db-0640-4e35-bef6-45ea9a92e37e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163558, "uuid": "82d3bdca-20a0-488b-98fb-4d3d32346595", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07aec973-ea73-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683201528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683201528, "uuid": "74aafb98-0194-4bb3-a159-adf0c57a5a9b", "comment": "Malware payload", "value": "e5812f186043be0dd447f70dd2673beb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683201528, "uuid": "d4da4c38-7e46-40dc-99d2-ae4eabdc8e35", "comment": "Malware payload", "value": "a5aa512bb59afc5126490779d0dc6be737cb35d8d2f2d387612dc36a7175957d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683201528, "uuid": "f981f3bf-f5df-4934-9de5-83c8a2867c48", "comment": "Malware payload", "value": "92ac32fac5660ad5ab9dd198b9403a8d54508ec9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683201528, "uuid": "0ea3f4f9-c452-473e-99de-bd6b3d73c73c", "comment": "Malware payload", "value": "9f44b01d1789876f1ae00e7239bafaf4a088e5d013c8aa5e9f23a5bf82638f3352a5973cfeed2a894468c395367f2dec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683201528, "uuid": "097dfe6f-623c-452b-80f6-5d341bd87489", "value": "T1F0343CADF4B6D50BED238EB05AD9F7508E7B75E5CADDE2F008B872242970067484172E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683201528, "uuid": "2f82e750-a553-47e4-9a43-4bb81eaecf24", "value": "071307373db47402e881a4d65e0a19ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683201528, "uuid": "d0d68c12-2851-488d-8ce1-8b7ec9e6b776", "value": "3072:0cbSBAyBuQL25e/1xRbG3Q5RZlnTNKZ1SKZoweu+H/+88veTJBMpSJsicukg4mt6:0cFyDTGoweuk2byB4SGi0mt7WsjK5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683201528, "uuid": "e3060093-affa-476a-a9df-e68b63322004", "value": 245600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683201528, "uuid": "6497190e-82bd-488e-aecd-fb49735e29ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683201528, "uuid": "12f3fabf-1e91-4f7d-8bac-8bba0c8e441c", "value": "a5aa512bb59afc5126490779d0dc6be737cb35d8d2f2d387612dc36a7175957d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d92ef02-ead1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683242153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683242153, "uuid": "feac2aef-eac3-41cc-aabf-cfe9727fec59", "comment": "Malware payload (Amadey)", "value": "9e529f47e109dd2ba44402d971dd1dc6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683242153, "uuid": "ee423e37-7480-4a59-b4ec-7875d5ec2d7e", "comment": "Malware payload (Amadey)", "value": "a614c9b90ac5ea2463358facd1d523e7788cecd7697717017279d92f06936839", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683242153, "uuid": "15ee6e25-04be-4af1-a526-acff9c1c9924", "comment": "Malware payload (Amadey)", "value": "728fcb310a732b7a78e214f3a985bd8dd7afb00b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683242153, "uuid": "cbe77876-7c27-4ecb-9433-d0083b927726", "comment": "Malware payload (Amadey)", "value": "afc0836a583f1b028822f6eccf2870fa9706a3b34f676bd27327d2d4859f120bea8dbd5f5af68945b4a8fd6cf3e19053", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683242153, "uuid": "5acfb7a9-5359-44d3-9f06-649b20f2ec27", "value": "T176840113EAD88473EDB92B7058F603831A35BCA29DB1936B2746985B0C72780F57177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683242153, "uuid": "36332d32-5e67-40c9-afec-973fa19f033d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683242153, "uuid": "7fa083f2-7095-45bd-93b2-3264a24fd338", "value": "6144:Kyy+bnr+ep0yN90QEOWkGaTG5teWEZTZtxn4tJmqZkwiJ3dtV1BZ8RRVR:2Mr6y90ALGaC5WB4XmxR/HanVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683242153, "uuid": "41f7efe7-f250-45cc-b425-9054d7e9e0c8", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683242153, "uuid": "325fdd8e-0bc9-45e8-8109-a510d82242a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683242153, "uuid": "0b102a0f-976e-4a6c-a7de-1abbb8e27de9", "value": "9e529f47e109dd2ba44402d971dd1dc6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da48193-ea42-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683180654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180654, "uuid": "4d4d3c39-1dee-4cdf-aece-a4d6d778514c", "comment": "Malware payload (Formbook)", "value": "b7165c69747834caadd62aa7892e9000", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180654, "uuid": "c1f7f85f-b951-4218-8f67-1c1fa150e5c3", "comment": "Malware payload (Formbook)", "value": "a61da59c71961241e2e01db30a93a9ff2fe05ec4885274707dd063c2706d67e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180654, "uuid": "7cc03f3e-2c45-48c8-afac-33d381953bd1", "comment": "Malware payload (Formbook)", "value": "40c3afdea1e5b3f61c14591e0a7ce46ce52de022", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180654, "uuid": "6a066f35-67f0-48e1-941d-546f2db0af8b", "comment": "Malware payload (Formbook)", "value": "39a7299dc6fec735ffa07cb1480d5e230ac60ce1b6377427e7b98b65370d14c1886d12aba342dfc94ff6dfccb410b638", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180654, "uuid": "ec2cfdf7-7461-4b61-a503-ae601920a7ca", "value": "T121949DE0E351C9E4F86B52FA8433983226579D2DA4F9151F04BD72616AB33830DB7C9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180654, "uuid": "c1070d3b-db67-4141-ad62-bf7a5b0f73e1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180654, "uuid": "04156096-bd19-4409-86ce-3a8909b52bd7", "value": "6144:IYa67tseYlNrGwbgnjOkYNOmM1WXI2ag4yv2llGlwJSW/iDJPXa0l86:IYMKwbgjO1Wm4yv2b1CP/86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683180654, "uuid": "f2f1a5b5-d6f5-46f0-8023-8c2f1011684c", "value": 408901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683180654, "uuid": "d480e373-845b-486e-a62a-09e9bac43675", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180654, "uuid": "d148ae03-e2fc-4bb1-ba0b-d9ceb3416512", "value": "Quote_Request_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b6b971-ea42-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683180555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180555, "uuid": "ee4546ec-8181-4d6c-9c0b-de89b2099ee5", "comment": "Malware payload (AgentTesla)", "value": "70468b5dac728d91a8acd453005cc9a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180555, "uuid": "fbbfe731-efdf-4ce6-a21a-52c62eba4b68", "comment": "Malware payload (AgentTesla)", "value": "a62a229c3b4cf8ab99889409867fed1758148f1187f8afdca2e29fa3b79239d3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180555, "uuid": "e3649d08-270e-43b4-8f62-7386b916fec4", "comment": "Malware payload (AgentTesla)", "value": "64bf673e2fa23d3208f198a06ad7104807c2e86a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180555, "uuid": "5eb4976c-6346-415f-823b-aaac4b11e8f1", "comment": "Malware payload (AgentTesla)", "value": "86ebe5b3e61f33274b27709b97cffcf5d47c47f396bcb91e8fb6ffd8deb5af94beda7aeea61f243dff2cc7cf9585755c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180555, "uuid": "c54aaac1-a94d-44f3-b47b-2c1e25cfc55e", "value": "T1D5F4BE60F3A68902D40BCE731A6CF9B01171BC9B7DC5D6A45BDA7F577ABBB44280024B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180555, "uuid": "107a4daf-829a-4e21-bc2f-6dc983b93a33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180555, "uuid": "4360b095-da3d-4e2d-9de5-05695a61a0fe", "value": "12288:nBi1e0xPmaj2y1wZCwAPxgrrQPQjuZEOioRTW0xLxMnv2ilfuK:nEA0xuajP1wTAkluIyC+L4v2EuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683180555, "uuid": "053461de-83c1-455e-b1e8-e4fc5cf8feac", "value": 793600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683180555, "uuid": "d6c9d456-7fd8-4556-87b0-1b8a8ee7524e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180555, "uuid": "545d0b39-7a66-4e4b-a268-29041fc091e4", "value": "NOTICE OF ARRIVAL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9def1f6e-ea84-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683209082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683209082, "uuid": "2101ab92-39b3-4592-8501-0e242ddab4c4", "comment": "Malware payload", "value": "778fa9ef133c22472faf3a5d38b5ceb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683209082, "uuid": "dc5402e3-3529-47cd-b0dc-d1d82db530b4", "comment": "Malware payload", "value": "a6c32c5b3009f3138c5c0bd7e6d9af756264479fdda12ec6a403c4078742a6f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683209082, "uuid": "1d28e0f1-b954-4278-8d6b-90da2c5fa41d", "comment": "Malware payload", "value": "a62fef90e75fe84b332f3aca30443b44796936f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683209082, "uuid": "b945fd6f-15a9-4ce0-92a8-546009fd6ad8", "comment": "Malware payload", "value": "32b03d4575dfe7b5880e4492a68f9732157dd480aecdeabd63dfae2c299b55c637418d2d454d73fdc358fd3005e6ec3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683209082, "uuid": "7da6d163-aa88-4e7f-a87a-881b28a071a8", "value": "T12C84129273C74B00CD2524BD44EF823A07E16FC369378AD9BF0C36A95E16A139F96946", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683209082, "uuid": "d9e2cc60-02df-4b7f-883d-d5186adc1f84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683209082, "uuid": "b771b716-19ef-472a-85be-88027ba4f777", "value": "6144:JiyrlK2EmkseqwA1Lxl6dONR8NQLkNNL66hUMK/W3dDUyhU2rV:wyrlK0np1l/g+LkNJDhUp/WtIVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683209082, "uuid": "03f026f8-aa0d-4e9c-bd1d-89b95c10f636", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683209082, "uuid": "d2ea2759-c7f2-4d3b-831d-380dd1fdfe60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683209082, "uuid": "c59856b5-9a9d-4a7d-a475-99074e76930e", "value": "a6c32c5b3009f3138c5c0bd7e6d9af756264479fdda12ec6a403c4078742a6f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "057fe87b-ea57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683189499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189499, "uuid": "e577b07c-67f5-4d72-bace-b63ae07d284e", "comment": "Malware payload (Mirai)", "value": "08dab6c77f99b3cd67989e1f5ca5fdfc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189499, "uuid": "0d5f1d90-7ccf-4fb3-a38f-b1c037e9cb2a", "comment": "Malware payload (Mirai)", "value": "a792ac8bf9fbae3d0f2b0fbda70a4e0fc522d3fe675c3984b7c55d3016990a2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189499, "uuid": "d7ff5a7c-b344-420a-90ef-3897159e435b", "comment": "Malware payload (Mirai)", "value": "331e741490951a24413e00e92725a7eeb4363a30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189499, "uuid": "c8b1cc9f-fa96-49ba-9216-9d0dbc12619a", "comment": "Malware payload (Mirai)", "value": "e1c5d15a0c300c0ea296b2597dde5a50390a812146c5eb1a4e7443c3605c149ad9e4a8629364128272b94f541dcd9cbd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189499, "uuid": "c527514c-a03e-40b4-b8b0-d2842f3c891e", "value": "T16F831956F8819B26C4D0127ABD1D018D33131FB8E3DB3202DE19AF317BDAA5A0EAB551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189499, "uuid": "35241e1e-133a-4a00-bd34-13dcc47c5eb7", "value": "1536:F+n4dJLxXUfvFOVFCsbd9f/NR/N/CBGXgEkGbUEVv4KmfVOWDHYIjXfnW10r:DdZxXUfvFOVFCsbd9f/f/N/OGXZpVv4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683189499, "uuid": "1ee9a9c7-1b7a-469e-aed0-215335e112d0", "value": 82852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683189499, "uuid": "a1236343-21d1-406f-8afd-0157955259a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189499, "uuid": "f6a8edb9-a380-4761-8ba0-d40e82ebc0c9", "value": "08dab6c77f99b3cd67989e1f5ca5fdfc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae528d5-ea2f-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683172355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683172355, "uuid": "c63a123a-aa6a-453e-a4cf-12499b0490f3", "comment": "Malware payload", "value": "7f8045b2c78195d846d5622d65574cf5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683172355, "uuid": "b1f757d8-7eac-4a81-a32e-c137dd22fbd7", "comment": "Malware payload", "value": "a9939214c9c6a2cd0245d3e41e960f0cffbb1ee0ec26e98453e9f586a30b4c7f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683172355, "uuid": "02812e1f-9a77-4800-9ec8-1dce3a67fc35", "comment": "Malware payload", "value": "5d1a01a1d270a4a70a4c4330b2e5ca74ccc886fa", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683172355, "uuid": "27394a96-590a-4037-841a-4820c041b68d", "comment": "Malware payload", "value": "3b25666c35fb242e7f2242ed23e90e56eb8df25df5dcc2374fae612f12332a08f3f21684363d52ad445c427df9b04d59", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683172355, "uuid": "50e1e662-5917-4f90-85a1-38f11ff40d2f", "value": "T141B229565B8C4C61E26AE8BB435DA00E08FCF23230C255C5BDADE2757B7D14E0B6B5B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683172355, "uuid": "a6d4fc59-93ad-4b83-88a7-f8f66d1f0317", "value": "768:BujI7W+aQw3KJdpsTZ220Ini2nJX6j4bVd3hlWajx:w+aV6y7Tqj4r3hkajx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683172355, "uuid": "a45d7695-f289-4f72-950c-b2ee76eec411", "value": 25239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683172355, "uuid": "e3ef6753-2444-4a96-9805-10fa7c4d49e9", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683172355, "uuid": "d22ce913-a8fd-4026-908e-9dbba0fac47f", "value": "7f8045b2c78195d846d5622d65574cf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a32c8689-ead1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683242162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683242162, "uuid": "154167aa-864e-4069-9955-af4cdf5943a9", "comment": "Malware payload (RedLineStealer)", "value": "3f9c64f14f28a8fe9afbf434c4237c3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683242162, "uuid": "ebb57cb1-db22-49c0-98c0-f0d418256492", "comment": "Malware payload (RedLineStealer)", "value": "a9cbe651f45880392d51f71b45409bfe1d020fab509d8f6f4e9afb228d7f3e96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683242162, "uuid": "6e90b875-b89a-4842-9848-39c3974cc87b", "comment": "Malware payload (RedLineStealer)", "value": "6c982051750c6cd77223c0fdbb2df6bf20ba8eb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683242162, "uuid": "8cb2456d-3bab-4298-b774-90bf62555661", "comment": "Malware payload (RedLineStealer)", "value": "ecd779af9a7f9d3fad76b8be2391563d194ebb2022024c93ca74adea7fa5ae73663b20234e5441bf367c1a5e74fa91dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683242162, "uuid": "610fd0e8-68ce-49c9-bd60-077843b93ce8", "value": "T1D7840113F6E98432D9B11B7155F303C30A363CA29D7483AB279AA85F0CB2694A53573F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683242162, "uuid": "29c41148-e8a2-4655-ac13-67afeb8a10b2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683242162, "uuid": "68a848fb-bcba-4db8-a733-05d5fc563e1e", "value": "6144:K5y+bnr+Gp0yN90QEgf+fXYP7ePRDJ/fBlXJOuHBnDnB8TIOzwW5I/OCkOXN5F59:DMrCy90epPKJlZ/H1iTve/SOXNB13Bd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683242162, "uuid": "f6c29b6e-4420-4739-9873-f8db376a132e", "value": 396288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683242162, "uuid": "8e9b6350-d2f8-46f6-b6fe-8d361d9cae28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683242162, "uuid": "7d919ed6-a489-4ebe-87e3-acdd28aadd7f", "value": "3f9c64f14f28a8fe9afbf434c4237c3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15552c98-ead5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683243642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683243642, "uuid": "bcd861f4-e67c-487d-93d9-15e7d54c68b6", "comment": "Malware payload (RedLineStealer)", "value": "34ee57585f7221603437ee9ecfad3310", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683243642, "uuid": "19353527-e7ff-4aba-8184-07dea6dbb6e5", "comment": "Malware payload (RedLineStealer)", "value": "aba34edf3f8e7f646f3050e5af11125e5907fa65e5cacb2e6382ce7f85fbbec1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683243642, "uuid": "d06463d0-4125-4f5f-92bb-e2f1f5568740", "comment": "Malware payload (RedLineStealer)", "value": "488321cf023594fb4123fcc4cca7b7d9a0f8a7a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683243642, "uuid": "680230e9-70d7-4ca0-8d38-b2a943085d32", "comment": "Malware payload (RedLineStealer)", "value": "67290d52d62e320625d3f2e3a77f89bcd05a98dad02b547bb82c7966d1e1ad15e6525d0dda8ef1233f1767bad7d54d56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683243642, "uuid": "20b8e880-34d9-4a89-9e07-ca8081c71557", "value": "T19D840212EBE94023D9B5677048FB03C32E367CE16E74972B2355986A0DB3981A47637F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683243642, "uuid": "fa1447f2-82bd-4e19-87b9-e1d5c4a7734d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683243642, "uuid": "e5cdf21b-3b48-419a-b970-ef045f8eec4c", "value": "6144:K3y+bnr+8p0yN90QE8bpHtVzT59SrdctofAWi9JY:9MrMy902b3VzTvidcWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683243642, "uuid": "54b283c2-07d0-4b7c-80fb-0fd6a8d02261", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683243642, "uuid": "1d2da59e-65a5-44c0-b1d2-0f41ad6ce7a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683243642, "uuid": "229f9836-e6c8-400d-afed-75fe3e0f67ed", "value": "34ee57585f7221603437ee9ecfad3310.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055cadf5-ea58-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683189928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189928, "uuid": "58a1eae8-9efe-45eb-832b-3e72c12b0c85", "comment": "Malware payload (RedLineStealer)", "value": "2eb81e12a60464d8240aa0ff066aa40c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189928, "uuid": "21ddae12-7f1d-4271-a014-eb084f560f52", "comment": "Malware payload (RedLineStealer)", "value": "abc270c5446ed04d91abe760f62e7f3c342de2e8e96121f3b482bc30839d61f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189928, "uuid": "1c2d5381-fe47-474d-af95-d93997517116", "comment": "Malware payload (RedLineStealer)", "value": "ad67a08c23cfcff6f515cb2f029581448daf05ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189928, "uuid": "3e26e1b0-8d9b-4905-8544-283f6195675f", "comment": "Malware payload (RedLineStealer)", "value": "b19510772b2e889ea47ea3f142bbae0e8da7aeee7ab21a5793561b75d0f4f507102eba855f6776b573862e83868da8db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189928, "uuid": "a48a88c2-c6a8-4349-b44a-3162066d2c94", "value": "T1CA652391E3E9A472ECB60B7454F707DB0B3AB9518D3C8AEF27549D894CB2880D631376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189928, "uuid": "4fdda2e4-fb9f-4e4d-9855-e65fdfe06539", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189928, "uuid": "55e66bf0-0272-44d0-bf71-016124e6ad9f", "value": "24576:WyTYO93n6um2P+i1vMOHhhgPzumXppXwgjN6GLxlT/HHBflit/vphUvTXxU:lY2P+WNDezumX8WN6izzHBflvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683189928, "uuid": "df401127-d43b-4e73-9b53-fadfa3cb7e87", "value": 1521152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683189928, "uuid": "676e4dff-7f64-4fd2-8cc8-bfda0dfb2a19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189928, "uuid": "129c1f3c-4477-4760-935f-cc0d3262e4fc", "value": "2eb81e12a60464d8240aa0ff066aa40c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a332ef04-ea41-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683180315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180315, "uuid": "71def085-2934-4fe1-96f4-9e40bec07a17", "comment": "Malware payload (RedLineStealer)", "value": "3bf7890e75f061505ab78ab219ce18d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180315, "uuid": "d09bfb12-b149-4aba-9dcf-9c1226714196", "comment": "Malware payload (RedLineStealer)", "value": "ad27ea6f2c2e9201d406da0005a2a944e3b4276a2dbbb942ae9b779682b76787", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180315, "uuid": "6427bb83-ca13-485f-9679-79992d55227e", "comment": "Malware payload (RedLineStealer)", "value": "81bad4c77719a76906a2143e5ddab084c7596dd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180315, "uuid": "abd8df55-f1d9-48b6-800b-1db71479ae64", "comment": "Malware payload (RedLineStealer)", "value": "d30b3976821709b8a86dd737a380c700507b30b247eea0f7228a8888c29f6908a3981c2e389b5210dc7d105514190da7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180315, "uuid": "2ac34c55-d200-41cd-a013-bfb9c98a7deb", "value": "T13C747D03530EC9BEEE6B60B9FCC4C2A56B54A0B9BB1FA287BBD02D14456F1E0765071D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180315, "uuid": "80e618cf-cc8d-417b-abc5-efd23dbfb720", "value": "d03a32a9d6119786dea4a25b734d4a33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180315, "uuid": "1382a659-b515-4bf0-a4ef-aabb09f10470", "value": "6144:14dkz8GrVhJBQs1EBSQrTKNcgG/9Ym3srGwO8MdIzsN:14dxGxhJR6Bnr2in/Wm8rGt8Md/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683180315, "uuid": "76b3f2ea-a58e-4acb-b79f-176f62b9e4db", "value": 346640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683180315, "uuid": "faf0c74a-d0a5-4f34-bfd5-001fdd5e9994", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180315, "uuid": "477cdb6c-3821-4677-bfaa-ebdc79808579", "value": "3bf7890e75f061505ab78ab219ce18d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6149d8d3-ea6e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683199531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199531, "uuid": "346bf702-a14b-4ce2-8455-a60c519c9697", "comment": "Malware payload (AsyncRAT)", "value": "b124a807c0ad34c6b986261d504543a7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199531, "uuid": "4fe5fb2d-b532-41f0-8401-cc50bb164792", "comment": "Malware payload (AsyncRAT)", "value": "ad2d9acbedafbab48db73b94a4274784df7c51fb015beefbf34a64504f791dc3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199531, "uuid": "a7834d89-4e48-4689-b764-28a8a37a5b76", "comment": "Malware payload (AsyncRAT)", "value": "4c11612ccb64b775d9101e81d47e0f395fe43ec1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199531, "uuid": "17d35b5d-68b3-4b9a-8d72-d15208db0733", "comment": "Malware payload (AsyncRAT)", "value": "d4932d12f3db3a003367ae2723b69cd0536c8c39d983c7e56feae4f9f6077c108020afdabd981455e9c26304cd420c1e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199531, "uuid": "b4b6ce97-dd20-4565-b716-faf6adebf6bc", "value": "T1B144458157CAF5891C373728A0987349FABC91A2D6FC51109E99583FC39B6F762CC923", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199531, "uuid": "d781a83b-ec96-4254-afa0-24234ce1271c", "value": "1536:of2s04f9cY+WG0pibDS0UvXAXpXXQXFXHpEDoVJnN8PH+mPbxUjLFdsm1pWdS5yq:EEAd51pWa9df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683199531, "uuid": "564feac1-77f3-473c-a4a5-eab1dc13adac", "value": 272179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683199531, "uuid": "12a745b5-afd7-45a5-b9c4-76529979f286", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199531, "uuid": "a0a06a1d-fcc8-437f-8487-8b6e958e59e8", "value": "A.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d8c538-ea92-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683214888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683214888, "uuid": "0c2c6d03-f170-435c-9502-6541d6ebdaec", "comment": "Malware payload", "value": "e6e6270e20ba59873795c0785dbaea80", "object_relation": "md5", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683214888, "uuid": "99ee0ff4-0376-4081-a65e-038cf330942c", "comment": "Malware payload", "value": "ad34be18b3dd65e53f31acf60a3cb47dc1622b8d7263ce675ae8e2769fb3e008", "object_relation": "sha256", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683214888, "uuid": "69d772f4-54f9-471d-92b6-c18aa832bce4", "comment": "Malware payload", "value": "f9e38ee5d479da7524c3704f519789428bb68b97", "object_relation": "sha1", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683214888, "uuid": "efbdff73-8013-4c29-8a77-35dfc3eb1e3b", "comment": "Malware payload", "value": "86ce7c5a54d27588d760d48e5a799f5474634f0370a5df23a8dfc740f80ecd9dd2c39f377beb93f855cf497e840ea1cc", "object_relation": "sha3-384", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683214888, "uuid": "98014ef9-98bc-4f0c-9dd1-130d2e9df03f", "value": "T1BCD533A3C1462382CDEC7CB529698352EF9528FFC8608433E530698FA536BE735D1B94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683214888, "uuid": "c510f8b5-0b81-4290-815f-b7eaa1ed888b", "value": "49152:4lrIjOeJ1xDLA5n0/cbydryltLsNgYnaswudAjinKlVzuywl8E:IrICeJ1xDL0n0/cbyxN3apuqjinKHur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683214888, "uuid": "26bb5ffe-e246-4a45-be7f-c67272bb9c4a", "value": 2881258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683214888, "uuid": "840405f7-fcc1-4267-be68-25412c49f017", "value": "image/gif", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683214888, "uuid": "8805e6cc-ee45-4d63-aa44-2a45545f1a7a", "value": "ezgif.com-video-to-gif.gif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a86275-ea94-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683215750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683215750, "uuid": "6d2a7efb-f869-4772-83fb-92b1e2a19564", "comment": "Malware payload (RedLineStealer)", "value": "2e942f6cc58995657cc8c46e7a26e106", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683215750, "uuid": "3b381df3-b90b-423f-8148-8208115c0723", "comment": "Malware payload (RedLineStealer)", "value": "ae388559b711c73041590e5cef681969828abc52e653387d333f0612a486b8d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683215750, "uuid": "e28e62a0-78a4-48ab-8d1a-5856108f0792", "comment": "Malware payload (RedLineStealer)", "value": "f0ef3ee90fc16151867875b46e88e1fede473615", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683215750, "uuid": "c2a5166c-c088-4314-bac4-42703ac879cb", "comment": "Malware payload (RedLineStealer)", "value": "399c21c76a056791128f608252790ae9659ecb22798e2ae912a255a38e23c287b9544068a0ec1538cfb5ab037a422d00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683215750, "uuid": "b66ab9c8-ca67-4cb7-be37-7df2d702b550", "value": "T134752301EAF940B3FEE12BB418BB42C32B393C945D64D78E5751A60E08B3A459935B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683215750, "uuid": "811d48b7-acfb-4890-9f0f-aabbf6424d82", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683215750, "uuid": "d880aca7-7a8f-47be-a0e8-79b735f5b183", "value": "24576:XyazzDvgvFZH/H0PG96rx/MyFOfLKocF0Ee1zdllBsrzunR/5vp6dhcLZ:iaPDvWjf8VbEfhEe1z/3Qzk/5vpwcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683215750, "uuid": "d4ac098b-27b3-42af-ad68-d59db68d92ad", "value": 1620480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683215750, "uuid": "3177ac66-b341-4ae0-bea0-50f0a1ad28fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683215750, "uuid": "b8f57462-f0d9-41ad-9fb4-87aebaaf95c2", "value": "2e942f6cc58995657cc8c46e7a26e106.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577d66df-ea6a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1683197797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197797, "uuid": "d38329b4-3f8d-4a71-9435-990589f53b12", "comment": "Malware payload (CoinMiner)", "value": "fe0447a7d3da51ecc9bca3a1fae3f57b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197797, "uuid": "f86f1dff-7584-4fc5-aed7-083fcc2a7848", "comment": "Malware payload (CoinMiner)", "value": "ae6bd7a2bfc9056b62e8ed38a36db8d67c72821b6d3e86bfa1153ff5d7498b0e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197797, "uuid": "22e77057-35b3-4826-a0e3-0c23d60de87e", "comment": "Malware payload (CoinMiner)", "value": "2f59f1be792d9522ca337f45bda87f6a89758d1a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197797, "uuid": "701376c0-6b7e-49cd-b82a-7f3304a77445", "comment": "Malware payload (CoinMiner)", "value": "e0fde3981016e7e49077f52d683e1b9a8cf3f3d2a2636bca5b241f53a5234918512a73c4a863df8088f199fc3bec9572", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197797, "uuid": "b07be76a-ffeb-4d97-85e3-dea9f8961466", "value": "T11D640B0352E13C98F6264B739E2EC6EC775DF2918F19776A22189E1F04B12B2C273B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197797, "uuid": "c915e988-59f8-42a8-9435-fd4571ad812d", "value": "0133aea8f8bab386500d52ab90bb0567", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197797, "uuid": "e089e5a1-7263-4e0e-8f8a-e886a829e33a", "value": "3072:ODMOZg29W5FRk75YqJbSNgktBN+CqYO5RirZh5Rn4UmxXAV9x/ht:QMOtu3kyqJ2tvqz4D4ZxXAjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683197797, "uuid": "546772f4-fec9-45dd-8481-0df5ab59e9b8", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683197797, "uuid": "1449f883-6594-440d-85b9-1f1840086316", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197797, "uuid": "71aefa8c-0fb9-46bd-a74e-6463541abaf3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebbc4660-eac8-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1683238418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683238418, "uuid": "3df8af41-fb36-4d0a-ae9e-ab3633d9587d", "comment": "Malware payload (Cobalt Strike)", "value": "f912c3d10ebfbec136c427758828a820", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683238418, "uuid": "5541b850-17df-4d18-987a-0c8e7c78fe21", "comment": "Malware payload (Cobalt Strike)", "value": "b0119ddb0e07fb00860377ccdef2b7c49509e58118454961675eac0cef3757b4", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683238418, "uuid": "dacbab00-5718-40c8-84ba-ff1ff587d2fd", "comment": "Malware payload (Cobalt Strike)", "value": "e5a440434ff0f98c24c9b4bee6b5277153cf7fd1", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683238418, "uuid": "6b455d86-7a33-4603-87b3-30e8800552cd", "comment": "Malware payload (Cobalt Strike)", "value": "6ee6322a37e3fd7e085ec68670efa9d63f841bf2b237f3c9c2fb71d1251469f77e8bd1dd73f63cb46dcebd9a30b73052", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683238418, "uuid": "e0fcb07c-e176-4a0f-803f-a5b14527aa52", "value": "T1E88529D7575C0BEDA6A88CEE410C365764F3C57B3C6E1399A9D24903B03FE14BA26A70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683238418, "uuid": "03fd9a78-f23d-4e68-a2e1-b35436185333", "value": "6144:hIeiDsBIeiDsiIeiDsQRIeiDsQcIeiDsQp:QVIolR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683238418, "uuid": "3ad57683-999e-443c-b5d1-4aedb02c8935", "value": 1759953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683238418, "uuid": "83dc05fe-9bbd-482a-a09a-e8e9f695e758", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683238418, "uuid": "ccd5618d-453f-4e8a-a215-663f8cde4b32", "value": "b0119ddb0e07fb00860377ccdef2b7c49509e58118454961675eac0cef3757b4.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ac0cbd-ea53-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683187996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187996, "uuid": "5dca333f-1e68-48ce-b26b-09373ed23866", "comment": "Malware payload (Mirai)", "value": "484f136b49106e2d6193376d9fc7e28d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187996, "uuid": "5be0df6c-1903-4e2e-9d95-0f33cb84a668", "comment": "Malware payload (Mirai)", "value": "b0591637d6e5e3db0a7be07e85da1934292a08cbf3b5bc0c39c7c8d963f12748", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187996, "uuid": "7d1cad65-a6c6-4670-a977-5d329607a62c", "comment": "Malware payload (Mirai)", "value": "46816249512ebab0ad4ab95a3f94c70a7d303e72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187996, "uuid": "f3e1e419-26cc-432b-ae34-4bdec312cbc3", "comment": "Malware payload (Mirai)", "value": "56557e2a951ff02b2f9b3b584f303bad522f39c55e62d2e3ebf3cbe351c5da8eaf203d44db1ef49ab0968730e7fd7490", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187996, "uuid": "4a972b9d-d22f-4505-9ec1-4701f8db15ba", "value": "T19D633A96F801ED7EFC0BD37B40470909B570E3E556A20B3767A7BDA3EC721A56816E80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187996, "uuid": "62fbcc6a-3b6a-4e65-868c-d5d042bbc316", "value": "1536:KT4NoalpNBsAyTV8T+0J+ec5x4BTn7KlbQQReTBnHmW:KT4Noalp7xyTf4c5GxxQReTBnHmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187996, "uuid": "9fd79add-2f54-4d91-bccb-b867ca530be8", "value": 71784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187996, "uuid": "5f41c7f3-6024-4ea2-885d-da3a01664a77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187996, "uuid": "93864dff-317b-4515-b084-22bf90a0cea0", "value": "484f136b49106e2d6193376d9fc7e28d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47595b3-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683194168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194168, "uuid": "367f6b1a-58ba-47f1-a04a-51c91df084b9", "comment": "Malware payload", "value": "9605280a88806dada7ca9dd06fe87c11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194168, "uuid": "56017655-cd56-4bb3-94fe-1c0834da1df1", "comment": "Malware payload", "value": "b0736992f25b7f6abbefa8fbfb6df9525851f957d084f6ddfe61aca9dd2176f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194168, "uuid": "dd6b9633-aed7-40f3-8bae-504df11a07af", "comment": "Malware payload", "value": "26bd6e75fdfae4b1cab49ca48678e59b332d3bf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194168, "uuid": "6e12020b-779b-403b-81d5-c16baaff62b2", "comment": "Malware payload", "value": "f25933caa3ff887a99d4cf6e6d31a8e3b789cf2eb1b70d861a418d922187af9229610d8ea0a1433ca6d7d96c62ec78fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194168, "uuid": "327fc407-ac73-481c-8c6c-279da301b497", "value": "T1BE92B67337A182F5E5D6E2B403E2017576BBA1F1323ED90EE8B227155DE0920FE1CA09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194168, "uuid": "223933a0-692e-481a-81b9-19e3d9b976c0", "value": "96:Yw4x3yEY/PHUvE5Pb5YfDdftODhVits1:G+HUvE5Pb54WF4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194168, "uuid": "69969c61-58b4-43b8-89f9-668661467be8", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194168, "uuid": "7d5027d0-7c32-42cf-a6c4-4efd1c472894", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194168, "uuid": "a5c671af-8b35-4d1b-93e0-189826688004", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.18467.17971", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27bec5f9-eaa4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683222628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683222628, "uuid": "ff5df55d-fca6-40b9-aee6-d4c6aabc016a", "comment": "Malware payload (RedLineStealer)", "value": "ebf231aaec4d4530f47fdd999b239532", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683222628, "uuid": "7233ac53-0885-4e6c-8770-621bf8525808", "comment": "Malware payload (RedLineStealer)", "value": "b0be8abf0c683a479561353d2b66630926a036d9cbe714bf528073b552e79359", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683222628, "uuid": "1eac77ac-bf25-4d6f-9601-bfe49c1e051d", "comment": "Malware payload (RedLineStealer)", "value": "a52f94ef519ecdca22b298914cde31af6c4f2aa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683222628, "uuid": "9ae5e8c1-d817-4cba-abb4-a9ffb3b88b88", "comment": "Malware payload (RedLineStealer)", "value": "cf729e618c6878332056fb770736b5338970cbf7751a9b29c3756e4518648bd03190a03438e62b7e200e60a1eb0e7330", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683222628, "uuid": "8356c4cb-c133-4cf7-9e53-f9d85966262f", "value": "T132752393FAEC4896DAF157B488B707871B387CC68A71029BA390D60A1C7335159B277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683222628, "uuid": "51e08f0e-4932-4561-bbc1-c179c5366c8e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683222628, "uuid": "87ec21ab-a7b3-4941-85eb-715f0f7fd16d", "value": "24576:oyeeWhqSfvGweK+zlVCrDuMO2/1use4YDVAs+WreYbZPVJ4JLb525F:veeWMWuweK+hS5n1uDaLMzZPVJ+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683222628, "uuid": "3f1f4123-2bdb-4109-be2a-6bd99bdb9749", "value": 1620992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683222628, "uuid": "e6632b87-b8b4-407b-9a6d-055a6ccf546b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683222628, "uuid": "1444b4ed-b99a-400e-bb78-4ac10eb7811c", "value": "ebf231aaec4d4530f47fdd999b239532.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8355fb52-ea49-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683183697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183697, "uuid": "ec661c3a-633e-49cd-88de-03ea06bcb715", "comment": "Malware payload (AgentTesla)", "value": "6a401c99a6197e09374e3c902c45624c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183697, "uuid": "073361a6-e1ef-47dc-96ea-a853bf3ba4b1", "comment": "Malware payload (AgentTesla)", "value": "b0d0cece64fdca1ef7ea77f3ada5bb2bc9c3e20a3e171cd824e1a35eb8a5b02e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183697, "uuid": "583520fe-d27c-4c33-95b4-8c584050480e", "comment": "Malware payload (AgentTesla)", "value": "bb3cfc935c1b006060c3e395db7d12461c8fe040", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183697, "uuid": "2ce2b564-427a-4c92-83fb-ddb85f907b37", "comment": "Malware payload (AgentTesla)", "value": "865f8bc62a6412a65c1b3bde47f9b75c66637aef2f01a0b7775875c07ee1bd45a16e8edbbed624d6687f0de491886919", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183697, "uuid": "b14d8d00-495a-4188-88ef-def5a2bafd1d", "value": "T1DF34F143B65754E1CA854B37E287C0160371E784BA93C68A794E136A4E437CFEF1A38B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183697, "uuid": "14d36d28-41ee-47d9-8938-29089a6d89a1", "value": "6144:nYv3OM2fecdgq+H5s/rM+jF3UbnxMfj0lsCPGF6n4:nY/Ud9K5wrM+jF3UbxqXCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683183697, "uuid": "0b62cfa2-7578-49c4-a454-1e4006dfeb3f", "value": 240712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683183697, "uuid": "ad571ff9-4311-40fa-8307-f90056a5eeed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183697, "uuid": "5a5bd656-1974-497d-a6c8-060f49f6ebe2", "value": "March-April Outstanding Invoices.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5403775d-ea49-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683183618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183618, "uuid": "52611c92-0b11-4f43-8870-a721137e6dfe", "comment": "Malware payload (RedLineStealer)", "value": "205d030d9cda03a31d9661fd2bb87df8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183618, "uuid": "5c1b0b43-7d1b-49d9-a29d-d3731c27ac89", "comment": "Malware payload (RedLineStealer)", "value": "b17bb19c48124e4d14729066d316dd3dd24d8bf08098446df5168474cb778e3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183618, "uuid": "0c88576f-afb4-42be-b1c0-5cda67cf45f8", "comment": "Malware payload (RedLineStealer)", "value": "ae12b23d95a2cb27527649bfb9f50453a9a1792e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183618, "uuid": "23d2eccc-3bbc-49e1-823f-1f518cf0788c", "comment": "Malware payload (RedLineStealer)", "value": "4fc652da4917413fd6ca556c45cf51149096ec3a3037c17ef46f1fbf63732095f38b1eef35812ce026e44e6748bb706f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183618, "uuid": "caddadfc-3941-4693-9d93-baa20190bf7e", "value": "T149C4121763EC9033E8B51BB018F703931F3BBCB26938926B26959C8A0DB2495747577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183618, "uuid": "04e8b8f1-dfa6-440d-820b-a9473b0b7019", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183618, "uuid": "61db4eb2-d556-434a-a1ec-31beaa4e94cd", "value": "12288:kMrPy90CsaXJPyE9k+cn/HmT2Lf42K5hfLDaClKcnjxp549:ryj9XcGT2UfLDaa549", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683183618, "uuid": "89eb1667-51a4-471e-8d6a-30afc9937cc4", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683183618, "uuid": "e16a3bcd-fd2d-4e99-a67a-276b0f6e1366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183618, "uuid": "d088e182-ee83-4e18-8702-cef894580948", "value": "205d030d9cda03a31d9661fd2bb87df8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dec7068-ea57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683189513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189513, "uuid": "5520f747-9298-40d0-964e-b083ef222a39", "comment": "Malware payload (Mirai)", "value": "b0d721f2fd19eb5935834d600916ebb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189513, "uuid": "114db4bb-22bd-4297-89b3-45040eda3efc", "comment": "Malware payload (Mirai)", "value": "b1990e767b553aade2cd4f1203d21fb2662a5749555a5ecf7ed3f80d2287ff48", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189513, "uuid": "10350cd2-bf84-4e0e-a948-36397b87a0d9", "comment": "Malware payload (Mirai)", "value": "18ed84532be64eaeb82e5bbd59221c1712c1271e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189513, "uuid": "08a01837-78b4-4757-a953-4efa577df80b", "comment": "Malware payload (Mirai)", "value": "0702265b1b5aadec752bb8d55a61ff3c67a9b9efd6fba7d9032b4b91f89d5a34822bac0ce5782d6903b1b3ba531e7646", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189513, "uuid": "df011bfd-2232-4cba-b26c-c32220f80b15", "value": "T168C35E86BF903FFFD81ECD3241A4DB0A129C590A2395BF7A1B78D408B65B11A59D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189513, "uuid": "827d9681-5804-4e2a-aec4-9908b7d7c89f", "value": "1536:mpdzaAiDymlxUddoWAbDrHQWTee8QDncElcw0rQ:mpdzeGMatVWv1Dlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683189513, "uuid": "4743093a-5f66-4a1f-a58c-05afeb12184a", "value": 128580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683189513, "uuid": "2d153ed1-fdaf-441b-a473-05f73c2dd789", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189513, "uuid": "1f37104a-e552-4215-8c4f-ce9411867420", "value": "b0d721f2fd19eb5935834d600916ebb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a524f1-ea4c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683185119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683185119, "uuid": "6581e4e1-2ddf-47b3-863b-84ee3fceb27b", "comment": "Malware payload (RedLineStealer)", "value": "d0dc22a254da3bd765a26bfd06cbeba5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683185119, "uuid": "c8fa7d51-5c7c-43c6-85f2-21f8dac6864d", "comment": "Malware payload (RedLineStealer)", "value": "b1a75fc70d1fcfbeebb84ebedbaf6d934db49e4b9cc6d8e0f242681de028700c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683185119, "uuid": "4818f7be-93ad-4fa3-b4dd-96f0b844a6e4", "comment": "Malware payload (RedLineStealer)", "value": "15ca5b839923eff704e7e92f27f12ef24bbc54b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683185119, "uuid": "0f3fed4a-c74c-45b2-a0d7-a5f2f77a84b2", "comment": "Malware payload (RedLineStealer)", "value": "9d31ca4a1dc8126624b54b0dba930ccaa457d320aed10b727013a963236f6f70c06a88a83c14f695a82d5465490df1ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683185119, "uuid": "95b879d5-5c89-4619-979b-5274b5e98015", "value": "T15DD41286B6E84877DDB527B06CF627830E327DA15A3897672645AD4B1CF3784A43033B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683185119, "uuid": "f064a956-54fa-4d29-bd39-22f1fdac798f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683185119, "uuid": "b46d5a9d-282a-4182-b6ee-eca0905b475a", "value": "12288:pMr/y90rgNRRoE3JO17WcXp9ZMH/P8kIYsdmSm:uyH967ReH/VI5dU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683185119, "uuid": "045be97a-f003-4ace-acc0-d5b6f15e9152", "value": 601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683185119, "uuid": "3668ec99-dd13-42e9-a7c9-635a2a967301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683185119, "uuid": "933012f7-95f3-4700-aae5-620b19ecd3ca", "value": "d0dc22a254da3bd765a26bfd06cbeba5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b6af07-ea58-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683190224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190224, "uuid": "7e5ed0c0-9960-416e-a3a3-2e83a8201286", "comment": "Malware payload (AgentTesla)", "value": "4c926d3c4b35b5b7646261fbcef59ccb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190224, "uuid": "c681ef60-c997-482f-8fed-604e281b592a", "comment": "Malware payload (AgentTesla)", "value": "b29b0b98f8b09103b37e18e283e9c7b341848a4b136c6d2816260f2cecff512a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190224, "uuid": "d98c73a2-4378-4c1f-a60b-4331e48c7b83", "comment": "Malware payload (AgentTesla)", "value": "97e5f727d3c53635f83a34e321c8f6d12063bac9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190224, "uuid": "dda07f7a-5e73-4ca6-b9bf-d635de9d7daa", "comment": "Malware payload (AgentTesla)", "value": "2e3336ad523a700e262e2f2d0afcb6555200e9bd62052356dd7f6af37a0ed8859ffcfafe69ffe85c7c94880a55d0e409", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190224, "uuid": "aa02ac86-b551-4b3d-97e8-0833f4631ac1", "value": "T1D9442340202E16D3AE7B8871B27C0CBA983DABF22B1F7EA54D334D025FD3E25145645B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190224, "uuid": "fae783d6-9de4-40b4-a0d0-e512cf939de4", "value": "6144:L6cyiiXtaYNqDFOaoZv5hr1g8wpDNj/OD8v52Rpk24B2k:LBid6QaoN1gBNb28sbDE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683190224, "uuid": "d4446796-8d6f-47e0-b49c-f19eece7ad5d", "value": 264498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683190224, "uuid": "a1b2371c-1b78-4b6c-913c-197aea70cf13", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190224, "uuid": "16d60338-0dc8-48c6-b88b-74982801ac71", "value": "46200150.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e29b174-ea76-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683202828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202828, "uuid": "40013b34-05e7-4cb4-a373-6fa6262afb1f", "comment": "Malware payload", "value": "9c0468fc91e3ac252bef4d8701b285a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202828, "uuid": "ec95755c-ec22-45db-a6e2-90c2ee17a2bb", "comment": "Malware payload", "value": "b35f1eeb0a916543616a6d12f03186b75e2a28b507af76e06b78cf536c6e1546", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202828, "uuid": "6300c1e3-49fd-4bcc-9d92-d5c5f006b636", "comment": "Malware payload", "value": "178214057dd7aabd185d8de9b31a636c3ef46626", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202828, "uuid": "d791403d-8504-499d-bfe5-ce69f463a9c0", "comment": "Malware payload", "value": "c6424e4b796ec4d332a5ab6f498193a9c760f4fec96239cd28a0393defdbc83c70bf84b5054f71945708fc8d54ee0b1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202828, "uuid": "22a5a824-414e-4360-90ff-c1bb59260263", "value": "T1F9343A7D318BD546EF65C8B0FAD4BBEC8BB794A68B3BE5E10D99C0207813062DD0549B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202828, "uuid": "1f44af95-2ee1-4f6f-8ecd-96cb49425eb3", "value": "071307373db47402e881a4d65e0a19ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202828, "uuid": "b2965436-c876-40e9-babf-5ac07811cda1", "value": "3072:go9aky7e4TPKRCIajfg4ZO2xEQ3eq3BWIN4425z2Vc3vSWejjMX9rOMGJjIpORKV:GD4yLFIvxcuSMGFKRc3ygUiVnTpRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683202828, "uuid": "8314b22d-6c77-416c-bad8-834d35505330", "value": 242528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683202828, "uuid": "312cf003-f8ec-4801-9c2c-e315ed5721f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202828, "uuid": "251ce0dd-4e84-4396-b6e0-f22afa9dbdeb", "value": "b35f1eeb0a916543616a6d12f03186b75e2a28b507af76e06b78cf536c6e1546", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ff3872-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683194164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194164, "uuid": "57b716c8-03a5-49c7-abf4-7eac7a05441d", "comment": "Malware payload", "value": "4b9b7a4562adddf383216eb8efb77f1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194164, "uuid": "c37497fe-8773-48d7-8952-bb304dfacc6b", "comment": "Malware payload", "value": "b3664d564046868cecdd4baea9870c923b34757cfe124683ebcfee975efec12b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194164, "uuid": "029c95d6-f50e-4208-b5b4-344a2a92d059", "comment": "Malware payload", "value": "81fae52de9888dd109c8cda98125ed276ec06ad3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194164, "uuid": "d1edcc76-dd0f-4630-9a6a-62a44da2f253", "comment": "Malware payload", "value": "9e94071314f4aac3c8c60ef1a4b5eefcc723a0e82d8c4f37a9e091a68043bdf1b205bcad62811704d18660c945232155", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194164, "uuid": "5ebd5b70-e0ec-486f-8684-7cc64aa19f40", "value": "T1D0C13946A190FC2DC25A0A306CEB1A345B26AB2301090B7A3B7C7C57DF797C79C4B872", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194164, "uuid": "20a184a7-254c-4282-a8b7-e5f5654d00aa", "value": "96:qM6zs3k6m90umHT4TS/jGlZGSzXb8d2jaYC8MZKNV1aTap:q5aP0+/jEGSzXb421uZK8ap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194164, "uuid": "c04d4a14-fd85-4b88-bc5b-a595f68b3117", "value": 5616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194164, "uuid": "f42a4173-7c3b-4257-b65a-b1c6a5b30c73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194164, "uuid": "d58aedf1-2ed6-4502-9f3b-30785afd4d42", "value": "SecuriteInfo.com.Trojan.Click3.27093.15571.4092", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa4bbab-ea3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683178099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683178099, "uuid": "0ca67369-23dd-481f-9539-073c05db929a", "comment": "Malware payload (Amadey)", "value": "051f554aa9778338cb9cc5bce90667d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683178099, "uuid": "771f7ec0-6f0b-491f-b93a-625cc4479d17", "comment": "Malware payload (Amadey)", "value": "b3b364a53f6c1bd4555f7f3796ec1de06fc0f5398d99c51d606b92a06447a2d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683178099, "uuid": "6c346f55-25f0-4b06-ab42-89ecae826852", "comment": "Malware payload (Amadey)", "value": "1a0d369f9fdbe191c87492ba84e25c554bcce5c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683178099, "uuid": "1c7f76c1-e939-40ef-8ee3-5e2bbff2c811", "comment": "Malware payload (Amadey)", "value": "3de479e735b3dc3aaaaf050a3a304051c1244bb13d85447f9e5f947ed9658a718b2c129bdfe6443fbada597758d2256e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683178099, "uuid": "6c09b2ca-fa06-40cd-b797-83117e736e13", "value": "T18B65234AB5E46131DCA25BB0D9FE12D31B3ABCE08C34578637821D9B19B239455723BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683178099, "uuid": "78bda248-e9b1-47e7-ab44-94c8c4d69828", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683178099, "uuid": "5de414b3-62cc-46bb-8ded-5630194c7287", "value": "24576:KyV3cfXG8UeUxzyHZL2kMWhFoqYWfjaVa+S8wQnWGUC6mh8GMKhbf6cpPd0D9ukJ:R228UeU0Foora4dQnWGUC6mhPTGcZSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683178099, "uuid": "34f4ecb0-c371-46be-9f8c-91479208158c", "value": 1548288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683178099, "uuid": "11ecef20-eea3-4936-8153-3b0268f34670", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683178099, "uuid": "9f24c910-cb79-478e-a1c8-890b7cfed8da", "value": "051f554aa9778338cb9cc5bce90667d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920d70ff-ea9e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1683220229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683220229, "uuid": "1a884a6c-32f3-4c17-8ac2-50aaddbdc337", "comment": "Malware payload (NanoCore)", "value": "b3ac1d448ec0c1a677e30b26a02cf525", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683220229, "uuid": "2d2ec775-d405-40ae-b512-b1dc13b26896", "comment": "Malware payload (NanoCore)", "value": "b56fcfe2487e1acd67163ca50b4d05d793557d927971675a09f1a5bcfa8464cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683220229, "uuid": "a86293bc-d8de-4d52-b470-8db2540883ae", "comment": "Malware payload (NanoCore)", "value": "7ac37e6d210fd713a350fbc5920d523404397b86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683220229, "uuid": "a8a6577b-99da-4907-b650-5c44f3b9c57c", "comment": "Malware payload (NanoCore)", "value": "cfcfef4fac123ec73c6a8922f9a5bee63addb6949f180d248e81e85264deafa263e34827ed0fc6483908a8182ff39676", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683220229, "uuid": "0aff4c9b-137d-460e-b9cf-58c9113fe41e", "value": "T1E025EC38ED0B21B7EBAAD334E4BA190AA5F414BB33349D5EC592774D090760374DA3AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683220229, "uuid": "4e1e5d31-d763-4aba-b8f5-dedb08b67a04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683220229, "uuid": "91816df4-aeb2-4088-a0b9-8bcc4ac7bb6d", "value": "12288:DtE1YG6m3qToJq0Kw2Yh3ZCZV4upfn98ZQ/O1NL4I3VTK0bOT0NRHl:DtE1xOk4vw2m5o/98S/OfDFOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683220229, "uuid": "af8de854-8b95-4b09-b290-2ed1a10b7c9e", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683220229, "uuid": "17bd2a9b-1fb1-4a74-9f2a-d556050d05cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683220229, "uuid": "73338025-c132-448c-b004-cb74f502cac1", "value": "b3ac1d448ec0c1a677e30b26a02cf525.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "129efc4f-ea57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683189521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189521, "uuid": "a1ca35d4-86d2-499a-a58b-ceeb48ec6fd5", "comment": "Malware payload (Mirai)", "value": "556ef54d58f7663f804792cd6311ae41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189521, "uuid": "4f9c26e6-6515-4348-8748-a84a3e3f96ba", "comment": "Malware payload (Mirai)", "value": "b5ec01ceacba81f032cd76feb9dd4361d58d295ec7d362949246e15f09e06ee9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189521, "uuid": "b2217c79-4e07-4106-88c9-b7ca21b2afbe", "comment": "Malware payload (Mirai)", "value": "4a8ef58c2d22bee5be5d4e34b6e49cfddbfe3cd7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189521, "uuid": "47770f7f-9800-44f3-b503-74afe9f44df2", "comment": "Malware payload (Mirai)", "value": "067237557e9e5460727ed3e00724e33614360717a3dfcbd734723d5dfcda49b6b5c6af473251c2c9d0669834e0607882", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189521, "uuid": "e62b7343-789e-41c9-b0fe-cdf471c0895d", "value": "T158735B24E9792E27C1D4A17A62FBC321F1E6220E25B4865D7C760F8FFF2465068172B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189521, "uuid": "56caf17f-98fd-4fc5-b8d4-ec4cbc5897fc", "value": "1536:RVFbZFcEvS/d7erkTS61Du+gc2i8R9QjLX56vNYCCAfQFx9:t/Jqxr1Du+gcz8YbovNqAfE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683189521, "uuid": "d5ee9150-f594-4094-a2eb-8b296c77c96f", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683189521, "uuid": "012699d7-1ac2-4a4d-abd7-6e619beaf9d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189521, "uuid": "3b5690c8-ad9d-447f-8e62-a22504b80c35", "value": "556ef54d58f7663f804792cd6311ae41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7805e46-ea46-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683182469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683182469, "uuid": "d1e31433-7e3c-4a5f-ad39-afe2566e17c5", "comment": "Malware payload (Mirai)", "value": "383648764f191c3c379aba4232bc2d39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683182469, "uuid": "481131be-35e8-4d38-9580-07ccad6711b3", "comment": "Malware payload (Mirai)", "value": "b631d7d94c92134d483811280bc2191469f30f88206abf727e3b4a8a71fbf021", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683182469, "uuid": "9dd36c33-1045-4658-a9a9-706d7471d8dc", "comment": "Malware payload (Mirai)", "value": "6fad07a58338406cbaa37ed2e289ed9cebcb4815", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683182469, "uuid": "be1ddb71-8d3c-49ed-8e93-1a57403c38ac", "comment": "Malware payload (Mirai)", "value": "1e3d97f06f79aaee9be479b458e1c1dfe84968dbc16e2ce7a62890f3e11d0dcb2eabae905d2b9b99328c69fdba41166f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683182469, "uuid": "b25578ca-8e1f-4147-862f-137b711cb399", "value": "T10CD34B1BB491C8F6C44285B126DB72509913FEBB0AA63147B3D47C646F398CA1E7AFC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683182469, "uuid": "2a94f3a8-0fcc-4f9a-872e-9e3e3e3dbe72", "value": "3072:E1g1IqW9Vf6CuV1D7eTtBC0lSutJ8a+PQ4KQOjsPkBBBBBBBBBBBBBBBB28GgeGh:e/fpi7IiPutJ8a+PQ464IGgeGrmcEO35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683182469, "uuid": "06df92bf-508a-4173-ba0f-3721066e1fb5", "value": 137557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683182469, "uuid": "c57eb76c-1d14-496f-8134-d4bbf15fc3a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683182469, "uuid": "813a2dcf-d501-47ec-b5f6-914bb91f33e6", "value": "Demon.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a37210c-eac3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683236134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683236134, "uuid": "5424abed-df0f-485f-833c-ac2189de4784", "comment": "Malware payload (Amadey)", "value": "b97d2b06d970e5f849554e1a2c947a2b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683236134, "uuid": "70dfccd2-036a-48f6-9c99-731fc5c8b959", "comment": "Malware payload (Amadey)", "value": "b732fed24079dc0f9aeb72c8f5984fbd84d13b49d78b0d87acf38bbff5df9266", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683236134, "uuid": "56445d4c-4379-4818-90eb-f653b3fafb9e", "comment": "Malware payload (Amadey)", "value": "dc9640d133eb0b8654748566c46660270c4905b2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683236134, "uuid": "911ca527-8f6f-4419-a985-6638b4c92dbb", "comment": "Malware payload (Amadey)", "value": "7f30d73daa7d093e6b309dc53b5961675e3fa919cb9cbe44fdaf9df5c90ed0861c3f4ba502921e5faf4706d5bfc9289c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683236134, "uuid": "c15e0cf1-408d-4ce0-bc17-5dc9f3496c32", "value": "T1C584F143FAE98433D875177028F617C30B3ABDB19978A35B2745AD4A2CB36C0A57172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683236134, "uuid": "290d15fe-fbcf-4560-8156-7b2699dce659", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683236134, "uuid": "6c6b9671-7a84-4c6c-887b-383f97ba031d", "value": "6144:K4y+bnr+Yp0yN90QEiCmpK7vQY/K77+F7DYOkwT/BOegGyuby:0MrAy90MKnC77+F4Ok2/BSGZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683236134, "uuid": "2b3b8063-39cc-4d49-8571-607cc56e2838", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683236134, "uuid": "044db16e-4477-4220-9d05-06db14c478ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683236134, "uuid": "98015951-10cc-4d9d-96bf-dbf9487156e4", "value": "b97d2b06d970e5f849554e1a2c947a2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d05062a3-ea51-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683187262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187262, "uuid": "6c8f8775-6946-4714-b911-5ea797c89649", "comment": "Malware payload (Gafgyt)", "value": "f29fcd83b3bce68b0f96d4afd5269edc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187262, "uuid": "6d1c526f-857d-48bb-8807-33ec16ea0804", "comment": "Malware payload (Gafgyt)", "value": "b8f5f280874b3e5f7af5384860e1764534bcaedbf412b243c141301d1973cb4e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187262, "uuid": "7763ed7a-6ade-4889-bc0b-d6f0d17e654d", "comment": "Malware payload (Gafgyt)", "value": "7ced186bfb9bd03a878896b0f2be46ee42bea9c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187262, "uuid": "51c396d4-1928-4193-b6f7-73466f98dfa8", "comment": "Malware payload (Gafgyt)", "value": "102bd358b2f9f9620e8ddf5346e04cabd062cb5b0d4ef62aa7bf335cef1dd499154b66bd47a7f4261fceac17acc3ec8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187262, "uuid": "8095bb31-b08a-4c72-9d22-5b014e3281b6", "value": "T1854301106F897AE7BBB22532FD5C49913A2F0BA9D17FE191A22003685464509BCF5FCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187262, "uuid": "5c56fbcf-14eb-438d-a938-c50a2c2ec359", "value": "1536:EuGcSJR2DmFtT5O4cFFgpk/9AAzL2tfBr5QE6bMv:EDhJR2Di4PkpkvzLwdQE68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187262, "uuid": "922806a3-c90f-474c-bcc0-c5bdd0ea2864", "value": 59128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187262, "uuid": "a3e7f8ad-1dbf-439a-b12f-d84bf0307a47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187262, "uuid": "40e09784-11f8-48b3-bd70-83a75e2fd9fb", "value": "f29fcd83b3bce68b0f96d4afd5269edc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e352cc02-ead0-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683241840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683241840, "uuid": "469217c8-8708-4f94-bb07-b77182592572", "comment": "Malware payload (RedLineStealer)", "value": "caa3e79675255bed70f58342d5623b1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683241840, "uuid": "75947098-a92b-4e2e-9dcc-8c44e8b25808", "comment": "Malware payload (RedLineStealer)", "value": "b992dae689fb952b7d50d5e7ac5df5e1a54b58889815227fb7113caf880f0f68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683241840, "uuid": "43618e76-08fe-4167-a740-3d14fcc56f5b", "comment": "Malware payload (RedLineStealer)", "value": "3d01f09ea818adab4d24f57fe7fa8a0a1ea1a1fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683241840, "uuid": "0a9a933d-a6ae-4088-a290-daf876ae99c8", "comment": "Malware payload (RedLineStealer)", "value": "dcc8abc1bc6f8f913cbf4850517087e8752da7a8bd6d06d8921d8512ac11eef75f73566248c76c8c13d7497b27218ded", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683241840, "uuid": "5f9c069c-d064-4abb-a12d-58913b0c3596", "value": "T132840142E7D88572D9B517B10DFA02D31B36BCB19D78876B2749AC5A1CB32C0E93136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683241840, "uuid": "899140f9-2185-4fef-95c2-3cfd008a3ce5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683241840, "uuid": "64e20f56-cdbf-469e-9d91-733a31ce8c23", "value": "6144:KHy+bnr+2p0yN90QEededGTlIPpdcwOe8G3oATVveT7Nsa6nY:lMriy90sd+Gmfc/+TVveTIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683241840, "uuid": "f99f7117-5740-479f-825b-4b13b3d354a9", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683241840, "uuid": "8efc74b0-6384-465b-a41d-137b3005bcaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683241840, "uuid": "35fecc82-4a4a-4212-afa9-1c5553ee2b2d", "value": "caa3e79675255bed70f58342d5623b1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7cb439-ea69-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683197481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197481, "uuid": "86594044-2797-4b91-829d-5a4d74891666", "comment": "Malware payload (RedLineStealer)", "value": "c582b416b25b2ba867b8fe5eb6689840", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197481, "uuid": "3c1aeac5-1037-4cbe-b608-df0e281bed71", "comment": "Malware payload (RedLineStealer)", "value": "bac75b214eb22276795f6f379db9958bdb6ff386f231da4984c875ceea732dca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197481, "uuid": "6dd98f25-7243-415a-8b43-066ad0f33508", "comment": "Malware payload (RedLineStealer)", "value": "143aac36254bffac0f237c8361c82a119f598ddb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197481, "uuid": "99314e62-97f7-47de-8f4a-2567d54536f5", "comment": "Malware payload (RedLineStealer)", "value": "e7ff987d6f9f3cea9a5f420599e9f9dd70464587a830b2b4c982da9f86709732e521320e348f4c8a2f144257ac6381c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197481, "uuid": "8d4d409d-59f6-4323-94ca-ede9723d0878", "value": "T1F1A45D1352E27D98F6268B729E1EC6ECB70EF3508F1A376A22195E1F01B11B2C173B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197481, "uuid": "805191e4-ee40-47d8-8ee6-1be71f1ec59b", "value": "0133aea8f8bab386500d52ab90bb0567", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197481, "uuid": "699e2d20-c154-4f35-9e92-7b9af1b79c99", "value": "6144:Al85sQnL5iVkD+LAZ5RwKGZsTo1F3zcbwVLt:IusQnL5iyDnts1FkwL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683197481, "uuid": "fcc2192d-c4c5-4d30-8540-a2433771d07d", "value": 455168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683197481, "uuid": "88673f31-252d-4c33-b873-b895011f7eb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197481, "uuid": "9bd6de58-9b96-4e2a-bb79-6c3830898bca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1977b0ec-ea79-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683204135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683204135, "uuid": "c0a220e3-7908-4ec3-b3a9-99c78b78df35", "comment": "Malware payload", "value": "454de28853ea54861c14acf6b2520bab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683204135, "uuid": "a50a470d-ca90-46ee-a7de-5ff8a2bc3065", "comment": "Malware payload", "value": "bb5d251130efb47c960fa6b622a603ed4c53e91494f8ebaceefcd65899b02d6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683204135, "uuid": "a97b9686-8fac-4685-98de-a0efcc6964b3", "comment": "Malware payload", "value": "2a6774af921e3e3a03fd22714059cbdc33ac6e53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683204135, "uuid": "5d3a99ab-423f-4261-a680-cece36f13033", "comment": "Malware payload", "value": "3b74e4ca48af057b55dd2c80a4de04e78bfc13e598a4fda5c7cd289c426f7d5e70faffe98e69be7cb488d1976fa1f42c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683204135, "uuid": "490fdf81-b962-4b73-9297-460500070472", "value": "T1E784123527E509BBE9C3C6F0B8F6C632AF7BAF0406148E034BD5AD73791458B4A9E560", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683204135, "uuid": "7e07763a-3098-4e3f-8147-20916591c77f", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683204135, "uuid": "1c40a213-04a8-4ef2-aafa-e5e3c521b430", "value": "6144:L8dNXSEm8t107G59ZLNokDCW4KwNLl4fn6wRPFDdL6qnoz1+vv8UoGfaD2H:gmU107GVWWCNPLl3Muq++HFomaD2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683204135, "uuid": "3feabd42-f26d-4250-a09b-be0cf3381f7d", "value": 397120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683204135, "uuid": "86bc5484-97b9-4918-a8bf-712fcea4b96e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683204135, "uuid": "637fa908-6621-402d-b1f7-281d5f9113c0", "value": "454de28853ea54861c14acf6b2520bab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20078a29-ea68-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683196845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196845, "uuid": "45f48b85-fb39-4d42-b628-06910a023191", "comment": "Malware payload (AsyncRAT)", "value": "ef0ec9b3bf2edc84d23f92a16b6a8a67", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196845, "uuid": "3b0ee378-9b9c-4142-862f-4f21b4c2f0a8", "comment": "Malware payload (AsyncRAT)", "value": "bbcfc7c262a04ae7291c4a1ea80253aaea3968a3c95d2b73b47016c298a7e281", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196845, "uuid": "afa47c31-338f-4ad9-a313-521cf5db8a1a", "comment": "Malware payload (AsyncRAT)", "value": "8e4d871940df560a85332bfacac0b9766f865b9f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196845, "uuid": "fd7a4a24-3e47-4898-a6bb-f9263230b9b9", "comment": "Malware payload (AsyncRAT)", "value": "09c959e54b92c1dbaebb21d316839ea13461293b9fdc2d4e2bd9d1bce1ce82986a5eb50f3b17b95124391f212044ed2c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196845, "uuid": "80f0b08c-691a-4b3d-8d13-68edc3dbfa55", "value": "T11825394BBCA044B9D0A9D23189B651917B31B8991B3227D73F51B2F82FB2BD81F39354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196845, "uuid": "0d6bcc62-9eec-418a-8c4b-f389d52f6a6a", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196845, "uuid": "d2657358-d8cf-42f7-938a-705f58a1d90c", "value": "12288:84mT/RcXtvyJdBQhXVQpPDv4aloZqby13caYgd2DBAm:84C/6XtvWBmQpPTXgcaYgdCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683196845, "uuid": "80e5aaf4-1733-4e15-8cca-462431aede4c", "value": 992768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683196845, "uuid": "a02a5d54-6773-4caa-9ccb-dc650d5e5866", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196845, "uuid": "efaa6ab0-0836-4beb-9415-f9da14e15f27", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a1de01-ea3f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1683179493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683179493, "uuid": "5045b727-72ce-4c36-9b13-2001b2d844fc", "comment": "Malware payload (STRRAT)", "value": "7659d28497dbb7e9f4e1a8727b4f7d3c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683179493, "uuid": "6f3480eb-d179-4ae4-a62f-0934598d1b07", "comment": "Malware payload (STRRAT)", "value": "bc28ae6de5e76fe085ed5b27ddcac05937e6f164d94a323a99e9a1c3bc7378e2", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683179493, "uuid": "9800e437-8dde-45aa-8269-34d8fd31cd40", "comment": "Malware payload (STRRAT)", "value": "4842f76088a330bf212058bd01d381a1e4b32ebb", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683179493, "uuid": "069a4734-0f51-45ac-8ea9-438b3f2f1698", "comment": "Malware payload (STRRAT)", "value": "df67ba7496916a076e775d4d105cfe355fae4dcdfabdddab366f0d11cddc6ddcb64d4fc981c281cb69b29bcc2d4ef67d", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683179493, "uuid": "7fc195f0-d4be-48fe-810c-b6f390b7ba53", "value": "T1AD63F11EEF5142FECE5B6CBE010AA264581385CE249BDE2E8FD1542F589BC88075F786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683179493, "uuid": "6ee11253-5047-4c9e-8e3c-27d833c53a1b", "value": "1536:7GyjeT0FWlKLOiWA7zj9CmFnq+vdmalR+naRgqukJ+dNn:ZJFWiFfoQR+aRgquk4vn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683179493, "uuid": "6d1d7041-6c9f-4811-a8a5-5d07a88a60bc", "value": 72308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683179493, "uuid": "43f965a2-79d4-4b6c-b372-14b5a393f751", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683179493, "uuid": "6aa6f741-a84a-4124-8294-563145368fb5", "value": "Fiyat-Teklifi-Formu.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a33cc20-eaba-11ed-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1683232242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683232242, "uuid": "153c3f0b-2ae1-412c-8db7-7e78d9b4614b", "comment": "Malware payload (njrat)", "value": "b9f3f7cffaca4f7c40d5d15c7cac9e85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683232242, "uuid": "1c7ce631-601e-45ea-ae37-f300140a4d8c", "comment": "Malware payload (njrat)", "value": "bc7624743bcd785325ff2a18b2948c222ebd360f1c5e012170b3e62d7e97bbd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683232242, "uuid": "b409e8c9-e744-46d4-b227-30c4ef811fe5", "comment": "Malware payload (njrat)", "value": "d91ec609370046174af660acbc7f1258f1ac0c9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683232242, "uuid": "583d4142-4312-470f-b794-eda66a917449", "comment": "Malware payload (njrat)", "value": "dcf193b2ab46b7ebfd141750ee1f442ee9e9d2b1b65b2f7e58bb99c346c86d0de6cef4ed4554488dba46f7dd7c31c48e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683232242, "uuid": "969669f3-6e16-4a2b-a258-a638c8b7a761", "value": "T14F031A4D7FE18168C5FD197B05B2D41207BAE00F6E23D91E8EE564EA37636C18F50AE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683232242, "uuid": "dcf4cd9a-2249-48f5-a55f-cc3a5cd1fccc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683232242, "uuid": "ec3a2ff8-daa1-4101-9aa5-4b722bcf9937", "value": "384:U4GBkiyRnDNGRn5IyUvoIdf1hg/SuGwxrAF+rMRTyN/0L+EcoinblneHQM3epzXm:XZ5M5jUvtdAaudxrM+rMRa8NupSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683232242, "uuid": "d8ebd393-6a61-4fb8-908b-3f917b0b1a42", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683232242, "uuid": "0a4baf33-9c99-492f-be73-3e1ff7b83f88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683232242, "uuid": "490cf747-6c0c-4f99-b689-84d3e8db5f49", "value": "b9f3f7cffaca4f7c40d5d15c7cac9e85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c2107e-eac5-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683236739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683236739, "uuid": "0f997398-0b49-46e6-81c3-dd4ecfd8f6ad", "comment": "Malware payload (RedLineStealer)", "value": "940b70b8ce97b576a4fb2891031c264f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683236739, "uuid": "0ac0a3bb-689f-4e66-8b81-87c345fe3ad9", "comment": "Malware payload (RedLineStealer)", "value": "be167023d177ad2e5bf9f4402d2faa7fe6558870cb5f0132b67e34649e5c5e34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683236739, "uuid": "8e9fc6f3-958f-4227-85a0-c850b5d1a6d7", "comment": "Malware payload (RedLineStealer)", "value": "cf986e776634cbfa61b05fa4b41908cd2c99a00c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683236739, "uuid": "0fa5719b-6be3-46f0-9e9c-a3d6de4f0332", "comment": "Malware payload (RedLineStealer)", "value": "4f8f6ba23c7bb2ab01c89a390b8f796899a9cf7d0354ae6f8710419a538b292aeb9586421d365d393c6c6b1526da594d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683236739, "uuid": "a0e55f36-ae0a-4daa-8dc4-204e46821f7d", "value": "T140840252EADD4032EDB5177018FB07C30B3ABC62997487AB2785A96E1C73AD0A431777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683236739, "uuid": "40213c0e-0b70-4203-96a5-04e32193549a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683236739, "uuid": "f6107101-acf2-47c7-bb78-3ac3dd3b0745", "value": "6144:K3y+bnr+gp0yN90QEq8YJFQHybQYbE9d3dWIVpqb3T0B+1tCRepz819fNx:1Mr8y90XgQHyjbs3jqDT0Jd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683236739, "uuid": "1f0e6afd-5bad-473f-85ea-271b97ce1cca", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683236739, "uuid": "fe0c81f3-5a27-4e56-8f43-9990d32caa86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683236739, "uuid": "f0d4add2-7593-4f15-bc1c-3ad896a466d6", "value": "940b70b8ce97b576a4fb2891031c264f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f112595a-ea51-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683187317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187317, "uuid": "67a2e18d-ee81-420f-adcb-461f58c61629", "comment": "Malware payload (Gafgyt)", "value": "4ed7900fa411994a2953ca7cca1b87a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187317, "uuid": "ba36ac0b-cfd0-4470-969e-697979c58813", "comment": "Malware payload (Gafgyt)", "value": "be69748a3ea198b13f4a59da64ffc626e1bc363c80e53882ce711482f73aa5b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187317, "uuid": "1189c230-6e65-4bdf-b337-65189a2211ea", "comment": "Malware payload (Gafgyt)", "value": "d9d22de11fb6cbf3f2f554fd9af048ba341fd252", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187317, "uuid": "d81e3984-2610-4f8a-8779-7e274e7f81b5", "comment": "Malware payload (Gafgyt)", "value": "63f6f9550f64e05553b142a2d151ceb2906e51befcdba7c39da75135e168ed7ce146a5768329643fa9eb15baa74b3f66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187317, "uuid": "4ddda461-14e9-48fe-aee5-19c860d8ca62", "value": "T174A27484F8411B6ACAD1A37FF64C13DE3A3E1364F2DBB3125E205F9137D5AA52936520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187317, "uuid": "f2f408b6-9a0f-4e71-8f78-55c2b76d4b47", "value": "384:9Y17/3/axmlj26ddzq1fDDpW3Um08r5UbzBB8UYoFx4eg:9YB/3/VVPzq1bElTtUL8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187317, "uuid": "bb3e4ae0-a7fe-4947-a0e3-a0f0194ec254", "value": 22548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187317, "uuid": "4773bb2a-b7b9-45e9-aa77-d0584d4fc11b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187317, "uuid": "08c7d555-b969-42a3-af09-b33a2139868b", "value": "4ed7900fa411994a2953ca7cca1b87a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd83b8f-ea43-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683180920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180920, "uuid": "cb2d14ba-ab5a-443d-92b2-9353052e67bb", "comment": "Malware payload (SnakeKeylogger)", "value": "b005a335c5d12794db00dc96955c4e49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180920, "uuid": "dda76123-02cf-4def-aa9b-d08e9c87f8d1", "comment": "Malware payload (SnakeKeylogger)", "value": "bf15bf7ad5e678a40cca28a50fbe8a4f4aa8b86f3480820d8c0178db3107cb15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180920, "uuid": "cdb47365-81cc-4cc5-ab2d-6adad0885ed3", "comment": "Malware payload (SnakeKeylogger)", "value": "370cb2eacb3480b36dfea50b46537451e535e30a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180920, "uuid": "73e10dbe-7b31-4fc1-bc7b-512c024acaa1", "comment": "Malware payload (SnakeKeylogger)", "value": "486f488db57cebccadb11a24d21ce23849ac74fd49ac9e38567c6fdc9726a2a46d8e97bd880f183a940e7bc3539d29f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180920, "uuid": "2b50a176-3ff2-4cc6-add7-2a3fe7e934f9", "value": "T11CF4AD54F3A68412D40BCD731A5CF9B012727C8B7DC1C96466EA3F9BBBBBA44294424F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180920, "uuid": "65e2b1d8-0e79-4f98-ae70-fea1e32c63c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180920, "uuid": "38fcf378-6b32-4e1a-93ff-b96cfa688fb4", "value": "12288:vBvwiX0xPmaJdZBsQdSwxT+PYv7Srr/GtZGCGxqvKuJ7yp0v0RF/f:vZF0xuaJdZ6QdSaT+QvQU1GMv6p40RF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683180920, "uuid": "fac541d5-4835-444b-976e-419a3cd9270c", "value": 762368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683180920, "uuid": "97a048fb-f74e-4dde-9c4d-ac0030f31edb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180920, "uuid": "f8064b37-5e98-404e-bacb-26c0a1d864b1", "value": "General Attachment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d600d2-ea75-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683202539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202539, "uuid": "0e8751c9-eb4c-4c51-b11b-110b94ac4551", "comment": "Malware payload (Amadey)", "value": "16312178a6daa3247bfc00c458bf6499", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202539, "uuid": "170421b3-490c-4162-bda1-f1a265b4f823", "comment": "Malware payload (Amadey)", "value": "bf37e108dfbfc88bb1d750c9318437c9ba16097f3a5a1047b5c70529029b7997", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202539, "uuid": "45d43004-dee9-438a-a2bf-82c21ace665a", "comment": "Malware payload (Amadey)", "value": "dd212de3318df8f39ae886ffb6460b1cb3bf969a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202539, "uuid": "f76420d3-53ae-4824-a7e7-97600fc7ce43", "comment": "Malware payload (Amadey)", "value": "64f22cbe112b029ded410d457315bd69d12a5ac4b270712ba6b07575f4ae90703a2e331577aea538b05c27fea3552a33", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202539, "uuid": "512d2196-ed26-4373-a22a-767069a3a841", "value": "T1BCD41207ABC85472EDB117B069F703871635BCE61E39A63B2746988A1C735C0B17736B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202539, "uuid": "a7d3ed6a-6baa-4707-bad3-979008c789a5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202539, "uuid": "9de59fbf-52d4-4ce1-895a-b22a3408cf18", "value": "12288:fMruy90Dgs/WoX1I3Cpo3Lt+Nw+1vU5GcR3He2np:hyQgs/WgaSm34bTW3+2np", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683202539, "uuid": "63600084-66e5-4aab-b6b3-776767c21866", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683202539, "uuid": "6465decb-8f5d-4337-9f4a-f557e36d2e0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202539, "uuid": "bd589b08-2173-470b-bbf7-9857a9bc28c1", "value": "16312178a6daa3247bfc00c458bf6499.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50892c5a-ea57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683189625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189625, "uuid": "11cef6b4-ccf6-40dd-a9b6-409109cd65a1", "comment": "Malware payload (Formbook)", "value": "7c59c33a20ad1e72ce89545ddff5b8c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189625, "uuid": "73bead4b-1fc8-480c-8ff9-96789de34d1c", "comment": "Malware payload (Formbook)", "value": "bf6a195481cb4cba11f09c03c4fca9be90f011fc883dad09b8b79a4b94e3aafc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189625, "uuid": "8522076e-9e7a-439d-ad39-d778caa8117d", "comment": "Malware payload (Formbook)", "value": "997083103829b5b51af7d0cd70592f74feca0b94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189625, "uuid": "ba0bdc5c-d666-4af1-8c97-72b59f0215c1", "comment": "Malware payload (Formbook)", "value": "67bd288cd32655bad40747f0f4efd4610ad9191a416d3dbce9eca15a49fee1b7946eee130714d5ecb7c157a139c78895", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189625, "uuid": "e4a39a0b-d815-4519-9bcb-26dee9f81c5e", "value": "T17ED4BE3D49BD1633E7B0C6B58BAC8871F06CA42F3291FE2A19DBD19016D3856B9C316D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189625, "uuid": "5fef3258-e337-4507-9b27-bba36993c8e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189625, "uuid": "eb6fe240-d3e7-458e-8e40-1767dc658d71", "value": "12288:1ufRxGFoyX+0GIYM93SGPRv2neMu11zpTXvA38D:+0oyX+XHSZvI01zi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683189625, "uuid": "c7cdc7a7-55e3-4b7f-af27-592ba9210115", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683189625, "uuid": "e6a1b8d2-9c58-4830-a20c-808e2907b65c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189625, "uuid": "4c7eb11f-c493-4591-b288-e46ef0a3dd52", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e389a51f-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683194166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194166, "uuid": "0adbe892-01b6-41a1-9031-f1c31c51ac6a", "comment": "Malware payload", "value": "a44cd4691d3b08dfbb76945c74d7d2c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194166, "uuid": "d897f2fd-2329-4daa-86ea-8317b107cf13", "comment": "Malware payload", "value": "c0206ebece6b41675102354edf7d361ab913d38ec0b6eeb2738fa422336cc153", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194166, "uuid": "34e68ad8-0e21-4e57-8a1c-0b0da4d6dda4", "comment": "Malware payload", "value": "92a2b7ae2a6ef1600ceb1852c2641f4fdfa3313b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194166, "uuid": "2684bf89-feb3-49be-9551-3443087e15c1", "comment": "Malware payload", "value": "29c83caa858345453ccd07fb6c4b56d82594a5ad8602e82a2218cece0ee6d8bbf0d5a0180801b6fb64d460a5c71cc0c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194166, "uuid": "6475cc9c-261b-42af-91f4-834612e9dcf0", "value": "T1C3A2A9CD360E0943C5E7ABB8193B37D1877EEB1630989385654FAF85C372C3A8512E99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194166, "uuid": "8e2327b1-bc36-489c-9114-95a65090bf05", "value": "384:DuuOVQheKH20lkTGHQgiVVf478QiYVg/kLQ:1vx9+QQgKf4QHY7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194166, "uuid": "dbcafdb4-786e-48e7-adca-ad55b7e24ae8", "value": 21748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194166, "uuid": "ee355db5-6b08-409c-b916-fd56c515e77e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194166, "uuid": "49fb0b10-a24c-46c5-b2b3-d7309687ea9b", "value": "SecuriteInfo.com.ELF.Mirai-CDA.16672.15430", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de8eaa23-ea51-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683187286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187286, "uuid": "b18e81c5-65ab-4af9-bb77-60cd3a17dfe7", "comment": "Malware payload (Gafgyt)", "value": "a8a849c2403afbb3f138a59c7e17a88e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187286, "uuid": "18f9997d-454d-48fa-9cc8-7e3e2feb96dd", "comment": "Malware payload (Gafgyt)", "value": "c0f8c97e2f6d836c8aa0d691a0c32a7d836e5d74ce5fbaaafb96aa54ceb6d31a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187286, "uuid": "9a76780b-f752-4e4f-8c36-dbf20eccbf1b", "comment": "Malware payload (Gafgyt)", "value": "8044b783dc5949c48a67123afafbaebb2ef8f158", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187286, "uuid": "342ed90a-3d08-40b3-9054-a5a062554244", "comment": "Malware payload (Gafgyt)", "value": "2ac7bdfa2163bc4193db0498b51707c852dbbe629805622eab798db491e1103fceb73ab0b53515412af7842130edd011", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187286, "uuid": "e9563a07-5b68-4b83-95d5-896e11acec70", "value": "T17A931993F801EFB6F40AA77604D74B25B630FBA64E531622731739A69E322D43827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187286, "uuid": "75eded75-461d-4232-b313-503943400591", "value": "1536:pxtlJH4tm85xhw5e2L6aB2zuFZcb43kGybZxhdpGvHmKQl0cJ6emfEj4:fv94tRx4ey6+cbHGybZxhdpmmbl0cJVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187286, "uuid": "893bc4cd-83fd-4ef7-8391-be14ae9e1834", "value": 97114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187286, "uuid": "5147cb61-c4e7-4bb8-b8d1-618434cc2a46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187286, "uuid": "319ca3c6-38ee-4bd9-a7af-0375f50b75bb", "value": "a8a849c2403afbb3f138a59c7e17a88e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e51d3fef-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683194169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194169, "uuid": "cf65d6a1-ab4d-4d7d-a83c-abd02e28a9f3", "comment": "Malware payload", "value": "cbc7ee25d02d1ce2729da6a7b3fe0819", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194169, "uuid": "5cd5667a-4547-4998-9775-c7cedb5163bc", "comment": "Malware payload", "value": "c10d435c9900de72690b75c011768e531863c09da1d497d2e36947857397e137", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194169, "uuid": "3cce5f00-b1f4-4523-8cca-043e7ef4aff0", "comment": "Malware payload", "value": "88818b140676838fb3a0624bd712ce4d0fc05f27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194169, "uuid": "6cc34b41-e1fd-421b-ada3-a7d5c36a9f32", "comment": "Malware payload", "value": "bfecf38d92474ac2a553a3b21edbc0b044d08561749badeeff91bfad0bdef292a15abc61667367fae0d299a605ba3791", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194169, "uuid": "d7dc6c59-9c00-4f37-8a8a-5ed0e4530647", "value": "T15B447D22F3C24936D1635B78FC3AE16E9539BF511E2C754AA6F91E0C8E7E3817C085A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194169, "uuid": "7e2bd9ba-ecfc-433a-8b31-0a2d544a13b9", "value": "6144:3SaeLxmjZ80mHQrA6eXsn1kG5rrfyBjf+YyBepOgA:3+xmjZ8rHrkfISYyBepOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194169, "uuid": "2c435ab9-45ef-4441-8d63-c7615e428e86", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194169, "uuid": "ea32fea7-2469-4ec6-a52d-92d7924bb638", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194169, "uuid": "58c3ae20-74d4-466d-bbcf-d66b1d1fc769", "value": "SecuriteInfo.com.W32.S-909ca299.Eldorado.474.13408", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76caf76a-ea75-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683202574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202574, "uuid": "f76b37a7-3fe4-4e5c-b4dd-368c1e4fd360", "comment": "Malware payload", "value": "fc98e4ee6dd8df3da921f4100f189941", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202574, "uuid": "24b1ba91-540c-4b71-8be1-cd4690f13b16", "comment": "Malware payload", "value": "c22387fb659da23f02efc1b371f39f1d3a4ce3d31b783a2f2de776c32eebb5d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202574, "uuid": "255bda7b-1137-434e-b2d3-7427567f978f", "comment": "Malware payload", "value": "f7f49de4bf52b38fde46aa55b9711b2a2279a1e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202574, "uuid": "90f1f3a2-1c79-46e0-adf5-a54b06e1face", "comment": "Malware payload", "value": "7582f091e4d9d243540d9d2e13b6f83e48aedc656a2ee1f286972137cc2f84e7b18088e1596060bb7bed6360dafa5c0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202574, "uuid": "065771f9-e802-4106-a546-30fc0bc1a25e", "value": "T124346D7FA286A60BEE72A9701EE4775AC6AB345CDF22D3E40496B77079710779C02433", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202574, "uuid": "6336a344-5a43-432c-ade1-a7fc75112f40", "value": "071307373db47402e881a4d65e0a19ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202574, "uuid": "5d1da5e4-7108-4d70-a9e2-73b7ddb45959", "value": "3072:zgPehzNXFJTnm/Yy3PatOuFlVNmcaz5FpjYoEIcANfX96OjeGriiPPKi3vQEj59q:oEVmhotyZN16UeG+Ydj59EOFg6fS/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683202574, "uuid": "9fd84e24-516a-48be-b2ba-15ff808b593e", "value": 231264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683202574, "uuid": "1a1451ec-dfa9-4e78-a251-a91dc0c175bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202574, "uuid": "bac61bd2-54ac-442b-8b94-f3ba67d2d3a5", "value": "c22387fb659da23f02efc1b371f39f1d3a4ce3d31b783a2f2de776c32eebb5d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe869fba-ea51-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683187340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187340, "uuid": "9fce1d3f-31d8-4411-a262-f49b012123ea", "comment": "Malware payload (Mirai)", "value": "cc3a04e1774550095d237b248b1bf556", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187340, "uuid": "b2ae296f-99be-4a85-805f-71b1bb58f36c", "comment": "Malware payload (Mirai)", "value": "c27767ef8dac5a4efe740f9e6e3bcd8f3ffbb10c79a6ffad0c7324ec040ed1b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187340, "uuid": "8b2d94fd-d60b-4dcc-b9f2-6954b0518ed5", "comment": "Malware payload (Mirai)", "value": "7a9ab7e9c87fac384845b25c88310a49ea5cb7d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187340, "uuid": "76bb8342-b9a7-4a94-a0ce-f7c52cb61787", "comment": "Malware payload (Mirai)", "value": "0cf19a06c977fdf6a53e1d24a26a98f93f5198109d7a5a8c9bce022088be847e4df8f678d4bfa4937e0a9c176d726afc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187340, "uuid": "2dda6220-2abc-46ee-bda2-1eed0d715bbf", "value": "T19D93B419BB511FF7D89FCD3746AC0B02388C958622A83BB67574D828F64B24F55E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187340, "uuid": "f1815a77-8fdc-4685-a350-65b6085c23de", "value": "1536:NUYh3J42HG6+sJ5qWnyQY/anZZHJFBw3wp4wbZnr:NUYh3q2IZQY/QZ+o4wbZnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187340, "uuid": "4d5db752-6f65-40ab-b744-287b8e5684b4", "value": 88844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187340, "uuid": "4b41985f-949f-48b3-81bc-d6d4499da89a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187340, "uuid": "be31943d-1b9d-4e67-8928-b17eb11b5a74", "value": "cc3a04e1774550095d237b248b1bf556", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c784c463-ea76-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683203139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683203139, "uuid": "2dc9aa71-7f8b-4495-9048-3a7fead86019", "comment": "Malware payload (Amadey)", "value": "fd73192b7f5dda97d349e9d886e1c68a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683203139, "uuid": "a9e3b0c2-f688-4324-9fbb-0499b501227a", "comment": "Malware payload (Amadey)", "value": "c2d620cc090a1e919e0596ae66431440a05748f969f66e639680c90806836175", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683203139, "uuid": "54ac0fc0-ede6-4d65-a570-a362b8ceb1a8", "comment": "Malware payload (Amadey)", "value": "73d0f12160df761a744402e81899418397c91d0c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683203139, "uuid": "15e97c8c-da49-4b0a-b468-77e9daae1caf", "comment": "Malware payload (Amadey)", "value": "5aec75dc4f02352f531c159028f2966bd34a2cde9883c5845a24e4ecaad33e23100aded0ee5397bc977e14effd533be8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683203139, "uuid": "4da262eb-24a6-418d-ad6d-45ed72a636fe", "value": "T10BF41217AAD88571CAF527B018F706E31A36BD616DB0C32B23819C5F08B3596A87573F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683203139, "uuid": "fbb882b1-0ceb-42ab-9d07-acc9ffe7743a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683203139, "uuid": "8a431145-d4c3-452e-96d5-168556783231", "value": "12288:QMrly90GX6GA5hWE1dMEo5K44w+/c+Xri6mQMtagCKYnBtbR6xmI:lyN6G8jio41+AVQMhCt1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683203139, "uuid": "4881fdcc-d77d-409b-8f7c-94934ea92de6", "value": 727040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683203139, "uuid": "0b793d4f-19ed-4f12-b474-052550d0fde3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683203139, "uuid": "8966107f-feb0-4ca9-950a-25275dd787df", "value": "fd73192b7f5dda97d349e9d886e1c68a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e007b9a-ea6a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1683197754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197754, "uuid": "1b9dfc48-b6ec-42c0-92db-046e9d318e34", "comment": "Malware payload (GuLoader)", "value": "5b47dfa91a93e0a803ae3725d3bf3b22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197754, "uuid": "e5bccacd-9ab1-4978-bf0b-6c54243e6e8d", "comment": "Malware payload (GuLoader)", "value": "c3d847c94bfe3e6182153fbb2a1082fb931d5877cda40e2bd3e6cee11e7fdbcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197754, "uuid": "9f9dfbbf-8856-45f0-a1c2-6528bc4a175e", "comment": "Malware payload (GuLoader)", "value": "b1200811b01fec3fed2a922038e31b69f7df7ffb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197754, "uuid": "18d10e80-7ece-40f6-b33a-54bce1ad5f3d", "comment": "Malware payload (GuLoader)", "value": "03b2a2665db72e3322375195b43da0631d0bd26a499d67fa35788a400698d23ddfdb7ed45b7ba2791c28b8bd343d3325", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197754, "uuid": "4b85f8ac-c8d5-4e34-9a53-dcc1dee6ee41", "value": "T1B5E4E627A21182E2C475BDB2CB8E59946E386D3E469EC16F75B5F37B28F3251410BC8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197754, "uuid": "16ae71bf-e0e5-4876-9ace-12718892f475", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197754, "uuid": "3bfb3a30-e8fc-4b59-aaf1-fa5f701dd874", "value": "12288:kH+/vBkZcYasAtiiP2V55ugrq23I5KsIH4Iv:i+/JqcLPU5EeI5kR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683197754, "uuid": "4acb3665-3347-4124-a524-1c4e8f9b33c6", "value": 694469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683197754, "uuid": "c92db4b8-3491-43a8-8674-05beb7ccb3db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197754, "uuid": "af69cbdc-65aa-4700-8e41-22ffc39bf87e", "value": "Purchase Order -28 09538210 April 2023,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d944d0e4-ea51-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683187277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187277, "uuid": "7b9ee04e-5d18-419b-b377-11e10a2bf23b", "comment": "Malware payload (Gafgyt)", "value": "199fab80a0aff68e3e3bd2aba7b394f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187277, "uuid": "d3f6050b-c3df-4fc7-8ed7-9c7455911ef6", "comment": "Malware payload (Gafgyt)", "value": "c513239b0cd1c0f90bcdab99eb625083a7e2ba36211c941555cc426b5d8ad05d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187277, "uuid": "d4893577-2a8c-4aad-9136-988e9bbe1b08", "comment": "Malware payload (Gafgyt)", "value": "051f422902d5ccd68869be4f135be1d06f79ece0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187277, "uuid": "d50b5123-2962-477f-9436-8ae88da6106f", "comment": "Malware payload (Gafgyt)", "value": "596c72f9b075ee194caed8243ec14e5dde58c2fa6fc6d2e037169d4ef3b5daeef6ac03d80429f416c85d0c02345e4078", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187277, "uuid": "db7e6cbc-d0fe-4d87-8911-eda52f7efb12", "value": "T130F2E06643C02DF8DEB1603DEBE8CF41665F26B9E0DB351141356624F2CA12B396C6D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187277, "uuid": "44e52e18-ac0c-4b4e-85b3-4ebedb37fd03", "value": "768:tvCmjV5tBOFIGe3VOqyv/OVsxs3UozGBGtBbhrQZj2:tvhV5XOFIzAHOVsczGMwZj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187277, "uuid": "1f3fe43d-4f7d-43b1-a39b-3ae2ee5fbd4c", "value": 37080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187277, "uuid": "a43ed391-baa3-47ef-924e-a633620ddd55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187277, "uuid": "da80d801-2132-4939-8387-1cfca041e3f7", "value": "199fab80a0aff68e3e3bd2aba7b394f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9007777a-ea53-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683188013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188013, "uuid": "30e6f8d2-5757-48af-8589-84ae35cd6135", "comment": "Malware payload (Gafgyt)", "value": "e9dcd01d8db18c7283a2831e7938b04e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188013, "uuid": "620b74cc-2a89-4350-b6f6-acec95c251f0", "comment": "Malware payload (Gafgyt)", "value": "c5e3a0e5f00f7005163778ed71ff1458ffb4feca2f81772c1e449a081652e1cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188013, "uuid": "038319c8-f594-4d5c-b798-2df91e0f5b7b", "comment": "Malware payload (Gafgyt)", "value": "7665bbbb93d64c6f345f6a58bf08deeda9c553b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188013, "uuid": "112cdd34-695b-45de-87ab-9766e53fa933", "comment": "Malware payload (Gafgyt)", "value": "5e31741454b09914b75b141f051fab32b529e19274d7d219fa60ebdf6c3c02e3a54d16bbd6bab61c69aea4bec1d84354", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188013, "uuid": "bb9de495-206e-458f-91d1-e50cc14dfb2f", "value": "T1E163290399669FB7C0866EB525F70A304753FD251F4B1B89722DAAF8070B9CDB80E764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188013, "uuid": "23cef7b7-eb40-48c5-915a-a88a5a255206", "value": "1536:N1BOxUVm4Wqj6WMzKrtg/p96Crf3l/XnVMuC4mk02q5vc6fBnj:NnOxIm4Wqa2rS6c9/XnGuC4mk02q506h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683188013, "uuid": "1f444663-268c-4100-8b2c-81aa80d7cd89", "value": 72105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683188013, "uuid": "47d06a3c-ccca-4dcf-97b9-4490fd993e09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188013, "uuid": "8797ccbe-702a-4e1f-a229-30ae031f1a39", "value": "e9dcd01d8db18c7283a2831e7938b04e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fedf868-ea92-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683214857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683214857, "uuid": "5de35281-494a-4f2a-acba-2a32537f4400", "comment": "Malware payload (RedLineStealer)", "value": "3b91fcacbfbe534b7f51878f47946669", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683214857, "uuid": "6e7f350b-f4df-4c89-888d-062c73bb7eec", "comment": "Malware payload (RedLineStealer)", "value": "c6ade3c9c649d486c3b2e7df7919bbee564dc56fa23950d455f8023d9013ba84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683214857, "uuid": "75a4a32f-e3ea-4f9f-9999-7e70343efd85", "comment": "Malware payload (RedLineStealer)", "value": "2bba8205fb8b78d6c6873cf3f4f281601d83486c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683214857, "uuid": "f661d8b6-4428-4998-8b8f-02dd5ba0353b", "comment": "Malware payload (RedLineStealer)", "value": "c146e04df67a01e956f3438eecd1961ce56aa9d5a006ac5884668238bad5758f76a6472c3abd8e46c56efd1d70623a10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683214857, "uuid": "c6f3f528-8087-4789-a1ea-7b21890234f8", "value": "T1CED41243B7DC9622EDBA273058F9138B0A33BCE65D74976B238164491C722D0E93676F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683214857, "uuid": "46558fb6-21cf-4e62-9fd7-79fedf074971", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683214857, "uuid": "925edb68-339f-40eb-8644-9cfa28e0b56f", "value": "12288:kMrKy90/6F+qfU5folU44TYNGtCowUElunr/Xdgc5BMTDEyTgT+4kt22:uys0bpVNRowZlur/XWQrKht22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683214857, "uuid": "a5f2c5b8-3f4f-4c15-b09d-edb024d52774", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683214857, "uuid": "905e9a03-6f86-4fb5-8aab-86df52cc3745", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683214857, "uuid": "9a73a43a-bbc7-4850-b980-f693428ca00a", "value": "3b91fcacbfbe534b7f51878f47946669.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4c271f-ea64-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1683195201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195201, "uuid": "d411ef3e-29cf-410d-b62e-32b8256a5f77", "comment": "Malware payload (Quakbot)", "value": "4f647d0185b4af6c55a7c4e55016a763", "object_relation": "md5", "Tag": [ { "name": "1683182516", "colour": "#CCA21F", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195201, "uuid": "76875dc2-88b1-4b72-ba28-2cf501b5dc2c", "comment": "Malware payload (Quakbot)", "value": "c6b9511a517fe7ed9abbe0b6ddc11623a75aece9481043ed0720670793031fd6", "object_relation": "sha256", "Tag": [ { "name": "1683182516", "colour": "#CCA21F", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195201, "uuid": "de95ebac-a74b-434f-b38a-6f77ca6ccd6f", "comment": "Malware payload (Quakbot)", "value": "4dbf9589590a330d236103ceccd77a9bcfdf38cf", "object_relation": "sha1", "Tag": [ { "name": "1683182516", "colour": "#CCA21F", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195201, "uuid": "fbca6ed6-7010-4d50-adb3-4a13f3da8333", "comment": "Malware payload (Quakbot)", "value": "d33ccef071bb74aac48879c1c0695cb519cad8a8d2e2507f1cebe2adec902cb47c375b07ebf01b5760b1e03f9beb9068", "object_relation": "sha3-384", "Tag": [ { "name": "1683182516", "colour": "#CCA21F", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195201, "uuid": "09d5e22a-cf02-4a14-aebb-5b11ee8f111d", "value": "T155A2E1FB32375A1F8889FAFCB310441C40E6C451DAF3B272104CB160A98884DE6BFB96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195201, "uuid": "4587b686-5b99-4cab-9f17-16eb2c42869a", "value": "384:lmzNWpj8GMvl/lU08FUjTYesvBowtH4Ix1bkNQy7FZ8CL2Q4IBQGhQSq2HQFqlvA:lmhWtMtiFQYeWuw2IjQWypeCyEjhezfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683195201, "uuid": "1863c890-b6f2-41b6-a815-b61ebaa825e4", "value": 23034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683195201, "uuid": "5d61d023-78bb-4001-be3d-b148fdc8f4a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195201, "uuid": "fe784ad3-8670-4d14-840d-57cfbd43aa8f", "value": "Hn.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db54807-ea59-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683190452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190452, "uuid": "484c645b-26b5-4b07-a08c-c6b6c9bd2d30", "comment": "Malware payload", "value": "2fa467e21c54d460ba33ae52998ce40e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190452, "uuid": "8567f8bf-b01b-430a-b7c7-be4bc33b7217", "comment": "Malware payload", "value": "c6f102c5732a1b27a59064f2bd4c42019f32852b45d03b43350dfc1700ee1c04", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190452, "uuid": "01879a64-727b-47b4-858b-5d3b4460a350", "comment": "Malware payload", "value": "64f6a710d760b228e3e64741b1977d737d94ef9b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190452, "uuid": "61c207a4-01aa-46e4-8686-aaccd80dd7ff", "comment": "Malware payload", "value": "bc807c65f4a086e97b26e72bf83962b4928c582c3b7dff048ed0b309152f02b8498f799d4348204cba724f5204adf036", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190452, "uuid": "96fa56bd-8579-4e21-8582-c6ff78c4505a", "value": "T1F9812A35A3180116EA57C18BC22DFCDE0329F27341CF965D5578F7D20AA3B68E9A9849", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190452, "uuid": "b632169e-4c6c-4304-bde5-2ec3f728b480", "value": "96:aSua4cuET67H95AnjAVrtJs4RipV2bL+iPzrU:aSnQXH/An0Vr/pIg+uE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683190452, "uuid": "82e0a8ff-dd99-4563-b067-edc1cac60071", "value": 3874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683190452, "uuid": "0cfd38d3-6eaf-4042-a5ac-acad148c59ba", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190452, "uuid": "358a798e-31ed-44e0-a9f9-c85b184cbc96", "value": "P0_802389.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e483b81-ea53-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683187822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187822, "uuid": "9ca4a51c-2aa1-476d-acac-a0f43617b11b", "comment": "Malware payload (RedLineStealer)", "value": "73d5dd606dd58251da58af3d21f4128f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187822, "uuid": "e897481e-5366-4f9a-a0c8-c694e3cb3a98", "comment": "Malware payload (RedLineStealer)", "value": "c74d357dbd22f2879e00ade618e4719be463daf6d6e3facf494ea418a7476655", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187822, "uuid": "544c64b7-179d-4cb2-994b-b923e9fc460b", "comment": "Malware payload (RedLineStealer)", "value": "9159ad9b2a62590faa294bffa72a30f0622b5d16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187822, "uuid": "e2f19fd6-8e58-490d-a2ee-dddd68958168", "comment": "Malware payload (RedLineStealer)", "value": "a1250f6a7169e50bb73bbbd139b8658e91af4b3b5e8f78b6dcdd11c3e03cd5be589388e2f969b4fd84e6833938546acb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187822, "uuid": "d9288aa5-5666-4e6e-abaf-10fb6d3cea72", "value": "T198747C2AE704E1B5FA1A913C2CC3616F5AAD68751BAF50C33B45471B315FFB03AA0369", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187822, "uuid": "be92d4a0-7677-4a31-9d47-fe451cd3044d", "value": "88ed05598d45c16a126d02464dd4684a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187822, "uuid": "9cf4465c-5df3-4dcb-9c2d-5e873a834aa3", "value": "6144:zPZigkguUMJ/8flCFdrAHhPa1erFO+RIufMn0eDPpfofuG:jEgtpfflCvMHw1eZHfMJhQfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187822, "uuid": "e657aae5-92a1-4df7-8678-072f9e1298a7", "value": 356960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187822, "uuid": "3cf5bcd6-fe41-4e37-b935-3823cf4a85b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187822, "uuid": "17ccdfd2-a162-4efc-a24d-910a6c87f34e", "value": "73d5dd606dd58251da58af3d21f4128f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b786a0af-ea41-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683180349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180349, "uuid": "c4d3fcf2-30e6-446d-bf56-3b72ee6d5af8", "comment": "Malware payload (Formbook)", "value": "b692af04166987bfe8b4db24afb58c4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180349, "uuid": "13f040a6-71c1-4ecd-9f92-0dfedc102579", "comment": "Malware payload (Formbook)", "value": "c80a78a69b180edbd9c52c5828d7adabfba05645618ed23d9728d1ea8ab394b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180349, "uuid": "6dba3143-9074-4e33-8919-25788a0f42f8", "comment": "Malware payload (Formbook)", "value": "2b98f44885eccc1d01583e9d37b6d42416622dae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180349, "uuid": "188ad669-015c-45fd-9667-0657964791dc", "comment": "Malware payload (Formbook)", "value": "cddfe2e74b1e2c3ac8900841357e935cc64e0dda2d1d23ff02f4062bed15214d4f6d334f085d53b30903f82216dcaf0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180349, "uuid": "4f54be05-e0a2-46ed-86b1-f4e2e0cf3e00", "value": "T1C5D4BE3C49BD1273E7B0C6758BAD9870F0ACA42F3191FE2A29D7D19012D3966B9C316D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180349, "uuid": "d7f7697b-4373-4846-a1f1-5458d24f462b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180349, "uuid": "1e05d5dd-2544-46ab-a2d8-10f7673d0aa0", "value": "12288:k0fRTG7MA/9svCVSu5UYv7SEVSO4/Tyfmyn/A8EjdiW7TC2/OSvLg+apR:5i9195XT7VFC2R/SlSLqLla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683180349, "uuid": "04f0745c-191a-46ea-bfad-d45f838c53fd", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683180349, "uuid": "328d63f8-fb19-462f-a173-fc00df2e9079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180349, "uuid": "a5b1b482-eb01-4203-b107-b4cb454b15ad", "value": "documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14beec06-ea76-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683202839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202839, "uuid": "b3b4c93a-e3fc-405c-88f4-158d49e11180", "comment": "Malware payload (RedLineStealer)", "value": "2c63f944b2cc1290c82db0eeb88e51b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202839, "uuid": "505c5858-3491-40e6-af18-2007ee46f06e", "comment": "Malware payload (RedLineStealer)", "value": "c83071d4e0a65018eb23e72e4bb00a4b0f8452ab9f28f5df8d05cc09e03ab65b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202839, "uuid": "ff68533f-a719-40b9-bc2f-9614f733af5b", "comment": "Malware payload (RedLineStealer)", "value": "61bf1da1e47133226659a61645c49e7d42b2527a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202839, "uuid": "0bb2a959-1604-433e-af00-42741e1585f9", "comment": "Malware payload (RedLineStealer)", "value": "9167aee72028e20881400ec5094d5ee648327449e614673a64b10fee1dc376e150af11c541ff3d131294a0379fa68b55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202839, "uuid": "0753c8af-af16-434a-b19a-1f60617ba527", "value": "T129F41202BAD94A63E8F117B01DFB12C31B32BDA28D65D36E31A1580F0DB36849576B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202839, "uuid": "52b112fa-a3a3-4a21-924b-2be8fcbeb491", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202839, "uuid": "62311451-4f7a-4f02-b877-4bc89ddfd0d8", "value": "12288:/MrEey90JdOvr7/Sd/cvWeU0M7vbI4cSa41AAPtC4YIxAfC2:wyUQPqoWdj7c6P4rCAK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683202839, "uuid": "ce70295f-934f-4b0c-abe7-5b6fcbf502af", "value": 727040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683202839, "uuid": "4057ad6e-52fb-4e80-95c4-09319e83d9e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202839, "uuid": "ff874dcc-1910-4838-88bd-2ebab8c5e10d", "value": "2c63f944b2cc1290c82db0eeb88e51b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779b2725-ea2b-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683170792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683170792, "uuid": "5cbaef3c-5ed5-4313-9c14-9acf1455b8f3", "comment": "Malware payload", "value": "d2cd6dae38d93539821d4c6e8d2afbf3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683170792, "uuid": "ed9bd614-cb44-422e-ba92-c8c79bbdae2a", "comment": "Malware payload", "value": "c931b1825c3a09f15cb4b2357b7a90ec3b13a19252f8520819ddd9b325387894", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683170792, "uuid": "6c78f23a-6659-43dd-bbd8-4fc3b7dfa9da", "comment": "Malware payload", "value": "1ffc3d1846c42367f3f9b0ba498ee192489e0bd9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683170792, "uuid": "ae96f67f-3b49-4388-afe0-65c6ebe37c1c", "comment": "Malware payload", "value": "71a95cba25af59d9ada417d6bcd0f027d263a4221b1005d9e5f181a6e29beb0c371c708bf0e4a3cc776bd34cc7664e31", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683170792, "uuid": "2c720275-3456-42eb-8941-bc65252d4b89", "value": "T1AA72F004E5091074D431A57A235A6A41B9386EB14B8A1FCFAFEB9CBD03BD1D236316F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683170792, "uuid": "3ad1aa10-762d-4a5f-888c-f90c8e66e305", "value": "d9a533ac36fca36743df9bf09ca0903b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683170792, "uuid": "7156d27c-77a1-4629-bb25-e4001b899300", "value": "192:r8WVrjkw+3GhTla1LiOOrsQcRga/6UhCJaECeZGaJewLRsutxFBXgGWcUO9FftxD:4WV8w8e6Mr8zhCUEDsuPXjWm9FfXSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683170792, "uuid": "00d3c4c3-6f76-4918-8de7-185aeb37ac48", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683170792, "uuid": "918a9b53-1dde-4b12-bf19-ab4fd9efa312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683170792, "uuid": "23f3c314-418d-4c58-aa7c-57706b663218", "value": "SecuriteInfo.com.Variant.Barys.320444.11967.28102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808b76cd-ea49-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683183692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183692, "uuid": "dcdc8012-e981-442d-96f7-88cebdef3217", "comment": "Malware payload (AgentTesla)", "value": "98f1cadab84365e01b7026961d773329", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183692, "uuid": "329d1f24-88cf-4baf-8daa-8a61d2ab0b07", "comment": "Malware payload (AgentTesla)", "value": "caefca83d781865b1e93a39e0cd9bc333271cbfd8302479abcec2b20c86611c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183692, "uuid": "6b768114-6b8e-44da-b000-08369c089acd", "comment": "Malware payload (AgentTesla)", "value": "371c2d90daf92bd90ab47bea2c74e7ddb0455552", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183692, "uuid": "cf9d9bfd-396b-434d-9974-3a6f8ca8361d", "comment": "Malware payload (AgentTesla)", "value": "8afb56facaa2b3ef9a41f8e95b7971df63982a8e18f36c4bf2ee6df2602a4013dbe0e87699fda0be1421954374ad9371", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183692, "uuid": "f1f69d45-65f5-42d3-a749-56b581048fc9", "value": "T1CDC1B825E3D81B33EE6A0639EC73E3410278B7A58EB7CF6E5DC4490EAC156D44A21760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183692, "uuid": "4952e7fc-802a-4a2c-8c4c-d3f5760768b7", "value": "96:w2A0YqSIhvyZ1As86eSn6sunKOwr0fLRjMikbFnU:dA0Y/76swKkfLRjFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683183692, "uuid": "9bba00b8-c112-4f49-be04-d5576a5954e6", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683183692, "uuid": "ce206fcb-d3a5-42c0-85d7-5fb7ac7dbb6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183692, "uuid": "70bf4871-88ef-4106-b9be-d6b26980ef20", "value": "CITA_doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f489041-ea5e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683192629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683192629, "uuid": "b7f9588e-0114-4649-a02c-7fe61f4d2826", "comment": "Malware payload (RedLineStealer)", "value": "99c7e8183aec42f5fd6e4b7fda23e45a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683192629, "uuid": "7fc89239-1553-4124-bac7-00e393033df7", "comment": "Malware payload (RedLineStealer)", "value": "cb1db618ce36feea3e333e74e920a76332340f0094fe777aba6d95d08c80743b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683192629, "uuid": "ab313369-093c-46b3-b547-2ba8b96e0871", "comment": "Malware payload (RedLineStealer)", "value": "620ef63298e7061dd9003ec927e40f2f03661b15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683192629, "uuid": "ee288861-ea5a-49a8-8ed9-b837998bcca5", "comment": "Malware payload (RedLineStealer)", "value": "ba1a35f06d061671a0d90c28cb3221824eb9fd18bfba0e38f87541990a35f2688cc824557f88b0a8dd1483fcb61a2984", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683192629, "uuid": "8a98d2d9-f6c6-45d2-9fdf-d4408d319550", "value": "T10BD41242ABED4072DDF127B058F612C31B39BC669D78822B3B95A8694C739C8D13177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683192629, "uuid": "8d679c68-4074-43e0-b22e-6f4db0e17a3a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683192629, "uuid": "4ce9bf4d-63b0-4b41-be2d-18c08cda560f", "value": "12288:gMrXy908k2B+rVwY0W0QIXckTF2uZsTI5LPJCSPFRxqQh:nyPvYrVQWNsluI1zPFRxq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683192629, "uuid": "db00832f-3008-4ed4-8649-ea59c0f74a71", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683192629, "uuid": "3177c9d1-39d9-4b30-8d23-b89e679ad1c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683192629, "uuid": "ff73902d-82c8-473c-be98-e3a920d11025", "value": "99c7e8183aec42f5fd6e4b7fda23e45a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd9659e0-ea7e-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683206558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206558, "uuid": "155fc02c-e6f9-45c7-8208-e6803f86ded9", "comment": "Malware payload", "value": "06f43e8b63c65cb45ffaec6096c82ed2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206558, "uuid": "38fa4bf5-af53-424c-bee9-50a554a56266", "comment": "Malware payload", "value": "cbc4cbf9db38f09ea31897b1fc58958076be2973998654eaed3a62dba9d3656f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206558, "uuid": "4e74f8ca-c1d3-48c2-8b25-4481d13ddee7", "comment": "Malware payload", "value": "1a6f9d8f847f2a2fea8c469eb53e01ad7a5bf5dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683206558, "uuid": "84e63e0e-6a86-4b22-ab44-48dba9898879", "comment": "Malware payload", "value": "ace240a13b33765fa7ee2d3ed0e99af44de70efc2346162d6b0fc56e20e4f40971b55f2c637d24f25bcc0b4edd84aac1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206558, "uuid": "49558304-e682-4a2d-a501-5ea163b8fe3f", "value": "T13274D02CF38D6E63D2BE06BAD0D156505330E689529FE78F4C9A0CF67C82BCA495534B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206558, "uuid": "33db0e0e-61ad-4412-9885-7db9d4b3ba02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206558, "uuid": "f60400c4-b697-43c5-a0b2-74bf1d7c1eb3", "value": "6144:JB9IV3alfX9D+w7OZlpz5Nt0ceAvBkEuZtHOC3PQX:BI3al5VOLp50ceEBkfZNO2PQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683206558, "uuid": "4735b39a-8f85-4219-8ae9-9ff68ab39335", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683206558, "uuid": "9b324cdf-b525-48aa-a453-519e702132f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683206558, "uuid": "46ea0fd5-b5a2-4a4c-ae60-0f348f2288b0", "value": "cbc4cbf9db38f09ea31897b1fc58958076be2973998654eaed3a62dba9d3656f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9a098f-eac1-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1683235365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683235365, "uuid": "fe27d700-398e-4e7f-ad34-5bc5335aa3bc", "comment": "Malware payload (Smoke Loader)", "value": "e9536e863a26bd148b0f1ac30d2fbff7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683235365, "uuid": "a6a9871d-c2f5-41b1-bad9-499d77250226", "comment": "Malware payload (Smoke Loader)", "value": "cbe73efcb33a39bb5896e25515fe480e3a9519ab5f7acfaccec5d53c01345c63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683235365, "uuid": "67836e59-5507-4e65-9b7b-787047c7d793", "comment": "Malware payload (Smoke Loader)", "value": "25870c5208e0e643eed4aafb44e65b5532d8514e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683235365, "uuid": "d2437e12-fcbf-4ff2-9264-47aeb2b6a2fe", "comment": "Malware payload (Smoke Loader)", "value": "68abca8457b31ce46b07c9966e280d5e3bc080a2c1e0ed3360407d60a253cc7e81235774bec324234f6e766add428b57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683235365, "uuid": "a8b1dc2a-4ce8-43ad-8019-37bbbc35de33", "value": "T1DD640A4392E13C88FA264B739E1EC6ECB74EF2508F59376962189E1F04B52B2C173B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683235365, "uuid": "b4c39b6d-8e73-477d-8b63-5036c5758f0e", "value": "0f907acfe861920cd55775c62f670cb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683235365, "uuid": "e4552231-168f-421a-918f-ff87d2aff1aa", "value": "3072:IjwaqJVssCd4Op7VvIpQrFCR2RWsVy2rN5Rb4U7TjlZx//t/l:uwfJjC3tVCQrF1bw2FME5t9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683235365, "uuid": "3e84ca40-3393-41da-a34a-35f2289814b0", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683235365, "uuid": "fdb59744-37fa-4f48-a34b-92c781ff26e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683235365, "uuid": "6e8b184c-4443-46c2-9d75-2f950fd95ad4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28cc0fc3-eaa4-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683222629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683222629, "uuid": "8bb48633-0724-4521-bf56-f5bdf346dc62", "comment": "Malware payload (RedLineStealer)", "value": "7dc96aa0ab782b118253eb1a89097846", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683222629, "uuid": "c4e6645b-c7e5-4583-ae06-85970cf59d4a", "comment": "Malware payload (RedLineStealer)", "value": "cc38a4b7fb94d49bb50c0ac5299e131101f881f39ee61d38d72e666606ea657d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683222629, "uuid": "8629824b-0861-4260-890f-d2c07c685ac0", "comment": "Malware payload (RedLineStealer)", "value": "3e63b378c25bc866408bbea85f9842a408e24699", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683222629, "uuid": "08a738fa-736a-44fb-b49c-1c408c2f3879", "comment": "Malware payload (RedLineStealer)", "value": "02707e0be30fea0c4f1890a19c1db4423af7f64dcaa845970c23db71aad80c0a1789e551580bdcd2917936b95b70821e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683222629, "uuid": "4da220d6-8e1b-4b71-bd17-d12b2383978e", "value": "T18F752316DAF994B2E8B807B0D8FA13471E3DBE92DA76129F7350645A5C326C8607073F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683222629, "uuid": "bc0bf522-ebee-41eb-af3b-5a0f7ce638a2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683222629, "uuid": "80f24467-5a96-44c1-84a9-44f534282944", "value": "24576:MyMuGDgt62Ey1oADD+zD0PdZOeP+QSS5hkR4qnMvB7oG9z42NZrwwdw5:7ZG0qyaA2mL1P+QzkWvB7osZ0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683222629, "uuid": "b3cdafa5-54d5-45a3-85f0-dc3bdddfbd57", "value": 1619456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683222629, "uuid": "b27af2bc-e15a-41bf-85f5-c938e7792d0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683222629, "uuid": "7a76e0f3-f5bc-4970-9434-f331ec219370", "value": "7dc96aa0ab782b118253eb1a89097846.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2aafbd9-ea76-11ed-b3cf-42010a9c0076", "comment": "Malware payload (PureCrypter)", "timestamp": 1683203211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683203211, "uuid": "22cebbdd-27eb-4b0d-9a89-29542a9b2496", "comment": "Malware payload (PureCrypter)", "value": "12b7825e2c9b53b29f6c502fdd518b89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683203211, "uuid": "891b983a-e0d7-4095-99f7-b899aadeaf59", "comment": "Malware payload (PureCrypter)", "value": "cc8274c502770613afec17ed1814e4b49c341984c87c9ca4fc536c6a6a965acf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683203211, "uuid": "d633b119-3ca6-45c2-8850-fee8e9ea5a2b", "comment": "Malware payload (PureCrypter)", "value": "2eeec6e1a280c2b7f9ff2fd57cd5f7c324d29292", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683203211, "uuid": "3506da0c-eb9a-4d5e-8b48-459ccfccf8a5", "comment": "Malware payload (PureCrypter)", "value": "968eb4dd94939bbfecb7630269bd6ea881855f013f10ad8d48461571bd0b54fed692028398ddf71d029ff4c8b1ce1168", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683203211, "uuid": "37b44968-11ab-47af-b4e2-54733bf60362", "value": "T16234E1582B9DEA33E27E2BF894B5406447BCD35AA862D78D6DD0D1E14453380B7322FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683203211, "uuid": "9881fc6a-be3a-4179-b245-0f91fbcc3f5e", "value": "6144:E4LdhXL1u+I+x7tBbb0RN0qvzBId2uRIbM:rB1I47b0N6tIbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683203211, "uuid": "d55bab8f-a0e5-415c-a7af-9463fac1d5b7", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683203211, "uuid": "156f0d23-78cb-409c-b722-6142ffa32130", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683203211, "uuid": "2afc9907-26e2-4751-9114-860faf73390c", "value": "cc8274c502770613afec17ed1814e4b49c341984c87c9ca4fc536c6a6a965acf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e22eac6-ea69-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683197298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197298, "uuid": "fb6d9003-0c1d-4d85-ae1b-7c49da90134b", "comment": "Malware payload", "value": "ac861bad8d477d7cf2420d14a1d29c03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197298, "uuid": "78f16b3b-11ed-49ae-91e8-079158edc63d", "comment": "Malware payload", "value": "ce07aa161a98051177e31df1cbd84d40119a7912525e80cf9dbd25e257874553", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197298, "uuid": "6d55dbac-b564-4721-a572-2beafc055e84", "comment": "Malware payload", "value": "b2cb5758f97f37aaedc669e9981df49321e8c3cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197298, "uuid": "e0ebabb3-2f47-484e-8470-5415bc492138", "comment": "Malware payload", "value": "201e87001d6583eea7af990b04ca15dcadd24fa82c7d9a073599385e2e5c31d290674225339a7c4ba33c884fe17cb54a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197298, "uuid": "a801a859-723f-4dce-9e00-5ffce33135b4", "value": "T1B1C4E702BBF49596E1AF5732887209604AB4FC816623F3CFCA4675650432774BF2B67B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197298, "uuid": "120226f2-3cf9-417e-850a-2ad3b340043d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197298, "uuid": "fa10e970-1529-4445-ad78-c07c0d9efbd1", "value": "6144:oJCKepty1pIHJDXPetYIRLCtqXYARbQU9y8ExbSXkd9GqLcsZCK:osjyUHJazv9b6ZTGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683197298, "uuid": "367e7dd2-4317-4b3c-bdfe-3996c003c393", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683197298, "uuid": "4b771c88-dc13-43f7-8eee-5a21d2b916ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197298, "uuid": "f4a617d1-8d1b-4e4f-9860-f56821ecf693", "value": "ce07aa161a98051177e31df1cbd84d40119a7912525e80cf9dbd25e257874553", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6099c29-eace-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683240959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683240959, "uuid": "b140053c-a7ae-49e9-856b-633366e513c7", "comment": "Malware payload", "value": "b7bc67f2ef833212f25ef58887d5035a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683240959, "uuid": "d7c8ab7a-8806-459d-b203-12447f264d03", "comment": "Malware payload", "value": "cfa7d79bdb21a3073c207ebe5ae0917f5d6e05a043b65ed368b84254dcf20fa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683240959, "uuid": "99f5c8aa-9c7a-4a80-b632-6918264accf7", "comment": "Malware payload", "value": "1b34656cdd2ffed970e265a92b704a6927b2e95e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683240959, "uuid": "fe217d23-3d56-44fc-9ae8-b1a731e60872", "comment": "Malware payload", "value": "bb38344809b665faf0bf95bb117493d71696c4855d2d2628ac1cd39651628372a2c676acbf91ec4f0561c043928676f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683240959, "uuid": "46e8c1d7-aec8-43d7-9bfd-5d8521a0f441", "value": "T1F0746C06F6A404B9E1A7D138CC775A05E7B17C4A13609BEF23A0465A2F37FE06A3E751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683240959, "uuid": "a0d2b9f8-cc95-4e35-a1df-4cfbeedeb77b", "value": "d56ad9e7805afc2442e3a288287c78b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683240959, "uuid": "fa590aa3-82fc-421d-8db7-c0ea2b674616", "value": "6144:pDQ0M49bfFTnhB5jhNFt+zoe0MGp7bU+4Dpoh6nS/N9HBQ:+wbfJh7hjt+AMGp3WoHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683240959, "uuid": "55ccd3b3-ef8d-4f7c-8aa0-fabdb1fd5757", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683240959, "uuid": "9199d098-2f39-485e-86c3-84379b9419d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683240959, "uuid": "7489e3ff-ef66-4e60-a965-f04a4993d77c", "value": "ffmpeg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b989a2-ea57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683189571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189571, "uuid": "9619301b-bc33-4a01-8309-250be4e18b38", "comment": "Malware payload (Mirai)", "value": "a45e9e8b89e6ff8dc23e7b0e9696c620", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189571, "uuid": "37b38954-5cc1-48c2-b00b-e13f041b81cf", "comment": "Malware payload (Mirai)", "value": "d055bea3295aec0da3b363b343841400fb668512ddc51b051f8c0df9125405aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189571, "uuid": "968bb3ac-44eb-4b3a-85fe-27e848fd8de8", "comment": "Malware payload (Mirai)", "value": "e5ff225894f2c842254d7fdc6e079e682b817648", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189571, "uuid": "d967bac3-e0de-4df9-9d1a-b23c292eafed", "comment": "Malware payload (Mirai)", "value": "8976ef3750bc3904f8b387baafa4948337f8f38afe3abebcd3b822a7096159d8e8465b1627226c92d0218b0e74d022fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189571, "uuid": "1551a55c-4c98-4456-bf7e-af68f47ddcdc", "value": "T1C1730A46B8419F12C4D122BABE5E418D33132FF9E3DE3202DD24AFA07BDA9D90DA7551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189571, "uuid": "f11a6400-fade-4524-8922-362c163e5555", "value": "1536:zEnM4ugYAXc1W09wxQZqkBukFqhWerYFufYTNSQYb1h8XOOZ0jP7bhYIIm+Wx7rA:aJYAXc1W09wxQZqkBuUqhXY8fmp+o0jJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683189571, "uuid": "31462450-0d59-4e15-a017-090d90fad109", "value": 77192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683189571, "uuid": "7fc40f08-d9ee-4c47-a678-4ba2146c60c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189571, "uuid": "b5070491-5c18-41a8-8d4a-a59da4878832", "value": "a45e9e8b89e6ff8dc23e7b0e9696c620", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8d1f23-ea49-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683183686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183686, "uuid": "b15663f0-14a4-4b35-a50b-b1c0329fd938", "comment": "Malware payload (AgentTesla)", "value": "4a75c54fbb45fec21f653c479bd36630", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183686, "uuid": "d8289e05-e5a9-495b-97a7-b395db64c1d8", "comment": "Malware payload (AgentTesla)", "value": "d09abd46b7e3761fd73b421dd29f8cbd81383c8e8dd19a09d7d63f4ced66f767", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183686, "uuid": "9a865b75-6b23-4365-afba-11426ed76434", "comment": "Malware payload (AgentTesla)", "value": "f55e76917af0903e455ece030d067b540f9cd28e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183686, "uuid": "5c7b7179-a679-4c8a-ab23-c5cb89a2166c", "comment": "Malware payload (AgentTesla)", "value": "cc91816c8136a91de998d411a7a956ec96ce0b3c21ebcbbcb949a50e1698ab1975cc7f40b7ee24b2deeee24ec9272e6c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183686, "uuid": "57c3d6a4-1b98-42e2-a9a5-71c6fe5f15af", "value": "T1EAE49C3C2BBB2FA3CD74EBB7D7645416B2E5F16B721DCD2928D610850A4390326E326D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183686, "uuid": "1db4148c-59dc-4f20-9180-b2b7b3aa30c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183686, "uuid": "0c403e77-b7b6-409e-9abd-d4fd1b365ccb", "value": "12288:sIzC6YN1P8G5/xxlZyu3vQ0U9q9GDCnoroEsXpIDmfcDUu4:17M/xPZf0q9GDaoZsXpIDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683183686, "uuid": "dac32755-1d1f-44f7-9421-0c9da5e84f5c", "value": 714240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683183686, "uuid": "b4848627-8d5c-41a1-b0b8-4f9c91764175", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183686, "uuid": "8e0e1d6c-7325-4be6-823a-f203771cbae5", "value": "0382635263526532.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45881336-ea81-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683207645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683207645, "uuid": "86827914-37da-4942-b047-7c0ee90997af", "comment": "Malware payload", "value": "25b1e06bc7fd0341a7826a1fa68af5ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683207645, "uuid": "043dd573-2304-49f2-89ce-1cbe6f3ddf84", "comment": "Malware payload", "value": "d0fe935bc726e951311771cd3611c5536feae7a1315e3583551505b1c9a366f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683207645, "uuid": "9e2ff7f3-f6f8-4a78-b935-cb5ecfebf088", "comment": "Malware payload", "value": "2e2b1ee46f607674dcc1089310197b9d94e57cf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683207645, "uuid": "d69b857e-66ad-48cb-b3bc-fca521619057", "comment": "Malware payload", "value": "fbf15d0e12b74f1319bdb9020ffa5c65ccbe8aa71089e0d37717093303bf5de2b31470286a469667be0ea7b58a45c1be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683207645, "uuid": "d5e1e9ac-a605-47dc-8df9-70aeaa2db704", "value": "T1BA444A6E22CB909EFD2098306EF4765287A7D1EFCE5ADAF009C15C6039E4173EC79426", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683207645, "uuid": "012edd71-0fcd-4f4d-b936-2e6ae059fc0b", "value": "071307373db47402e881a4d65e0a19ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683207645, "uuid": "887e33c2-217c-4809-b212-30902e0854d0", "value": "3072:zwE3Fjfh1JervmVCyD3lZ6KmTmaNQYJ5MeIfO4aOpzyGC25pPUIAjchtz+EbgKn:vCyjl/UqFpSch9Rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683207645, "uuid": "85d8b5ec-be37-4036-aea0-da56dbe5fea2", "value": 258400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683207645, "uuid": "bdfcf594-f84d-43ed-93e0-9b834d55ff32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683207645, "uuid": "eba21bba-31d8-4f2b-909d-79961460b2a7", "value": "d0fe935bc726e951311771cd3611c5536feae7a1315e3583551505b1c9a366f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2df50b-ea40-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683179684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683179684, "uuid": "e7720d75-7533-45a6-8775-c046f6bfc47f", "comment": "Malware payload (Formbook)", "value": "866992e686690dd0c538561db3d2b85b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683179684, "uuid": "a94340f7-2d46-4905-b37e-ee2e278d400b", "comment": "Malware payload (Formbook)", "value": "d30f415758c3cab377c63b3dd5a043d83d153c47a8f6aae56e88c5868d090556", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683179684, "uuid": "23010273-1c7d-4976-b4b1-2632076b3eea", "comment": "Malware payload (Formbook)", "value": "050d57066eef80c7099a3be4816c44aae94d63de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683179684, "uuid": "ca6711ec-1995-4aad-a891-fc4b137a963c", "comment": "Malware payload (Formbook)", "value": "39a8d399ec9bb8a4c8cf33965ed45a1b02ebd66abf4747a9eb3f02513a510e06f683a6d04a3ca747fca7f83d14e3b078", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683179684, "uuid": "eaba3106-cd4b-4f68-a7ec-becacf305577", "value": "T1EFF49C3C2BBB1FA2DD34E7B7D7645416B2E5F16B721DCE2828D710890A1390366E326D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683179684, "uuid": "ae6fb47d-79cf-443d-9695-bc61a6913980", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683179684, "uuid": "321add3f-c1be-4f1d-b78b-c020b57ff3bb", "value": "12288:6svC6YN1PTGEDUuw23Klrf7QauaCVo9Sep8ceibRdcEBFEqdYG:sLDqDULrogfcVBFEqdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683179684, "uuid": "738faa4f-6e6e-4cb0-b660-7977619af79a", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683179684, "uuid": "841a0c7d-62ba-4683-b7fb-9147b5b6d5a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683179684, "uuid": "a54c5bd5-99b7-4b4c-ae3f-8d05824c051f", "value": "Inv_7623980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2665a8-ea3c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683178103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683178103, "uuid": "7f83eb13-243a-40f6-ad9f-01351f0dbc5e", "comment": "Malware payload (RedLineStealer)", "value": "fc41c5c843cef22cae7d775a1c65cb79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683178103, "uuid": "34610cd4-e863-49a3-98e3-1aadd3a3460c", "comment": "Malware payload (RedLineStealer)", "value": "d43e533bb11aadc204eb283ce804d56133de67ebd443c80fb375e79983766337", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683178103, "uuid": "627f5cbb-a3f1-490c-906d-99c355509973", "comment": "Malware payload (RedLineStealer)", "value": "253f557bf8a5e0b58f282259a15cc23f9d982f54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683178103, "uuid": "1d9bbc7b-af42-40ae-a11c-05ce87a033a7", "comment": "Malware payload (RedLineStealer)", "value": "11845f47960482a127aa26a7696b57971be05d74f18050a38ac862a1b35a9778c62e3f77380731462a446ed4d39c577e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683178103, "uuid": "429c7630-90a7-440c-8f9a-a41a602bb081", "value": "T1AEC41206EAD85137DDB62B7069F606830B377CB25E78836763859C4A0D726C1E83277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683178103, "uuid": "65a9d4ca-5bb7-47ff-9e5b-e629821fbb89", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683178103, "uuid": "e714f8c5-e4a4-4222-ae34-0256379dc06e", "value": "12288:iMr3y90iPARr0WqlQJFIiCsoOIyftEJiHXbIX3ucQh:dy2SQItsFtEJiKpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683178103, "uuid": "735969b1-61d1-4af6-8788-b2f679dce529", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683178103, "uuid": "73d8e589-6f34-43a3-9920-580e3fcab23d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683178103, "uuid": "5229f355-7fac-4204-8f8b-97c31375fe44", "value": "fc41c5c843cef22cae7d775a1c65cb79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1003e3-ea4a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683184064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184064, "uuid": "63848b90-606e-4c23-9e46-e42698de8308", "comment": "Malware payload (Mirai)", "value": "ce320085f4b628e5c46cc6fa35b82cf5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184064, "uuid": "03ad2383-371d-409f-89e4-d5cfdb085599", "comment": "Malware payload (Mirai)", "value": "d451f93fff052df6642962fc442e76f12d095fc08ca42cd4aabaffe89973fe2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184064, "uuid": "431cf785-cc15-4b34-8a67-9c416209d67d", "comment": "Malware payload (Mirai)", "value": "aee06b83beb32352bba3a23811f270d527e15a1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184064, "uuid": "d7e19f9c-4559-4623-a28f-5aa531553ce1", "comment": "Malware payload (Mirai)", "value": "5dcd7e51d5f56c1a9e0a6fd495bff667dfac939665e2b0d806884a476f666ce6f53e24c157210b7203d347cccb789c3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184064, "uuid": "4bdbc861-c0cc-426c-a3d4-9d691d923034", "value": "T147145D06EA404B53C1D22B76B29B534933235FA5A7DB330699287BF03FD275A1E36D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184064, "uuid": "46c9a45b-f1b2-42f7-93a5-4217c40d0e86", "value": "6144:ktGDvaTv5wMj/mG0QetJ8au4lSR4LxMM/97mDwZeqZAB:eGDvaTv5wMjbretJ8aQRwN/ZmDgeqZAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683184064, "uuid": "d4d3db83-afaa-450a-8cc1-f580ec010a03", "value": 197457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683184064, "uuid": "906a6249-3cc8-474e-af24-dd7c98879257", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184064, "uuid": "660e5224-2774-42b1-a939-0e946fa5a29a", "value": "ce320085f4b628e5c46cc6fa35b82cf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f29b65-ea5a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683190807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190807, "uuid": "6a914a3d-ea33-4733-a28a-a0dd07f6c0d0", "comment": "Malware payload (Loki)", "value": "8e0ecb7ba2f014cca993d772c9b7831e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190807, "uuid": "b2cbbac5-393e-42eb-9c33-64f7cc4aa061", "comment": "Malware payload (Loki)", "value": "d48d5a7e080ddc649f462281c3bd8c7ee3909f251669640e3f2c6403cd47f3de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190807, "uuid": "195cdf62-9b4d-46c1-878f-f4260e6287db", "comment": "Malware payload (Loki)", "value": "c52846068d0477f42d1b183cd197f739a8b301db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190807, "uuid": "e421c973-ceb4-4458-bc32-57ad5c7f6f87", "comment": "Malware payload (Loki)", "value": "4a4433a540287a98a2e1766d1dda228d18dd5e9f41e198b9c73df0513fe6adf1fe73429dfe5ddd699df0659a2d79870f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190807, "uuid": "9d13707c-902c-4add-b337-31c189d9d72b", "value": "T1EBE3021172E1D067E8B307B14A76791A1FBED9071854924F1390A78A3EB7BE3EB0E315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190807, "uuid": "edfabd70-2296-4c99-8009-43f07d5b3294", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190807, "uuid": "ed59d251-e121-474a-9981-d5a519721f78", "value": "3072:XfY/TU9fE9PEtuCbyxLUty3bnGhZH3nGGYcU0XrdWIbvYiZa:PYa6SyxLCETUXYIX8iM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683190807, "uuid": "e808c903-e9f7-48b2-a358-5d6b119e6aa9", "value": 153787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683190807, "uuid": "be6aa542-65c0-452a-afb7-b6399001a196", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190807, "uuid": "d5f62d0c-cdc4-4c40-a1b0-b6b38f813de7", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f453b8f-ea53-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683188039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188039, "uuid": "b20b6c03-1bbf-4a6c-9428-f3de0433e8f1", "comment": "Malware payload (Mirai)", "value": "0d886655d3df6a7042f35e11c63645dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188039, "uuid": "d9f36747-97f5-49c5-95b0-a7fb4b295460", "comment": "Malware payload (Mirai)", "value": "d4c301a1784375fd6cc3a9e48e4d59b6a5e301027d2545f791e9037970622ebd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188039, "uuid": "13acb861-67a7-4cc2-8012-a3a0d5739b48", "comment": "Malware payload (Mirai)", "value": "b8a3903068c0492bb0837b6fe8eebff6c221624f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188039, "uuid": "7672b1fb-f3fb-45e0-b538-82d6cbd1d201", "comment": "Malware payload (Mirai)", "value": "94da3cc87e08efe461abeb3c45d69934a8f3a12b95505d000048c001dcaf212c1a968e1b83cc360a7162661f2ad8a248", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188039, "uuid": "47f1b153-23ef-4701-b84d-577cab934716", "value": "T190130856F8924E26C2D413BBB67E5A8D3370A3E8C3DFB213CD506B51B98640F0D66E90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188039, "uuid": "10b9cdb2-fa75-410a-8d9c-ccf1490cdae4", "value": "768:gST3fb2YvG5lMFL/7mUPaNrAu89GLJrEBmtO61NKXeot9VHPeOhgoMGeRwVwbZn:FTD20G5yF7mU0rQotOiKXlVveOanIVwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683188039, "uuid": "62fde180-d004-4fc2-84c7-45e1386f8bb5", "value": 44624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683188039, "uuid": "c4c59bc8-940b-486a-913a-afed7d7d6b9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188039, "uuid": "545577a6-fb0f-4611-81d0-77674ae50e96", "value": "0d886655d3df6a7042f35e11c63645dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c88dec3-ea55-11ed-b3cf-42010a9c0076", "comment": "Malware payload (BluStealer)", "timestamp": 1683188732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188732, "uuid": "5f95ecc9-640a-49cd-b194-500690c1921b", "comment": "Malware payload (BluStealer)", "value": "a838a2013c038b3a5039cb9abb199922", "object_relation": "md5", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188732, "uuid": "5db92265-0d4b-4932-9dfe-df9ef83316d9", "comment": "Malware payload (BluStealer)", "value": "d4f62b8520f3f0e84b19769be0f7bcdc20e41af8cea048261f3e37c0428b22d7", "object_relation": "sha256", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188732, "uuid": "0627042b-3425-43fd-a544-8a34a77703e0", "comment": "Malware payload (BluStealer)", "value": "6a315d36c940cd95359cd4ef46c5688352a22a42", "object_relation": "sha1", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188732, "uuid": "a0df85be-bd94-4288-b050-5084f344e9ae", "comment": "Malware payload (BluStealer)", "value": "0401447252bfb767bb824ea42f597d9155209c2bc5d616a02b4f095afdd1d1c7e003482d4b4348e45681722e6aa89028", "object_relation": "sha3-384", "Tag": [ { "name": "BluStealer", "colour": "#B2C98C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188732, "uuid": "b761a69a-b7c4-411a-8944-29ffcb246427", "value": "T1EC75F057A014C85FFE1ADB70C1B8FFA4A6F0BD73A4D5542227793889EAB4F421E8C119", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188732, "uuid": "a5dc56fe-8394-41f6-871d-47d87a831f2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188732, "uuid": "193a813a-41ee-4e81-a81d-f7abffd4adc8", "value": "24576:Bq3UElwshsKgvyH1kz7iQ2Py9so+4XfbqQtTpSrwCDCSD85vvOn2rRAJdqfcd7AH:Q3UElf6Lk1y7iSFd5BvWn2WJdyk8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683188732, "uuid": "6276efc3-d26e-409a-8de9-674f3336117b", "value": 1549824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683188732, "uuid": "523bff00-eab7-4afe-adbc-159fac8dc06a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188732, "uuid": "1a0afe25-37ae-48be-a6fb-e6bd9290f866", "value": "Purchase Order 202319876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f861f8-ea6b-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683198246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198246, "uuid": "0847d8bc-2cf9-4c5d-af35-0a5901c0c10d", "comment": "Malware payload (RedLineStealer)", "value": "92e79e8ed958f7289702c96fe03de5a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198246, "uuid": "92482aff-29cb-4848-8bdf-a668b02909a9", "comment": "Malware payload (RedLineStealer)", "value": "d540f75897495102dd30eaa924623ac40415e8a716bdcbadf7d7c9a00feb5c97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198246, "uuid": "52f7e189-d4f8-49b4-bb90-18389743da35", "comment": "Malware payload (RedLineStealer)", "value": "e16dede58a351b4bcc4e7b973fdec6c3ec3e98ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198246, "uuid": "4d9139be-c868-467c-aeaf-485deebf37ee", "comment": "Malware payload (RedLineStealer)", "value": "84592778c6427d841332a3f683294c8a71be4e2b1469b0b3258378742b0ac9d8ea48657885fce1f5305669a08bde1cfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198246, "uuid": "3e6160ef-2c22-4592-a913-592acd3e749d", "value": "T1E7A339262BEC40D4D968D2789BD3DA56E6F6F8524B2193DF13A5461E0F37BF09C39220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198246, "uuid": "fbe39b4d-ed39-411d-bb4f-2b09d92a9bea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198246, "uuid": "531123fb-4243-4c2d-9ec3-e38f45abd375", "value": "1536:BfbO0u8DiUPCrElGBWHNC68MVlPjgNJiWUex4bmR+w/Y2tKSG8xB2ncSVKC29m+l:VbEUPCrElGsHNC68MVlPjgNJiWUexfNh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683198246, "uuid": "09992c12-fe17-410f-8ace-f183f3878824", "value": 98296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683198246, "uuid": "b3eb586b-7716-4bdc-8311-08b2b31d5502", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198246, "uuid": "933671da-69d0-4ba5-a75e-16b5fa6839fc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ec7bcf-ea66-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683196340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196340, "uuid": "cb6765d4-538f-41fa-a5a9-7aaaecc6a71e", "comment": "Malware payload (SnakeKeylogger)", "value": "1edac83db68a1dc5da6c647218a4ddb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196340, "uuid": "85984164-459a-4633-9cc1-0f5ed2f8596d", "comment": "Malware payload (SnakeKeylogger)", "value": "d7f55b222b8d9a235401bc900230aff5b37da8cc7e9431459da35b380c5c55bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196340, "uuid": "1956b02e-657d-4855-937d-752658a14ac1", "comment": "Malware payload (SnakeKeylogger)", "value": "a2300d8947c14ed8b6e1fc838d7e1711ff341862", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196340, "uuid": "3e1ee355-08e8-4894-b2ae-a9c5cab997cb", "comment": "Malware payload (SnakeKeylogger)", "value": "5fc6ee7f497f6807a01e0c4f6670863879ff4360b1cdaef98594661ae22608f7ee9fb69d5f0c5ba3225577b8da334dda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196340, "uuid": "eca62e2c-a725-42c3-b1e0-b586cf634309", "value": "T11CE4D19431BA8792E43B87F01478B46413F670AFA8EADF110F9670C55D9DF502E89A8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196340, "uuid": "62507107-24ff-4dbb-bed8-33ef57e66cf3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196340, "uuid": "8a989116-d5d9-4abb-91dc-dbc9a7768367", "value": "12288:JpOni4IyAxN4XRc92S35birzFjjhQmZM8M70XC0rPygboVF2OSdrg2s7n:JcIKXVkiXFBFZM974Zrqqs27dG7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683196340, "uuid": "c86f68f0-538d-4f39-9d59-43e427f6e98b", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683196340, "uuid": "8778c952-71b3-41b0-8969-06c54e1bc8b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196340, "uuid": "8a41c7a1-39b0-416f-86fe-8ef30d63cc7e", "value": "payment copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d897f8fd-eaab-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683225931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683225931, "uuid": "41031346-4f58-4304-b23d-9c9b88976701", "comment": "Malware payload (Amadey)", "value": "48abc6655b96a7b18ee4df97db82af23", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683225931, "uuid": "c19f4f73-2810-4812-817a-3ca96c2093ea", "comment": "Malware payload (Amadey)", "value": "d879d27689457fc7bd1b7052e5916b26b826cf1276bcaf6bab8e63afc028f71b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683225931, "uuid": "d63febea-d682-4c99-bd3c-dbe027724a26", "comment": "Malware payload (Amadey)", "value": "053e6372bfadd5a036f9c287f9954b3c3b087657", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683225931, "uuid": "8cf00ad1-4ee9-4441-8f2a-035e91c0d9fa", "comment": "Malware payload (Amadey)", "value": "3611c60938bb39657b40e749212c1611bde72e2f1d81dcdea12ee82cb1bc77c2d44b99d22ac45999bbfeb7f029706c15", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683225931, "uuid": "d9f8ba37-eed1-4b0e-9e4f-39a1e3a0c6e3", "value": "T18BA40213ABE88072E9B417706CF713C70B32BDA1582857AF3B569D5A0CB3684993177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683225931, "uuid": "d798ff2d-db21-4081-9c26-c2e10e75f388", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683225931, "uuid": "018bf1aa-ca75-4d05-b261-d2e67769da93", "value": "12288:TMrby90Gcqbw6nqbkzPRvPa7ZTbXNIRtxgK:wyRcqbbqIzN4XWTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683225931, "uuid": "e0cd52fe-bbc3-42b1-9b79-48428dab452f", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683225931, "uuid": "c4b8925e-d0ee-41c9-a786-08f05c1a6dca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683225931, "uuid": "1b8a832e-203f-472e-b73b-1b3c6a50c4fb", "value": "48abc6655b96a7b18ee4df97db82af23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab362f96-ea8c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683212540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683212540, "uuid": "2a02877a-1073-404a-8339-41f1dd52164a", "comment": "Malware payload (Mirai)", "value": "fe4c60beeb923ab93f2c63f4045b8abc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683212540, "uuid": "90dc34bd-1a9f-4dd7-8876-88dd400e410b", "comment": "Malware payload (Mirai)", "value": "d88b3d492614de475717d80ba59332a7de32535fc5c2288f6597e94b8c853269", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683212540, "uuid": "9c90192b-8d93-4a1f-9319-af86139d4257", "comment": "Malware payload (Mirai)", "value": "81f2445e81d4451cc9777210391f011e24a73cf5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683212540, "uuid": "f5eb59b4-ddd0-4bcf-9744-206ef7e08829", "comment": "Malware payload (Mirai)", "value": "68ec15da1b541c3dd709fe2e52321139fc45c1e7d7eab2d17beb2a981d8da8b9765c34054865a547e8ba6dd8d77473c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683212540, "uuid": "1ba5fe0e-5fd9-4277-8bb4-4c04ed5517a7", "value": "T1B473BFB1D0687D64C15C0138B6E9CD3A1713B404A6635EF49E568BEA600BDECF61E3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683212540, "uuid": "801ed729-bbb2-42e7-a32b-ff4efbb5fb11", "value": "1536:z/BmB4rKTNwt3aGVkMY776QF3tqvw9BgdUIy8F+CpNy:zZmquTN0aGVi72eNBgqIye+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683212540, "uuid": "55a8b590-4623-4c37-b4ed-c37c8dd42002", "value": 76812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683212540, "uuid": "33d04812-4bfd-4606-b083-334720bac5cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683212540, "uuid": "cf38efd2-94b1-4d44-a4d0-e97853456282", "value": "fe4c60beeb923ab93f2c63f4045b8abc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3086603-ea77-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683203614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683203614, "uuid": "70c96c1d-d80d-415c-a79c-9b25ed61e3cf", "comment": "Malware payload", "value": "cb36f2c7d495c2a30fc1216525c1d797", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683203614, "uuid": "2de38428-f691-47de-9bba-026229d4c5a6", "comment": "Malware payload", "value": "d8bc54d3a4a3022f43c67831356df16ae9c8925a861d8f1087a20b9e2503758c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683203614, "uuid": "e39334eb-cb5a-4fb9-bd7d-4fa9227dec21", "comment": "Malware payload", "value": "63e696c408d3995cb2a040c9ed0cee08e1c3b255", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683203614, "uuid": "6f438cd4-06af-443b-ae24-6ce988f34c50", "comment": "Malware payload", "value": "687575c27ec34e618f113ee11cca9b445fb41c3aa6f0842b2d01dfa20846c79c6ab24ef8a766847b81526cd20312885f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683203614, "uuid": "04d7025c-d598-40b3-af02-4ed5be6cb2a0", "value": "T1BD543BED609BA556FF559C356ED4B774A77308E58F6AC2F004A8502338A88E3CC05F7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683203614, "uuid": "9de4d9e8-a02f-438b-b673-48e772be9f84", "value": "071307373db47402e881a4d65e0a19ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683203614, "uuid": "5136e366-2aea-42ef-b66a-be81d4eccfcf", "value": "3072:Y3IqxvWAh3n6gJCCY+lbadtVDzLg3biUoaOLkCQJQwtRne30YkLU6jm7q5Jtn8SN:Y3Iqxp3f1pozCS+5J5t0l9BOfY4YpHUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683203614, "uuid": "b8ec984a-844f-4015-bb4a-8ce12da8acd8", "value": 280928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683203614, "uuid": "02c18f9b-804f-4066-b962-bfb663011df7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683203614, "uuid": "7a3394fa-2998-489f-978a-827b4219c1b8", "value": "d8bc54d3a4a3022f43c67831356df16ae9c8925a861d8f1087a20b9e2503758c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af18ab5-ea6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683198635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198635, "uuid": "e1e7fab4-921c-40e6-8c71-2073e3016cc0", "comment": "Malware payload (RedLineStealer)", "value": "d64356b85ef4ffb8d751eae778d2cb2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198635, "uuid": "e44bc629-77e8-4c4b-a589-cc5f40efd508", "comment": "Malware payload (RedLineStealer)", "value": "d8cf0997e17d320be06731b6aebb22cb95e28b1aa0104a09ca5814b866fead58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198635, "uuid": "5206e54a-6a8b-4396-a17d-8d1a40e015b6", "comment": "Malware payload (RedLineStealer)", "value": "c3c489285a6c29e9babdcff41ba93dc6a532024e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198635, "uuid": "a511d499-8a09-4023-9225-bc6543d806a2", "comment": "Malware payload (RedLineStealer)", "value": "4771e194668dc3274c6408a2d9cfe2d3a7245a6f61e676912e9262d823788de4f88a53c034cd1d53ad3c29a47a539dce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198635, "uuid": "072901ba-77b5-42ca-99b1-b437eb4a8bf6", "value": "T14B75232A6BCC90A3DDF87F7174F216831E35BCA70838C25777A5A86D28B24D46931739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198635, "uuid": "fad56a74-ed9b-4e5c-9e51-8b690eb128f6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198635, "uuid": "314b786f-e183-4036-9900-8b1c9dc7a8d4", "value": "49152:+PrK1pwfo30h6IWXV0FnhBByk2X2H6Yd1IWIo:erGMo3ygIZOYpXIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683198635, "uuid": "469aee22-26ec-4cc5-85d0-302c935014bf", "value": 1623552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683198635, "uuid": "38fd7704-565c-4cbf-bb2f-0b47b2c850fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198635, "uuid": "c5ebfdde-9f3f-4683-a062-cb5bdfa40fea", "value": "d64356b85ef4ffb8d751eae778d2cb2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5f2def-ea56-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683189322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189322, "uuid": "48df740a-c236-47ed-ba5e-8bd819e1beb4", "comment": "Malware payload (Amadey)", "value": "e28cb2dae89cfecce4d5713a14e9a3d9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189322, "uuid": "d0404845-7f79-45af-95ff-61f4a9e93efb", "comment": "Malware payload (Amadey)", "value": "d9a732545cd8f94b16d798ab31f369a6ad61fca19fc56780d531468ee2e6ff8c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189322, "uuid": "32973309-71bf-43df-97dd-21788d121afb", "comment": "Malware payload (Amadey)", "value": "8f3a305910b219830598e3ed70b5e3fba4724536", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189322, "uuid": "306b1c1d-0fa9-40f2-8127-32d23011ad76", "comment": "Malware payload (Amadey)", "value": "0946da11619ff43ebab2948466505f44d0a9e6e63409595b70cd839799a788e001bf881e1f0ab24a04b1707da7f6ce9d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189322, "uuid": "daaba71b-0aba-44c4-85b9-38dd5509a743", "value": "T1C3652342F3E9D031CA740B3104F92BDB4FBABCA18C38B79B266559854CB35C056B57AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189322, "uuid": "52c3c3c1-6791-4b19-bdb5-5966bdcad1f7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189322, "uuid": "08cbd0a9-f606-45f3-9705-e11e5b290ca6", "value": "24576:WyOjrIOIXgVl6PKmSoIaq8v3AePh4mMxOmFhlyW4eJD/fpHwQnCB:lSWjS6f/AUh4Hx7fKenZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683189322, "uuid": "ff8c2016-2614-4874-a0b2-6ef0add19c3a", "value": 1519616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683189322, "uuid": "6ef6540a-605c-4ef0-a8f3-7f092a6c87be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189322, "uuid": "b2f0494c-0657-4dac-84a4-f0f3fd877409", "value": "e28cb2dae89cfecce4d5713a14e9a3d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b89d3416-eabe-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683234038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683234038, "uuid": "32b4ea76-7ca8-4d38-8066-9cd81738ae96", "comment": "Malware payload (Amadey)", "value": "f7870c9c01ef6f89bda961563fea0ad0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683234038, "uuid": "a4da6864-4963-4dca-8b3f-ce6b863145c8", "comment": "Malware payload (Amadey)", "value": "d9beda619192289915406dc5b56c571ea6e9fc91fc5645ae16b63a10c04a47f9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683234038, "uuid": "09af003a-3bb0-4703-90b0-2847a7e2663c", "comment": "Malware payload (Amadey)", "value": "f4829c37bae471e36f72c38c0a01ad0777c48378", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683234038, "uuid": "1c8582a0-1a72-448f-9600-597bd9194ec6", "comment": "Malware payload (Amadey)", "value": "06a5284b6c3223db214b4eb9c48a344c4b59e40c9c5daf49547f4b3226777524443d3b1189088d854c023c4306a846f7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683234038, "uuid": "cb461254-2ec8-47cb-91e3-358477f4d30a", "value": "T1B284F143E6D890B3D8B917B068FA13D31F3ABCA15938C26F2745AC5E19736C0A43576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683234038, "uuid": "6610c31f-5375-484e-93b1-35a72ece9825", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683234038, "uuid": "46a4d0c2-beec-4438-b40e-ecd6741d84d9", "value": "6144:KFy+bnr+dp0yN90QEUL2Fp6RvGAEFQIoGHfqELU459ZOIdZjvq39et:/Mr9y90RrE6iG/pU45HB5vqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683234038, "uuid": "1b2a6e4f-2e2a-4793-8e85-4e6e7a20e1ac", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683234038, "uuid": "2326e82f-3543-4a14-b8e4-d5a0620c67ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683234038, "uuid": "d0d51091-d9cb-4beb-8906-3ad9ac3b933b", "value": "f7870c9c01ef6f89bda961563fea0ad0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7a5e45-ea70-11ed-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1683200652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683200652, "uuid": "19239c20-10a1-4d1a-bab4-3e21f8947525", "comment": "Malware payload (zgRAT)", "value": "7a13dbbd050c9ff2ce0994d83839f753", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683200652, "uuid": "8358e57f-5da1-4b1f-a775-937690347465", "comment": "Malware payload (zgRAT)", "value": "d9d19324374082ee5f960d9d7bdfe422b7724050fba45db751d01f1469295c65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683200652, "uuid": "7c1f2d5d-67f1-4485-a4de-baa418c73f60", "comment": "Malware payload (zgRAT)", "value": "54a8142da9187e910f3e264e408baa8fe414ca06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683200652, "uuid": "18bcaf74-3f1d-42fd-804f-7e4549d6617e", "comment": "Malware payload (zgRAT)", "value": "74cabe024d88480f4b69afb8744f278b70f432eec19a0b78598f5a25bac479255a2b5c0ecf447d5de9227de9a4d3a956", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683200652, "uuid": "efa0cd3f-14e5-4237-be50-c5c0e32b1405", "value": "T112C5F1312BE5BE9FF6AE0A74E89601150DF09C67B1FCD2486CC459CF6DAA720C811E76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683200652, "uuid": "2169bb03-ba93-45a4-8631-5d46e20e83ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683200652, "uuid": "37938a5d-fe8c-4554-a717-368dd8292c29", "value": "24576:/E1YZP9JFoqsUjFA+5qYmsHW6L+qhfESYHUH8NeAmrJdvWSQuMQDGVTq/FYdNjpc:pv2+5qZohBY0wGnWSQuMQizRcwnt1Fy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683200652, "uuid": "1727798b-3bc2-437a-91a0-09f992e04b98", "value": 2719232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683200652, "uuid": "6c408863-a491-4de1-91da-9534b98d23f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683200652, "uuid": "b6d7e8ea-9858-408e-9b02-d851a6a541e2", "value": "d9d19324374082ee5f960d9d7bdfe422b7724050fba45db751d01f1469295c65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aefa6bd-ea9f-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683220512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683220512, "uuid": "a99425a8-5c49-49ed-a214-f83cb37767a4", "comment": "Malware payload (Loki)", "value": "18dad0de59923919cb8a429fe8e14f90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683220512, "uuid": "835fb61b-3a00-4f45-b94b-8b408fb680f6", "comment": "Malware payload (Loki)", "value": "d9fcc1602122022a5c2ad597168eed6137a55b2356d767f5a877083c99989561", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683220512, "uuid": "56a13387-a9ca-4a06-9fd8-7b3e1813704a", "comment": "Malware payload (Loki)", "value": "be53fdf297ea45d41ae0d96ad378c5a736e2a000", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683220512, "uuid": "493f0eb0-e02a-47df-9d65-a6e61c593380", "comment": "Malware payload (Loki)", "value": "a1d033c42c9fb1a5aeb6d38cd0ffaf7f1b9816ec28f8ddcd03af65f9d5c78658f1dbd315309f61db03a45c3a68c9314d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683220512, "uuid": "893ecaab-2d65-40bf-a49b-e85bb33de4fb", "value": "T155E4E12227B9BB91FCF283F8661890016FB47D6193A6E6D84CC6E0CD5158F18F760B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683220512, "uuid": "44c6590c-3228-4345-809e-6495fd4ebd19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683220512, "uuid": "f1303531-a96e-47b4-910a-54f9cd31d709", "value": "12288:7R11KT7o6XF9lLfu9Fb15BDnTUMjH3EydhUA5qxw+m7Ru:1PKTLXFbLfuLB5BDTdDfUA5qnm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683220512, "uuid": "3efc4e43-b530-4760-ae5f-60e0edb075c7", "value": 717312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683220512, "uuid": "defb9ab0-3b76-4f5f-b3c5-6434f3e1362e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683220512, "uuid": "00f3a937-dcf6-4d1f-be08-34ce4ffff745", "value": "18dad0de59923919cb8a429fe8e14f90.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c912b8-ea41-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683180156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180156, "uuid": "5212ad64-941f-4508-b0ec-0f66fdff24bd", "comment": "Malware payload", "value": "c38ab93ae13556b722d37aed6b41fbf7", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180156, "uuid": "cc036104-1d21-4932-bfbe-e8116d1d0e23", "comment": "Malware payload", "value": "da1d847c4a24d3ea3e5bd317dbfe1ef8c1fd82d33d20674bf9fba408d00beb11", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180156, "uuid": "a2c58f6d-4d71-4b43-93e3-47814580cdc6", "comment": "Malware payload", "value": "04e26941ee5f0eab49ecfee63f5ac3c8e327b682", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180156, "uuid": "f7d682ef-26f6-42ab-9e60-a02ab732d0ff", "comment": "Malware payload", "value": "f14b1c8095c5226f23ce10a204a9b3e031e8473798e787606932dce76c4f2b224ed222ba8366de9e985bea2a2d3c0c9a", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180156, "uuid": "9458f9dd-ab73-4897-9d77-157c4decf2bb", "value": "T1A92533C1FDBBFE3B8010BD91A7257E7892245985639B2318E797C6D39C4E39918AB1C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180156, "uuid": "9409df33-6aeb-4456-8591-bffbf03626fa", "value": "12288:Mr40tpl2bZSgOSa+p3Ns+IZHSzdWqhx8wXrkQrqsx56xejdUsh8+Ab3rbp8L/OGY:Mc0tplOY+p9sTwdXhNbkpsSsKs6/pu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683180156, "uuid": "5e7cfea9-f3bb-4fed-a6e9-f579f7de31b7", "value": 1034541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683180156, "uuid": "51fef00b-d41a-4638-9410-4bdc145ddb8e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180156, "uuid": "dd2f5e0f-f2cf-4104-aa83-93dc6307ac92", "value": "GPT4_V2_2.0_Setup.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df7c4d7-ea72-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Expiro)", "timestamp": 1683201271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683201271, "uuid": "a992598f-cad7-4881-b275-f3be64a0c00b", "comment": "Malware payload (Expiro)", "value": "b3b47f7fd1fad3e0d79c8d20a5bd57b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683201271, "uuid": "40a37a7a-6901-4a35-8ee6-c859efdd7623", "comment": "Malware payload (Expiro)", "value": "df2a21acbf5abb55445a48a442b6245205ec80e36bb861aadd47ee18e4d132f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683201271, "uuid": "d9eb54e1-a5d6-4081-9c36-b5c9738b84da", "comment": "Malware payload (Expiro)", "value": "dcb8e21d45e9b6a1b9408b67866f79c191e0122c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683201271, "uuid": "bf43f572-06cc-4954-883a-728fd1164957", "comment": "Malware payload (Expiro)", "value": "2a4a14243200b4bce6dede10f9aad1afd664bd67f8ceb886292b0cebfb50e38ab277c0df4e4d42c5579ff016d9b4bfcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683201271, "uuid": "ac9e2d1b-a179-4471-a37f-48b6bd37d261", "value": "T1AF65F0575065CD1FFE2ADBB0D1B4FF95A6F2F07310D190241BB9219ACAA5F022E4C92E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683201271, "uuid": "54998f6d-9670-4d47-827a-39c3c9d30eff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683201271, "uuid": "868afd7f-9df8-411e-acab-b78aa5a2e60d", "value": "24576:eTJyekkXDVzThJ68yj42MiIsMcGOKJvADSiBHYcOvCedKERBx4HoHvguqT+z:YjXRf76hsZiZGFJ4DSImvC3ERBZv5pz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683201271, "uuid": "25fdac2a-b28b-4bba-be33-d24654684bd9", "value": 1533952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683201271, "uuid": "df4654ea-b40e-4434-b12d-e4fcfc6aea49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683201271, "uuid": "9c808ddd-540d-498c-9540-736f923a270f", "value": "Purchase Order 202319876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6daee6d5-ea6e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1683199552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199552, "uuid": "50c30920-b798-4b3e-8c76-90ce56ebbecb", "comment": "Malware payload (AsyncRAT)", "value": "d3efb9110f676b9c6990ac8ce21af0d8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199552, "uuid": "37084b59-b863-4ff3-9922-7f2a85d6ac3e", "comment": "Malware payload (AsyncRAT)", "value": "df3d882332ccedd588c8bd095b4693cffb9d1a3b8359e6f005e16a9ebdce16aa", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199552, "uuid": "ff0b81cd-fbe3-4e70-ab63-7acd98e25a3f", "comment": "Malware payload (AsyncRAT)", "value": "6afc4f91405cadfa67694b475df3f36d903283f0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199552, "uuid": "1ea7f375-e363-405a-bf81-e2bf13de8348", "comment": "Malware payload (AsyncRAT)", "value": "b848cf1b114d3e7ae45273e5bf3015032fafb9e8952c9398c515c4b5c75dd77e7f95085eba0d96e8d01ffaaa7e139641", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199552, "uuid": "9512411a-1327-438f-bd54-490333d8477b", "value": "T122448FB303C407BAF6840FC480AD611B15F1C16E746829AD9BF2199B7C7AD97AC74B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199552, "uuid": "09277034-6228-4ffb-a950-09fd8de475bc", "value": "1536:sz5LkCs68+OHLBdLb3YE4ZeLXxMxgswiYD:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683199552, "uuid": "e9de1d0b-63c9-40c5-a234-b5c5786e9555", "value": 268324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683199552, "uuid": "1a87a5b1-c4ff-498d-9cf0-373fcbcc98bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199552, "uuid": "9b29717c-e665-4df1-8d65-116919262965", "value": "B.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b7bb22-ea1a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683163458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163458, "uuid": "74591497-3431-42e5-83f6-c540d1b4daa0", "comment": "Malware payload (RedLineStealer)", "value": "611e8b35a373d74349f389fc12f30d3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163458, "uuid": "fd3b9e3d-7af3-4ebc-ac39-7991f7ec5aeb", "comment": "Malware payload (RedLineStealer)", "value": "dfd0333bd7b527d6447417f2f5996015f539ddaa9d7237b558f67bf6139e14f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163458, "uuid": "1dd0ba93-3e56-4479-9961-1f4566a3baff", "comment": "Malware payload (RedLineStealer)", "value": "89f2ef3aaeed9f2869c08b60a851dcffd3a1cae0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163458, "uuid": "d3c29b1b-ccd5-4379-88ee-acb9cabaf961", "comment": "Malware payload (RedLineStealer)", "value": "9de787511e5196aafaa94679b963b6a6a31793129ec6a38135c50b4557767f8b2c53a58097bcdde7a97711988665595e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163458, "uuid": "362659db-839f-4c6e-bc14-f23acc1b5bda", "value": "T184452312E7E855B2EA750FB024F2068746263C72C868136F7B9ABC290CB35C6D5B1777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163458, "uuid": "139d4538-e8e4-4415-b378-de7d5c9024df", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163458, "uuid": "d3822c0e-201f-441a-819c-13d87392de07", "value": "24576:uyCzj9HadcIWzvs02evhSdhmSx2+MTkdr83PsOCPaX/9p1jH1LGLm2fOEg:9CzjkdcIqvs0N5Sr1fdo30PmVLEm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683163458, "uuid": "2bb74127-ae03-4eee-bcee-39fc2d80d57b", "value": 1266176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683163458, "uuid": "17ba8887-6b5f-46f9-b6f7-44d1b96105eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163458, "uuid": "2adedafe-de9d-4136-8058-7142c5e45e92", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69679cfd-eabf-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683234334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683234334, "uuid": "d50fc7ba-9b76-452a-8b04-60081cb2e6bf", "comment": "Malware payload (RedLineStealer)", "value": "2ed202b04f3db8e0e366a88aae375382", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683234334, "uuid": "243ca45e-54cc-4129-a56c-1a06950ecb76", "comment": "Malware payload (RedLineStealer)", "value": "e08e314b61d09e7c38fc00cec283c27fdd6573089331a14383b8d46117550e7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683234334, "uuid": "7d40a2f9-a639-4a8a-a133-48fade08c300", "comment": "Malware payload (RedLineStealer)", "value": "ea71336c75de24bc28fb78bf5480c454d9100769", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683234334, "uuid": "5a992817-e8a4-4315-82a2-2b94c0872b15", "comment": "Malware payload (RedLineStealer)", "value": "9eb0d0210f48a655fac90f73deeef71dc7121a17ae7cf6da1008e9cd837c31d47d65f6a3cbc1a58c750bdd4f2bbea197", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683234334, "uuid": "cf597a43-75dc-47f0-a640-2abb94f271e2", "value": "T189840242B7D88573DCB11BB05CFA03931B36BDA1AE78C33B2B46695A4C725D0A03572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683234334, "uuid": "44c3babc-0feb-45bd-b921-b8df5611fee2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683234334, "uuid": "01a1aabb-4a2b-46cf-b8a8-58c31c864afb", "value": "6144:KBy+bnr+5p0yN90QE8Ktc/y1eK0p27LQ/fgd1+SPWBJEyVbejWwYcPK:/MrBy903tc/LK0ULQ3SPYV4PK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683234334, "uuid": "e918dc41-e7a4-468d-8e0f-cb92df4b63b6", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683234334, "uuid": "05389e59-2fcb-4b21-91d8-e01140f49f4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683234334, "uuid": "98c0738d-3e4c-4bae-9dd9-95726262e52c", "value": "2ed202b04f3db8e0e366a88aae375382.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a69b49-ea53-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683187962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187962, "uuid": "bdbdf9b6-c7c4-40ee-8e00-bc00e925b288", "comment": "Malware payload", "value": "ffcf59e2d3e210b15e0c82c81e5ee389", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187962, "uuid": "86ff9c3c-26d9-47c9-8d0a-eaa5e616ab01", "comment": "Malware payload", "value": "e0c3c0d43c9996e2e47207d3fad4977d508b49034cfff0606b91c904ab2dac5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187962, "uuid": "77ad46ec-fb0d-4664-9b63-f7620dc8eb95", "comment": "Malware payload", "value": "2456bc2b4fec9f0c7789c3f00158fb6fa050e7e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187962, "uuid": "29dee2c8-d867-444f-bc58-97fd049d87fb", "comment": "Malware payload", "value": "0114a255ec15377273ed30b8fad065721e6ba051be62d3ff5f63fffeb53a40c38e5b7897a6c172c3d44e9ab941428309", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187962, "uuid": "70cef4dc-26f8-4ec6-bf35-4bdc1d1c4b1d", "value": "T1C5A3D717AB51CEB7C85FCE7306AA460120CEE55612E46B6FB274DA6CE74B94F08E3D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187962, "uuid": "3f0a62bc-0eee-4f19-baa6-b61b7c2000da", "value": "1536:0GeTzI+eXiKbmTYWZMbZMPtAw7p7sXjYggpp2ymOimW+zWBSirHzai:0oc/pOZM1p7Nggr2ytimW+zWBSgHzai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187962, "uuid": "bd71e831-f764-4f74-b78f-8a0e64d233cc", "value": 104824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187962, "uuid": "ae10a05c-c372-4f92-ae68-d04d90ceaa02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187962, "uuid": "bc0c3355-38e8-429f-a7d7-e9c1dcbecfdf", "value": "ffcf59e2d3e210b15e0c82c81e5ee389", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b52997-ea58-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683190192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190192, "uuid": "dbb400fd-7648-4a40-b22d-81f4ae42a2ee", "comment": "Malware payload (Mirai)", "value": "f1f4adec38a78c7c73fcb8f1ad03cba6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190192, "uuid": "6855ac1e-5d4e-4d3a-bddd-09ba373b96dd", "comment": "Malware payload (Mirai)", "value": "e0cae8da9907611db5c81a3990e7b5d7d64ada9c2dfd4991473e3cb33e9780f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190192, "uuid": "6aee3644-67c6-4908-ab35-04f5ad606e76", "comment": "Malware payload (Mirai)", "value": "9122217d6f5c6a1c4e6a069420ac8a3765752976", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190192, "uuid": "a8e4598a-18f1-4ed4-99d0-a1da626b7cff", "comment": "Malware payload (Mirai)", "value": "f2ea5c09aab60074ba2d87495ab0768ef336aa6344e51cf425fcfcdd400743b69c25e9d01277a430cbfb88275bd5b57d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190192, "uuid": "c6f9b342-0d88-4127-8527-fb410f68bbab", "value": "T186333B8966422E2DE9DB5CFD80334F0ADD551211A4A3172BB3ABFD8339332A4FE55909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190192, "uuid": "668a9ac5-a0dc-4a42-b7a3-f0d55cca75e1", "value": "1536:o8+ntz91trZykr9V2HRMcRZ7guMGg1pIjk2g8I:oVN9VCfWuM/pogr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683190192, "uuid": "5899c0f3-5cd7-42b0-9993-6f345faeb072", "value": 53624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683190192, "uuid": "fc12c682-9605-4e8e-9d55-a74acb6c841f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190192, "uuid": "1f7639a5-dd01-41f5-a44d-401cd4f6b7a6", "value": "f1f4adec38a78c7c73fcb8f1ad03cba6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02241e06-ea67-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1683196365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196365, "uuid": "ab732103-1a8d-4d0a-982c-5924956dc334", "comment": "Malware payload (Vidar)", "value": "391ca27c9a0f24775ce52c74a91ceb73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196365, "uuid": "c8e747c2-1737-46a8-ba4a-c3db37954bfd", "comment": "Malware payload (Vidar)", "value": "e1565f294ffcee131f05930cd8454ea5d222a6f1f2341f924cefe3565cc65810", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196365, "uuid": "0224d6e8-c81f-4224-83c9-18ada87844c3", "comment": "Malware payload (Vidar)", "value": "02a13f5a5c24b86ec6f6501754ca5bbb0fc93460", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196365, "uuid": "04206891-06d5-48cd-ba0d-11bd2b309a4d", "comment": "Malware payload (Vidar)", "value": "0da47e8c29a20489e1f78fbab763bfe300a743136087f7a01cc55953b30327bf91914dff9f14dd9d70114fbbc33ab312", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196365, "uuid": "ab0d6b97-6941-4789-aacb-fd78d3232e5a", "value": "T1513639A31BC3951DC96AD0F68AA1BD7F8B73B86647183A536DD13774B667800FD0AB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196365, "uuid": "2c2797ce-c1a1-4930-8f3b-baf1c9124a12", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196365, "uuid": "2b630a9c-6f16-46d9-97ad-2bb54c1b578d", "value": "98304:h77a3TZRRiRRRwRRRRRRR6RURRFRRRRdRRRRRRJRRRRRRRRRRRRRRER7RRRRRRRo:h77BmnfzuL21F5oQegx+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683196365, "uuid": "657547f9-65cf-44c3-9f95-06c897c6a782", "value": 4893696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683196365, "uuid": "114c0d47-8a7c-40d3-93a6-12c7531a1ad2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196365, "uuid": "9e6f628b-1ebc-4d22-8835-38d7212f2479", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a50d3c6-ea54-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683188245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188245, "uuid": "84a237f4-6e16-4648-a47a-5f775989191c", "comment": "Malware payload (Mirai)", "value": "52b8547aa08f65c1a9c613f953179a29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188245, "uuid": "8cfc632a-a630-4e12-a358-ca919dc7f20c", "comment": "Malware payload (Mirai)", "value": "e1793d24fd4e5a2544189ac4262c07b1d3c3737d2c434f23490ab7f6dc497f30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188245, "uuid": "0dcf9896-f65d-4bb4-b2c2-606eb9c159ea", "comment": "Malware payload (Mirai)", "value": "969efc26cec91beede14ed6f2f79cca1142a9c9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188245, "uuid": "236ca39f-fa9f-410e-80fd-f2bf6f3955d4", "comment": "Malware payload (Mirai)", "value": "f89ef86734bee6978f28fa2c150bc26e93199c63f08333dc5ca22c42645145b1b7254d219bb436798c4e30083867dc98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188245, "uuid": "7525e2f2-24d9-44ec-bbbe-4abab00faaa4", "value": "T11D434C12EA5181FDD48AC2758AAFD172D635B96C12346A1F3BD0BFA51E33D30272E384", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188245, "uuid": "b90aa6e6-c85d-4a5c-bf7d-03cdb2de4627", "value": "1536:y4beqr6miS2WiTDwfwYmNpwqzqwVwtlMr:zwxAoYfqz5yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683188245, "uuid": "95f1d9cf-548a-4b61-8bcb-fe3512e7a9fe", "value": 58544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683188245, "uuid": "1702eb8d-83da-4a40-8e36-495dcac34889", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188245, "uuid": "51ebe1bb-dfb1-4782-b563-707a40915ac6", "value": "lava.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc04624-ea42-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1683180599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180599, "uuid": "12daced6-44f4-4c6a-9a3f-0c9bbcbf57e4", "comment": "Malware payload (Vidar)", "value": "f2ed04b59c837416cddc1835114cf208", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180599, "uuid": "407ed379-e495-4d68-9262-df5fc315e81f", "comment": "Malware payload (Vidar)", "value": "e292b5f2d6392009236b8da913f3ab156d3cc151473d4a57c3340932448b93e9", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180599, "uuid": "e83a3d67-a179-4aa9-bad7-c50227d8a1c2", "comment": "Malware payload (Vidar)", "value": "7216bc29618eef9acc2452865bc5f3d663184059", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180599, "uuid": "475fa198-6ebc-43e7-95a8-6d90aab498f3", "comment": "Malware payload (Vidar)", "value": "096a7b8a5a64fe194f257a215c3abf3173bddefabe6ea502b51e76abfc78b4cb3c97f6a29c1fabe8a720db881b55c76e", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180599, "uuid": "791428ee-751c-4d17-8467-90191a0dc68e", "value": "T1F7A63375F7ED3F888004B52172B08970AAEF15CAA9D1C0BC46ED5DB48764FB4A5A81CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180599, "uuid": "f35bcf4d-6982-49f0-9bcf-b1f2efdae395", "value": "196608:Gphc8EhZ/rUqli6UiU3JNiDOiNFeP9wTLK1iy4:GTcdzrnlqiU3firXeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683180599, "uuid": "1ce8f6f6-82d8-45d2-9453-2097e75f36f3", "value": 9517614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683180599, "uuid": "58cfc1b8-4b94-4f9e-a775-cf377576c604", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180599, "uuid": "fc01f99c-3bc9-40f4-ac65-81e27f6a2659", "value": "Adobe_Lightroom.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b1f8075-ea53-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683188005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188005, "uuid": "6aedf10e-5d73-413c-bdc4-21d7c6fb3f7f", "comment": "Malware payload (Gafgyt)", "value": "93e2b4c0dcc8718ad30e0fdd8dab714f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188005, "uuid": "4b225a20-7342-49b8-be90-708803eb73e1", "comment": "Malware payload (Gafgyt)", "value": "e2a5d36e953c0baf15ecd68e8c12498afbdafc343b1432319f4b4cb62206d157", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188005, "uuid": "616ce69e-cd1d-434e-be52-b1d33e1b34ae", "comment": "Malware payload (Gafgyt)", "value": "54a7e488f04a16d3611606e9bd65b698988d88cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683188005, "uuid": "73178b8d-a49c-48dd-bfec-f8940d4ff2ac", "comment": "Malware payload (Gafgyt)", "value": "e090390d265fd9afacf7c60975bde4350c9b6fffbcfdc9c1e212d380802a7a5155d22f2ecc5669c69c60afd789bb385c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188005, "uuid": "89f354d7-de60-44b2-9ebd-ed70bac30fb9", "value": "T113733B03771D0B93C59BAEF02DF727F187AAF96112A66580A10EFFC41372AB02515FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188005, "uuid": "fdf2d5a2-05fe-4941-b5eb-1a4f7ecc16fc", "value": "1536:lotQm3qLiuNGOHBIeFaBXzI23mJn2vobXqNaW5ZZz1k8iVmX02q2//8fBgj:lotN6LiuNGOHB4jI23a2Q4ZI/VmX02qG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683188005, "uuid": "79ce6f69-d5db-485b-a977-5653dda8a368", "value": 80349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683188005, "uuid": "2741e383-aa9a-4598-8d73-75b3d43881df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683188005, "uuid": "780806d6-38a0-46b8-9503-83f4f2faba65", "value": "93e2b4c0dcc8718ad30e0fdd8dab714f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b744cfb-eaca-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683239143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683239143, "uuid": "b2c9742a-6428-4edb-8e8d-90091fc75456", "comment": "Malware payload (RedLineStealer)", "value": "d6f8a06c66180234f25e2cdb74499352", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683239143, "uuid": "ab2ae723-5c72-4362-ae76-86aa9b5c0491", "comment": "Malware payload (RedLineStealer)", "value": "e2ddb819e586ad94bd0da533c14aab245aa768be1069392c1090981a1ce9725d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683239143, "uuid": "4b80987f-cb13-4ac1-a5b1-4af70a25f0eb", "comment": "Malware payload (RedLineStealer)", "value": "f35100b45252867034f689da3fd473b06e84d311", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683239143, "uuid": "975d1cf5-5063-46ef-8ca5-e2ad5faade9d", "comment": "Malware payload (RedLineStealer)", "value": "a5147eed2bde60b15a9a42603065e4fda9f89adde641d777c3ef38af41a901f2c6efaad3b6befde5872dfcd0b4299824", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683239143, "uuid": "32313981-735c-4f90-95cd-95fb1e2f5e76", "value": "T13084F142B7D88033D8F017B158F657C30A35BDA19978936B3755AD2A1EB3AD0A53233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683239143, "uuid": "b900581c-3279-4651-a9c8-ac9946eee1f3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683239143, "uuid": "423dc115-b02d-4ccb-83a3-03dc82339342", "value": "12288:uMrby900PBJsli0ywUQ60PRnjhZwkf4C:9yJUzbUWPR1Skfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683239143, "uuid": "0f4b8f1a-1182-4735-9f01-79908ad2627f", "value": 396288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683239143, "uuid": "4634e7ca-a3d2-42bf-9ba0-da151f77a437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683239143, "uuid": "70569ff5-09cd-4b44-98d9-740007949e67", "value": "d6f8a06c66180234f25e2cdb74499352.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77317b13-ea1a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683163490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163490, "uuid": "3e74d214-04b4-4953-9d67-fc6a565d353f", "comment": "Malware payload (RedLineStealer)", "value": "f2e2aae7993db11b00a8e58da58509fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163490, "uuid": "ad00e51b-237b-449a-a701-1b71919a5d5d", "comment": "Malware payload (RedLineStealer)", "value": "e3a5ea3cc18e0f4f9dc77368d883eabeb4427f803fceff24ef9764aab1be14b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163490, "uuid": "b26a23dd-93a0-4d32-9504-8a45b441ad68", "comment": "Malware payload (RedLineStealer)", "value": "7264511130e1560325b9d6a7c39e76ddc8826c85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683163490, "uuid": "00091e02-0219-4570-8889-0863859ce0ed", "comment": "Malware payload (RedLineStealer)", "value": "76120b2e168b0ffc60281067f0e0c74ca39ae9640ea7e0afb11682edef97cf4305dd6b6f724bb1fd5e5dc18bd924ba5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163490, "uuid": "9361b23d-4db2-4284-8ee6-9c4c5388c0f0", "value": "T196452312B7FC9176CA210F3058F717E72F3BBD900A744AAB2789D95A0DB3152A579323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163490, "uuid": "dc6dbd56-4e28-4419-97d7-9500357f4d08", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163490, "uuid": "1e3bde70-0449-49ce-9e1f-6974807a4006", "value": "24576:eyD9FpJKWfjmyKfNDa0bBZlIvPZCbEyx/gpczJr:tDjpKfVaGZEwE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683163490, "uuid": "bea71819-34d2-4541-9295-8a888b428636", "value": 1265152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683163490, "uuid": "b986f443-c91d-4899-9343-3ea32a2ba140", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683163490, "uuid": "fce1ec25-849f-4bf2-a605-ce38d96547e8", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4456e64-ea51-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1683187296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187296, "uuid": "2675c886-bcc8-4933-a00c-22a712970245", "comment": "Malware payload (Gafgyt)", "value": "6d8a8e7ce4e0e093257606999907e479", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187296, "uuid": "9b3bcb87-6241-4ff5-bb52-c4eca8be7eff", "comment": "Malware payload (Gafgyt)", "value": "e3bca3d025054db0adbc5c5b3d204793fb7c0d0dfdc77fed9e03c1a69d688c76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187296, "uuid": "61ac6080-d229-43f1-9670-5c293e808237", "comment": "Malware payload (Gafgyt)", "value": "f2cf04aa6f49c1fef95c513460077426f1098bb5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187296, "uuid": "12a6c96f-9e9b-47b8-8903-04cd5fcd0b88", "comment": "Malware payload (Gafgyt)", "value": "f31c2237708a154de7a133c0c80d8fea4323a2b94f0ca1aba01cdc5ce58af22465c80d151b66fa24363bd74cc508737e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187296, "uuid": "a2d643ba-bf76-4b22-a3c7-0e3edd59352f", "value": "T159833A43A9628FB7C0866AB565F759300753F9110F0F2A9A713DAAF4434F8DEB80E764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187296, "uuid": "1b286fa4-067b-400f-b70d-66ae9bad5670", "value": "1536:1GvTRbSZjar2BKzsUKwL73Zdu5gCg81m1Ql0ciEeGfES4:0ll2IzpL7gg/smql0ciDGfES4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187296, "uuid": "0b889df3-fb97-4275-aa41-6c472139ea45", "value": 85890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187296, "uuid": "8280fc6b-902c-41d2-9a1c-773cc31bf646", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187296, "uuid": "0f59a2cf-c0ce-4b7d-aafa-b13da7da3585", "value": "6d8a8e7ce4e0e093257606999907e479", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eec223f-ea93-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683215311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683215311, "uuid": "60e4499e-1bac-40ae-8591-e6a76e250417", "comment": "Malware payload (Mirai)", "value": "88dc813d22110d41f7b961fbd78e1ea7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683215311, "uuid": "f517b3a9-9453-4530-bef5-6638d2617a79", "comment": "Malware payload (Mirai)", "value": "e4251be2b6d6472a59d97363e419a7781c00883e2625f9f9fbc2b7112f0ef765", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683215311, "uuid": "a6c9b962-2373-472d-b052-6e7ee9f346ef", "comment": "Malware payload (Mirai)", "value": "486f3734e8986e6799cbbe36bcd817c91de464ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683215311, "uuid": "e89b2a0f-a619-4cad-b58e-efa1781eeb33", "comment": "Malware payload (Mirai)", "value": "6a9c59dbd1207af061c610f04e5f561fd3a7ca5551e159da2db209b81fc1007790442d7f55877172262431da86ea4112", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683215311, "uuid": "9d43926f-9733-4747-9c21-d16c7ce1d7d2", "value": "T120835DD5B8018E7CFE57DAF981224B09F52173018FA30F27A6A7FCA76C331999E06945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683215311, "uuid": "7e60b544-a739-42e3-bd6f-d2ff370c6a2c", "value": "1536:Q0/Q2N0qRmnBc570jYcwuXSPkaebpTk3w9VMTmJQplfLpWL87i/T:QQSnBc54j1wwSTadeKEL47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683215311, "uuid": "54b56b93-3f00-4357-9800-f33c221ca418", "value": 83280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683215311, "uuid": "cb0190de-66e6-4707-b7ca-e51695c859fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683215311, "uuid": "99f89301-6bba-454f-89a4-37738519e60a", "value": "88dc813d22110d41f7b961fbd78e1ea7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e09eb0-ea70-11ed-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1683200561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683200561, "uuid": "587598d6-16be-4aa0-8e25-02858aff7c88", "comment": "Malware payload (zgRAT)", "value": "44ac8cbfc40de1c0b56fb73d8671fe3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683200561, "uuid": "1f2756f7-84c0-4f5f-9e07-e6454d73f9d5", "comment": "Malware payload (zgRAT)", "value": "e46d9944b8b136fc836ff5f279fbe17286812468590bd800f1357afe371527d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683200561, "uuid": "6e71efb2-6eeb-467b-b3e0-7b60ff287a18", "comment": "Malware payload (zgRAT)", "value": "953937b371f883bbce2046556094cf9453314d04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683200561, "uuid": "2861c0fe-6a7b-4c8d-addc-b0985503c202", "comment": "Malware payload (zgRAT)", "value": "0bc23a13b2e9a2e7046701f1046f0171d24558949d4efdac34410e9531cdfe52c36e1c0d6cee9dc26e2a2aaace1cca46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683200561, "uuid": "777cb12c-0e75-4666-b4f4-ffda27b25512", "value": "T192C5023227D5BFACF67D0B74F86505481DA0A9AB5068D24C79C824DB4EF6794FC20EB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683200561, "uuid": "9d750350-ff62-4a08-bebf-6077c0f9f192", "value": "24576:rQPrGlJblzsHsG2bk6UvAGRkdRKWEIycOYL32m9q80SE6ObFFL4P3/xljjriEErb:rFJdbk9OG6jBbbEL4X10pwryzM9PF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683200561, "uuid": "aa780592-38e6-4b98-b4a8-5b5e408b757d", "value": 2695680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683200561, "uuid": "68ca9749-cd15-48b4-95ee-b46765f69226", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683200561, "uuid": "4ad28fab-4c37-4992-b380-5e026b17326c", "value": "e46d9944b8b136fc836ff5f279fbe17286812468590bd800f1357afe371527d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56da5c2f-ea4a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683184052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184052, "uuid": "a1815264-a6c7-4045-9b50-c758eca93a0c", "comment": "Malware payload (Mirai)", "value": "4f9f1955ba6b0bd1a0714dc1d952cf5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184052, "uuid": "cc66276c-684b-49dd-9424-dfbd04c5470d", "comment": "Malware payload (Mirai)", "value": "e473604cadb31beded77aa3857afedecb4abf20027613252a47cae74b12a1cb9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184052, "uuid": "63e88378-6eca-41b7-97cd-b402830885ef", "comment": "Malware payload (Mirai)", "value": "05d896601d58964e3bc17316f5350c2560c0dbec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184052, "uuid": "ff22f894-cedd-4d57-9fb8-04dfd9743614", "comment": "Malware payload (Mirai)", "value": "f2bb91117ab23a3e0c950998a8eee6b0ac98e910ff1230d2712e3468e44698608dc46cb25309cebc2b7644bebe224eed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184052, "uuid": "a4dfa27a-f4ae-46a0-a6d5-fc168145847b", "value": "T1FAF32906F4104663C1C21BB6769B524D77235FB997CB33129A287EB02FE179E1A3ADD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184052, "uuid": "5322ecc3-9cd9-4eff-838d-c4a95c223e7f", "value": "3072:s/dTNHLiGumQIsXrRVTaVg12Hm8tnetJ8au49QuhsriOEMlDRmyEQ0v8XEtB:nXrRZamwtnetJ8au4lWiO/VRmyEQ0vyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683184052, "uuid": "d7595603-2c4f-4768-a379-8705e1d9d6e2", "value": 158417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683184052, "uuid": "8db0373d-f5d0-43d2-8af7-2643eee9c9e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184052, "uuid": "d2e33757-e392-48fc-b05d-0f7df254b0cb", "value": "4f9f1955ba6b0bd1a0714dc1d952cf5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359652fd-ea50-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683186573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186573, "uuid": "0f8b80d3-4f43-4e52-afdd-04fe7d901a5f", "comment": "Malware payload (Mirai)", "value": "4564b427af3af04d6c55d7427f523cc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186573, "uuid": "adaf28c6-4191-4bfd-85e6-05c8e829b2a9", "comment": "Malware payload (Mirai)", "value": "e501acacf65dbb020d0a48255bba252b6a05f70a45676b5d7eab535723e67d9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186573, "uuid": "00613a5c-ae33-4045-afb5-a68a82a93abf", "comment": "Malware payload (Mirai)", "value": "05c1c5e16547f18f842766f740019e58d99a869c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683186573, "uuid": "7723a510-e155-442a-bb96-ac6487e59eec", "comment": "Malware payload (Mirai)", "value": "3fbbb0908e3d6f7191b551e10f952a27664b7bf1ebfabd00922ea5a55035f17369bf227c29d2d692cc0e8fca4643364f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186573, "uuid": "d45b761a-9c6b-4eac-ac39-f9adb77d053b", "value": "T1D493C519BB511FF7D89FDD3746AC0B02388C958622A93BB67574D828F24B24F15E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186573, "uuid": "781f1d24-679a-4128-a430-30bfe0b71966", "value": "1536:NUYH24GHWD+hBmqG3N4SfxMW4ZXH1RQVkwJpwbZnL:NUYHTG7G4SfeW4RIpwbZnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683186573, "uuid": "a8d566ed-f804-4354-8e2e-fc00f9adb9ec", "value": 88844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683186573, "uuid": "0151dc35-6228-45de-9ee9-affcba8b2131", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683186573, "uuid": "a9373abd-19f8-4d55-9182-0344c73d7560", "value": "4564b427af3af04d6c55d7427f523cc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7843fb3-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683194146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194146, "uuid": "22958266-aad3-415a-9b4e-dc85bd5fcc6d", "comment": "Malware payload", "value": "3054d4bdfa5978d87fbd3c345f46a428", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194146, "uuid": "734884ce-813b-4141-a5ec-09ddb81483d0", "comment": "Malware payload", "value": "e656bc74b78247d46ed96444bb80ea80e7679b6f4471a8a25bc7fb16c2c3d98b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194146, "uuid": "442b155a-1f25-4986-9db2-2b11697b2739", "comment": "Malware payload", "value": "372498bdc6ee70248ef567f1fe3365fdbe2fb027", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194146, "uuid": "961dc2ea-c6b6-497c-9df5-99f110ac38d1", "comment": "Malware payload", "value": "6b60fac405c0cc218c56ba8fb99119d85273791f10b4029860e4e97263c4e89fb28a64ee1968fa76f3c35fe7dc33583a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194146, "uuid": "25678426-d6d8-4a8a-a923-8a31335dfd58", "value": "T177F2F1958F03A5C2F2EC67B2C901BDB6C186721B7C3C5027264BBF93B6091678B16D74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194146, "uuid": "8f8c604d-03d7-416e-90bb-25516a6966e1", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194146, "uuid": "946b18e5-4e08-4483-bb96-5c3e8ee31426", "value": "768:J85U0gMT9OxtWZ+vvXlDEK79KBrrqCqdOgISpaj0kolWD0eQ:B0geEO+vvVDEK79KBrGFdqeaj0r7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194146, "uuid": "dffc2216-b6ac-4088-a76d-282becad59f6", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194146, "uuid": "0d3cc14e-d9a3-41dc-bee4-e653086a4776", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194146, "uuid": "6f85f963-7042-4501-be24-f5aead87bb69", "value": "SecuriteInfo.com.Trojan.Click2.30899.27256.16102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc3506f-ea96-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683216943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683216943, "uuid": "82e52c19-543b-4352-b6d1-3647597e8b2a", "comment": "Malware payload (RedLineStealer)", "value": "7762e8d3d9dcc61e03338faa448cf6ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683216943, "uuid": "3123d4b5-97bd-4158-a6d3-52ef752c7029", "comment": "Malware payload (RedLineStealer)", "value": "e6c6e37ac27977cdf1590079f10b95984b6ee342a92b3960987cd0a35b4f5c69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683216943, "uuid": "f0acf791-54d4-49ae-a22d-09959964ffa4", "comment": "Malware payload (RedLineStealer)", "value": "22d39f6eef4a76a2b838281e497d3129a2e954ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683216943, "uuid": "a24345b5-27bd-4ec3-a4f0-1eff08b05d3f", "comment": "Malware payload (RedLineStealer)", "value": "31d5201fbba3abcee4bad9bb3f0bbd44b34521dde8988f9f4bed4767b3c7cceb9da450404220fc3205ea70b574f114c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683216943, "uuid": "8c401776-562f-4a59-9cb6-0f7d71f46fdb", "value": "T1C6752397AFDC89A3E4B45BF0C8FB13830B24BD909838435B67C1994A4D73A5295317BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683216943, "uuid": "8397122d-f61b-45b6-8996-cb28de5630c7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683216943, "uuid": "5ef18df9-d854-41d6-8ff6-0d79dc2dadfc", "value": "24576:eyXavO/m8SOJkcuY5I3bMLmXU9/kRBxQpKWRNTYU7ToC3Yd7xuAl:tqkm8SOSPg79aQvx7ToCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683216943, "uuid": "5fad296e-c681-4df2-8df3-293c0aa8fa08", "value": 1620480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683216943, "uuid": "ef2050b6-6956-47a0-92a8-c87c53840405", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683216943, "uuid": "30287468-5d08-4e20-a344-20dbc04cfc43", "value": "7762e8d3d9dcc61e03338faa448cf6ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e96ae983-eac9-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1683238844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683238844, "uuid": "d635360a-3963-47ea-b0f7-04840eae340a", "comment": "Malware payload (Stealc)", "value": "b1ad31ae4a2c2d6e9708ba8c85c9689b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683238844, "uuid": "e45ee8a2-2358-417f-8ab4-d1d345325152", "comment": "Malware payload (Stealc)", "value": "e6c84d3d6e9e0e0b49c37850a98d08787a84687eb83a8ee035db5ba65d8eda2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683238844, "uuid": "d1f40513-bb3d-45a0-ac23-8318bab7a03e", "comment": "Malware payload (Stealc)", "value": "c746b45164cbd65587e04c82cf2013e773ac3612", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683238844, "uuid": "230bea7a-ceed-48ce-9c6b-a472a5323702", "comment": "Malware payload (Stealc)", "value": "d9ac8020ba3e6ebdc54776388ae2b617ba2b995847af164c8624a3bfe105ceba1fab61eef3626eeab9d7a126564d4aef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683238844, "uuid": "1fa2fa30-5ecb-436e-aa67-b67c9521f12c", "value": "T17CA59349B2E0D8A5D9A8437733ABCA55D025FD3A3F56D40BBB99C71B1A300CA891DF13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683238844, "uuid": "091cf7ba-3695-43eb-9d0f-5d4b39aeac5d", "value": "9cfb514da54ac2b95223b80c0c809e08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683238844, "uuid": "7d743f35-8eb4-4d3e-9e5d-20711cbe590b", "value": "49152:4sehXhWBWyS58cODVC7U4ZytacVXBvoWJI:5cO6A1XloWJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683238844, "uuid": "cab42266-4bd9-41fc-84da-aaff280bf75e", "value": 2215928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683238844, "uuid": "0a6f8e5e-52a1-40ef-8c20-f6e9823793ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683238844, "uuid": "5f0d6246-5d59-44fa-9bff-0604afa8e6d6", "value": "b1ad31ae4a2c2d6e9708ba8c85c9689b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f1a644-ea76-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683202811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202811, "uuid": "a6fb81be-243e-4a0b-9dbb-f60b8a70461b", "comment": "Malware payload", "value": "b0ade3796b32d251f5e93e7fe3095f63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202811, "uuid": "d0df95dc-06de-4c0f-9b26-316cc30c275a", "comment": "Malware payload", "value": "e6d5b24389a95db6a48e8a894a349cadb0b2856344542000061f826ca64f8e32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202811, "uuid": "973723aa-d7d5-4d51-b8c9-29d93fc3cf30", "comment": "Malware payload", "value": "b4bd4bef21bb909e68a67a8c4bd383517ac95cf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683202811, "uuid": "cf1ee05c-7dd7-4a16-aeff-a8715630fe7c", "comment": "Malware payload", "value": "1f1ee44b61d6df2c9db364b27606d1720d70976be12472e5c28b69ea55b78e088ff304a08f5088c095aae023a0f97b37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202811, "uuid": "c72bf74f-a5ca-4b9e-ac8d-22684ff154ba", "value": "T16A347D9EE586101BFD73D8B07ADC6E51DAA30C9C87BBCEF604C91C706A7585B982A443", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202811, "uuid": "a13536cb-085f-480f-b4a7-fb1d93c5983e", "value": "071307373db47402e881a4d65e0a19ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202811, "uuid": "45677754-0f70-4e34-91f8-035c3bb953f2", "value": "3072:d+f/5Iq2MLrP2w7C9oG9JUpqNw5ZErW+sFPT4k54peeIEctHEu4Plw6hkjnn7/pR:wmOKGeI3D6hkjjzOiCDRYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683202811, "uuid": "7c049d79-60df-4971-93ba-c7203a3eca5a", "value": 240992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683202811, "uuid": "2328c20b-269b-46e7-8195-1cf03086467d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683202811, "uuid": "5c7f9312-80cd-4403-b34f-f6b420bbfeae", "value": "e6d5b24389a95db6a48e8a894a349cadb0b2856344542000061f826ca64f8e32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b2ae8b-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683194162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194162, "uuid": "9cdf0d16-a5b2-42f3-b312-cf8be4acbbdd", "comment": "Malware payload", "value": "e81a0c2f2d95cb9f9d414bdeccb1363e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194162, "uuid": "09d04614-f6bd-4918-8276-c5388a189ff9", "comment": "Malware payload", "value": "e753b9f3346f5da38540e4e3888339455b7e134f3b52f212f0b563e38a2dc358", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194162, "uuid": "2114720c-d468-4ec6-8f16-5a8d77ca3ae5", "comment": "Malware payload", "value": "e363183461197c2934cc2f503371627a50e55a28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194162, "uuid": "4ea22d21-e51a-44c1-9075-cfc6c317011e", "comment": "Malware payload", "value": "7c40ee06ee11db84b59ae0d95775afa79d0af93751f9c999617d7d036c4904ee4ebd753e7c226a915cd746597d86d694", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194162, "uuid": "07c8fbce-e625-493b-93e1-492a919f7081", "value": "T12253027E048AC73AD68AB975A2713C7400483AD8257A234B51A3575D8F31CF7B4EB631", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194162, "uuid": "532fc3fd-b461-4f0b-a033-18935eff1002", "value": "87bed5a7cba00c7e1f4015f1bdae2183", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194162, "uuid": "556f647f-7227-434d-b7b5-8a8eb644ca13", "value": "1536:uMJXocvaMyiuIpnPrgOqcWis5DMrSJCfn/zQdXx:TtocSAz6bcD6IrSJG/8dh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194162, "uuid": "0628fffa-0f0b-4fde-9843-568b1582c0e2", "value": 61440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194162, "uuid": "684a6685-a8ba-491b-908f-e19fba3bf238", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194162, "uuid": "5a86b8e6-9436-4796-9c06-7af2732f11f3", "value": "SecuriteInfo.com.Packer.Krucky.B.deW@aOOjkO.13798.1009", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6540e992-ea6e-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683199538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199538, "uuid": "81834854-a4e2-4c39-95a4-e91132ab7357", "comment": "Malware payload (Amadey)", "value": "0855d1b22a0ae9861bee2b4416642568", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199538, "uuid": "55ef28f6-add0-4dfc-89ae-8f1576088425", "comment": "Malware payload (Amadey)", "value": "e786ec3a804265639f5ec8ae41f22ee2fc06c247ef3c0414a75b9c3dc82de8da", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199538, "uuid": "fa2cea11-1488-4b90-be03-4797d1868f15", "comment": "Malware payload (Amadey)", "value": "19c76c2c27e213b41c40cada5676ce85cf968dd9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683199538, "uuid": "e85aa9c5-90b1-4a73-9f7d-9aa74b230c6f", "comment": "Malware payload (Amadey)", "value": "57e3137c2cb4c3774bbe32d661996b48d65c10494901e77d24c824deadd9132f9121f0dd13aab29e88ca060f037d7b39", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199538, "uuid": "e543c25e-9400-4c63-8f21-357b9f3ff39d", "value": "T114752367BAC41063DC741F3010F202D31A37BD924DF8D2963752DE491EB2999ED72BAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199538, "uuid": "53141414-6dab-4df5-8850-f9a2e2ccdc62", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199538, "uuid": "a788dc9d-cd74-4648-9d01-9f21dbc57b1e", "value": "24576:Aybp2ZU6ihzoZ6Qk1kI485uuqbNcPZfMASstF+i2HfTLroeHLnyL+l9Pssurrca:HWCcZpk+ITo7ASWwH77HLi+P0sWrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683199538, "uuid": "4193500a-25e6-4af1-8903-995aadee7f1f", "value": 1622528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683199538, "uuid": "8593221d-8daa-41bf-b644-6d185187de3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683199538, "uuid": "d4737104-e1c8-4461-b7c5-4192c296619c", "value": "0855d1b22a0ae9861bee2b4416642568.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21608df-ea76-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683203183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683203183, "uuid": "eb226295-428c-4deb-a455-7cdec37b0918", "comment": "Malware payload (AgentTesla)", "value": "66848e333b46595ce8f97baddd978702", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683203183, "uuid": "8362fffc-74a7-459b-af89-317e1c031933", "comment": "Malware payload (AgentTesla)", "value": "e7e0689ace455992d052b1c39c3edb903bc4477358f4ecb8fb0fff62f8d2561e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683203183, "uuid": "5ddab090-9716-4dcc-8837-36266b51b772", "comment": "Malware payload (AgentTesla)", "value": "d209422df0f144b456596ff6f4fd54a27bbdd551", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683203183, "uuid": "377f71b3-ce5d-4f4f-8846-d9b03fbf4bdd", "comment": "Malware payload (AgentTesla)", "value": "a6e3b031fca377c378d513b31bf015df3ba483c40fb1f64577f44e0eb967ef44332ac8ea83eb3eeb9d7c9dfad744be61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683203183, "uuid": "dfd04451-fdef-43fc-95a4-f66da0ce7592", "value": "T119C47B3C59BA5627C076C3798BD09823F1A09D6B7012EEA954D733B64713B8639C327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683203183, "uuid": "498ee077-13d5-4389-9af6-fad9a02da6d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683203183, "uuid": "bf056179-6696-4d7d-b698-ef408c2302ce", "value": "12288:Mb0zKqnAo31ZB1SyvCeLXa0zwvjre3sk:Mb0pn5QeLFwre3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683203183, "uuid": "ce15e25b-e266-43cb-9117-217d346f9ea7", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683203183, "uuid": "d2cff09c-40c4-4ef2-81cc-e0c2ad66729c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683203183, "uuid": "e734e66b-79f6-4f58-bf19-78300674b88f", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ace8a6-ea4a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683184045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184045, "uuid": "f52cdb70-51ac-4d8b-a898-6d4b57bc24f1", "comment": "Malware payload (Mirai)", "value": "a117c8b0fd18d65b77d24f345a1e8cbc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184045, "uuid": "66817b8b-9724-4d04-abc3-c99409cb59cf", "comment": "Malware payload (Mirai)", "value": "e8ebb013aa66d88bf5ac722dfec5631379b1962a3dd4d236c5ee2fa2e3128309", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184045, "uuid": "a95e9d3f-d689-48bf-a193-f706da9d8e87", "comment": "Malware payload (Mirai)", "value": "6a8b3bbc28f68e0df91f7c546ceb5a5866e0a0f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683184045, "uuid": "a263bf67-1660-441c-b7de-c344b7d5ba65", "comment": "Malware payload (Mirai)", "value": "f7a3703b3532a11a4dfaab50524bd3a192988ab857ce9b10c0b970d7d9c4d8ab2b62b4eeb0133626fb493d0f10b062f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184045, "uuid": "1c58d1e6-54ae-42b3-8f66-4e23eb83d0a7", "value": "T1D9C32BC7D502C5B3D4020AB2129B765A4922BF7B4D6B5AE6F71D3CB09F3188A3225FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184045, "uuid": "aa9873eb-6e68-41b3-ad24-b72ed1652f44", "value": "3072:lGR1eOtJ8AAWS8oJMetJ8au49QuTsSk0n8+E+gXBtcZkG7gyqc:loyxIoJMetJ8au4llk084gXBtcZn7gyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683184045, "uuid": "8948bd4d-f589-43c4-8e98-dfbf6aa9f660", "value": 119678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683184045, "uuid": "2496a625-032a-483a-b5db-beb9a89abb81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683184045, "uuid": "65bcd497-2379-4d73-8792-b29c77ba8d45", "value": "a117c8b0fd18d65b77d24f345a1e8cbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f75b254e-ea6a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1683198065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198065, "uuid": "5be84b87-30cb-4eab-83ff-76aba024ca39", "comment": "Malware payload (DarkCloud)", "value": "749fbecc35eaf48f1838f0f75c796553", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198065, "uuid": "a1615d06-4ec8-4f83-92a3-deb4ee9a0b77", "comment": "Malware payload (DarkCloud)", "value": "ea391bb21dacbc708f1c74a5354ded7b67459249a0dbab512fe1f82568d77f0e", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198065, "uuid": "a14e267f-a6c4-417a-b5db-6728269ea4fc", "comment": "Malware payload (DarkCloud)", "value": "3a2dfce8a7268b048f2a45cf539da9cd8f735b02", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198065, "uuid": "ce56c5b7-8801-49d4-9336-73209f38ff89", "comment": "Malware payload (DarkCloud)", "value": "feb6d3badb1d8eaaa93c00d8dc4ef4e973653d45bd15891ffaf7a60308e1c483883aba9f99156bdce60695c2cbb18bcd", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198065, "uuid": "119fb326-3fc6-4bd9-9856-129ce5846f50", "value": "T1A7A42B16EA21B13AF85785703965963B68186D376144AC2FF7819F8E30326DBD1F232F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198065, "uuid": "f814f65d-dc08-4e96-b5c5-93a49e6f5a51", "value": "2e44c023e945de76a75be81353118438", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198065, "uuid": "1127d095-efeb-41a7-8ac0-6dcfe98e9bcf", "value": "12288:BH2PRDZt5RI8ZxU89C6sWr8i6jYKkJj6GmZU:BH25PZxL9C6pr8DYb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683198065, "uuid": "130eed2d-ff0a-49e3-8c03-508bce2db8aa", "value": 465920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683198065, "uuid": "29447464-c3cc-4712-a1e1-0089439a4b97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198065, "uuid": "a8ebe47b-7dfd-4b8a-a5ae-1d6143158c32", "value": "ea391bb21dacbc708f1c74a5354ded7b67459249a0dbab512fe1f82568d77f0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54168ed3-ea40-11ed-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1683179752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683179752, "uuid": "3bb17802-a7a6-47cd-81b6-b5a9d030a927", "comment": "Malware payload (SnakeKeylogger)", "value": "9b524c236139e203399b9bf4d05e194a", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683179752, "uuid": "a4aff744-821f-474e-a24e-fcbb56f53e9c", "comment": "Malware payload (SnakeKeylogger)", "value": "ebb2b819aae0d371b1c0d006cdc37ce9b9e2171d265a08b3121e5abb62e0dc6f", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683179752, "uuid": "bdb7ed6d-1c81-4c34-8e95-f377c5b7e293", "comment": "Malware payload (SnakeKeylogger)", "value": "22ff0f652b794357b5d1e92768fe9092d00cdd3a", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683179752, "uuid": "ad527505-26c3-4a57-aca3-95805725cf91", "comment": "Malware payload (SnakeKeylogger)", "value": "6f30f8c76e65ebd493cf88b541dc56aae60bbfad193a03c9ea82397689e3fa42ae96bb9c84db86306be197e4a5dd5023", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683179752, "uuid": "b54995a8-9e1a-4487-befe-2bcaf0fc324a", "value": "T1BBC423432C54E8F55B69FFF00AE4B0B5EEC0D9B2588EB7975E983109A9D16CD02E811F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683179752, "uuid": "af8f7be1-0d9d-4827-820b-38bd7c1bb0dd", "value": "12288:k2Urmubbi6GaA83RXTZI4y6OHquvnr/GbvQzTok0SzYj4X:IyBgXTKTMuvnrujYUhKCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683179752, "uuid": "bd470a6e-d205-417c-9729-e89142a53183", "value": 549932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683179752, "uuid": "4748e895-d4a2-4f4d-85e8-7aad897d1ed5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683179752, "uuid": "8a35a8cb-7dfd-409f-a279-e4f800314269", "value": "payment copy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3786e58-ea68-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1683197173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197173, "uuid": "252b4393-92e7-477d-8ae1-e6fbef639ee3", "comment": "Malware payload (Smoke Loader)", "value": "1f4f6532a2563f5d19e437023a3f151f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197173, "uuid": "1452d8fd-38a8-4be4-9535-4e6f16cc2e78", "comment": "Malware payload (Smoke Loader)", "value": "ebd2176450ac8c951f6c881da6403fb727bc9ddeee28f0dc5a5a2c9bfa8c7621", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197173, "uuid": "872ff8e3-febb-43ef-b1d4-f52a2e7ed0b3", "comment": "Malware payload (Smoke Loader)", "value": "d16a608ad45eea137c10b3c80570c236460e3714", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683197173, "uuid": "05831e18-c27f-4002-bb03-37e5e874ad37", "comment": "Malware payload (Smoke Loader)", "value": "eeec6066e889f9fb62923f79fc342d6eafdeffba890f7af472933ddae91006d3cb466fd9fe31c6f14020a91bc3e66858", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197173, "uuid": "a8648db8-bc99-4094-8ac6-5ba05c17303e", "value": "T1E1640A1342E13C98F9264B739E2EC6EC770EF2508F59776922299E1F04B12B2D173B95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197173, "uuid": "56e788f5-7b17-4360-9520-38c6153e26de", "value": "0133aea8f8bab386500d52ab90bb0567", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197173, "uuid": "ba97a4d5-8a3f-43f4-b3b9-d3fa544004fa", "value": "3072:dU/eJ4t0yWgGuuV48PmGh2ud9iwaHmohcqN6W5Rk4UMb1x/htE7:u/enI1u3mG2IiwaH/6C3jRt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683197173, "uuid": "4e1ecca1-301d-4914-ac8f-a3f3750d9c55", "value": 326656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683197173, "uuid": "d3fdae51-ce62-4f0b-80be-8d3035f801b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683197173, "uuid": "231d1ff6-cdfe-4f20-b7d8-d4b3807c25ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec8fe74-ea83-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683208493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208493, "uuid": "e354f9c9-1009-4bda-9dd7-fe6d337d2867", "comment": "Malware payload", "value": "2e5428a15a37026ad74f3bf13f15ce40", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208493, "uuid": "e260717e-a910-4fb4-9370-f4150332110a", "comment": "Malware payload", "value": "ec0f998453e3125596d9907d4e5fdfc367ddee82239fadc50a7c67ed1cad4c64", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208493, "uuid": "eb647f80-53c8-44f6-8afc-415beb2a5429", "comment": "Malware payload", "value": "f97238cfc6bf1c84ae8d69df7ca5461bb764460c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208493, "uuid": "21659182-8391-4ede-9f13-9590d90aaf2f", "comment": "Malware payload", "value": "ace19120722054543a6c4c0d5d558e019b1adffec85cb3cb88f1be17de2f6667df955f20a0bea606754055e4a238664a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208493, "uuid": "98c03729-ed7d-4f24-8fe4-5c41549058d7", "value": "T1F21533D4486F024DC7ACCD3BE1ED1B268960756E59390F2E9720F7E9F1DD21826C13AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208493, "uuid": "2cd68de9-501e-40d5-a57a-47f64cd1448e", "value": "12288:70CxAvsDoysUIRudr2mFsBoI+MAgQCeAwcdpc3BnVmtflCXKaK8UAoiDAVth:wGhWUI8didBoI7MUETwAKapoPjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683208493, "uuid": "822d7d62-6c80-4978-9dea-43a3ff82400f", "value": 917644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683208493, "uuid": "4789540a-617d-4f4c-8cec-f69ba6be9193", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208493, "uuid": "98c1f6e6-54d9-45ff-a2b4-b865a53c464c", "value": "RFQ #NCG23MC2125.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b616d50-ea52-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683187361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187361, "uuid": "4f964a45-bff9-4e6d-ade3-637b14eb42bb", "comment": "Malware payload (Mirai)", "value": "54526259d4bbb0476af8989e4123c4f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187361, "uuid": "63f1eb0d-b864-4d51-b88d-56dfbccedb30", "comment": "Malware payload (Mirai)", "value": "ec48056b649593e673b23d58aa897b029751c34352abd0a777dc5f0e9ff2b123", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187361, "uuid": "e64cd8e4-2ed2-453c-846f-a2822229ab95", "comment": "Malware payload (Mirai)", "value": "15c8d0ca4f781803933fe27a3cd05233974a3695", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187361, "uuid": "df10e97f-f836-4ad2-907f-841b99305527", "comment": "Malware payload (Mirai)", "value": "2c61600febdec065e4b1562879a120f6653fab18f67f024d0ff639b17b19aa673e5cb10b9a6cdc5187fefe3050ad2d35", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187361, "uuid": "649c99b6-9aff-4b85-a836-625161e6d8be", "value": "T1FF632902B3080D03D1A71EB02A3F1BD1B7AAD9C123F4F685695FAB96C675D334585EE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187361, "uuid": "b97b564c-587b-4950-ad08-687aa603ae0e", "value": "1536:gAEqb3J7YwfJlWCPK9ENDgO/vjjwbZnlRP:Qqb3hBK9ENDg0jjwbZnlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187361, "uuid": "382f7ea7-7eba-4236-9e19-ba30af3e0b64", "value": 66972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187361, "uuid": "93fcfe75-7d90-4419-9fbc-ba80742034e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187361, "uuid": "eaac5520-a607-498e-b96e-8e814ea84b4e", "value": "54526259d4bbb0476af8989e4123c4f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b9629c9-ea59-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683190556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190556, "uuid": "5f1b6cc2-6cc0-4a22-8e12-49d4d66a892a", "comment": "Malware payload", "value": "8d4b311ba61c100b46427d78e4e54a79", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190556, "uuid": "c5429c71-1204-4489-877b-b134dce0ede1", "comment": "Malware payload", "value": "ece1909e476b02900396b3bd0c92545bef54f4602144bbd1e4cf547a7b348863", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190556, "uuid": "6babbac0-1bb6-4af1-8952-bb430beb9d48", "comment": "Malware payload", "value": "decbb19595e4bfa2cbd49f84215bc58589faf92c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683190556, "uuid": "f04f5c76-2de7-4a3e-a885-23b4c266fb55", "comment": "Malware payload", "value": "39ad453c4c72091a15b2c594c2847be9f4be3948f9f7c6b7fabb30b431294d2097b6f9393fc6f3049a6fa53523098067", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190556, "uuid": "27aa5d08-6743-49f6-966c-c74e34cbd81a", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190556, "uuid": "c2589682-0b03-4b74-a39d-03b506627526", "value": "3::", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683190556, "uuid": "d8712373-1f3e-4769-a7da-1dd2ccd516ec", "value": 264498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683190556, "uuid": "7c27c537-31e0-40e4-8448-b440cea74a4d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683190556, "uuid": "ddb77772-9394-42f1-80c7-bda124d22f7c", "value": "46200150.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3c7168-eac3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683236136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683236136, "uuid": "ab02b734-7bfe-47b7-a1ce-a9fc72ae8b8e", "comment": "Malware payload (RedLineStealer)", "value": "cdcc66ccb840b58907f4973ac24753ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683236136, "uuid": "c042428d-ea27-415a-b114-eee65ebe9e6d", "comment": "Malware payload (RedLineStealer)", "value": "eea5f4e5d29e2398e02ff6445a310dc8907eb17b2572fa4b1f23b781b0e02dd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683236136, "uuid": "d23deab1-19b3-4a33-b799-69e0c605dff9", "comment": "Malware payload (RedLineStealer)", "value": "8a6419c8d87318fb4aea07ec70ac67b113a64b41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683236136, "uuid": "42b92369-0ad8-4de3-a82b-b42f25d6ecf0", "comment": "Malware payload (RedLineStealer)", "value": "c65ae47c3747bb50e278419d757254d05c600e4ec8a449d04c2c66b2e9792afb4a7c11cae19fa59a20f63cc886849b79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683236136, "uuid": "92746210-536d-4aa8-8036-d4aac1bf55e3", "value": "T175840102E7D89033DCF5277058F703931A32BCA25D78975E7785A89E5CB2A80A436777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683236136, "uuid": "aaedb294-ead4-4ed3-aaa4-cd86adad3d81", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683236136, "uuid": "0fee6590-f599-4006-89d9-1d2325779107", "value": "6144:Kiy+bnr+Np0yN90QE2LU6Wvry/BQ1k4z6eAQICTXAR0+ayX5UMfKHb:uMrJy900LTWvroPdePICT41azHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683236136, "uuid": "91a0ab75-8b48-48a9-993f-27a1caa032d6", "value": 396288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683236136, "uuid": "92a2bfcd-d1b7-4215-8d04-67760e79c63b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683236136, "uuid": "fcca5b9f-f32a-41d3-8909-a6de4004a885", "value": "cdcc66ccb840b58907f4973ac24753ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e9fd7a7-ea97-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683217244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683217244, "uuid": "90a88d37-55ae-494b-906d-c89a49329bad", "comment": "Malware payload (RedLineStealer)", "value": "8bbb41df39a0fb84c4065fe92ce5a775", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683217244, "uuid": "2d68e536-2e8a-4fd2-920f-2795bee5a227", "comment": "Malware payload (RedLineStealer)", "value": "eec9de4b2039ec5f5e3ebbdefcd7a5ac088bdcdabe4140dc1f1d5031debf4229", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683217244, "uuid": "1f0d6ecb-d39d-473c-9809-25df36d0c0ca", "comment": "Malware payload (RedLineStealer)", "value": "55a05161c5f3ec28e77f7fee19cfe38ccd685e7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683217244, "uuid": "064420d6-086b-4a10-a460-a068ce2bbf6e", "comment": "Malware payload (RedLineStealer)", "value": "8a09c51007df1440e950b4691a4ba4ec120b671da9d0ff5c55d7786ccc0a33795cd4d570de35a0c5f7c6a86a984c748e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683217244, "uuid": "f3af2bd2-c9e4-4334-8ac9-629013b9eb32", "value": "T1C5352392EBE81536E8B51BB19CEB02931B357CD14838434F654DBA0A0C736C5A479BBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683217244, "uuid": "43b79685-f72e-408d-82c5-4badd03cf65c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683217244, "uuid": "389b0bfe-f30a-402e-a64f-e5a8906e5046", "value": "24576:byN4qwBbVOp0wwIfEEAW5FEIhwxYTFBDyNBH4jrr:ON4n5eVwK3AW5FEIhRFBDyv4jr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683217244, "uuid": "809adc64-380e-491b-9403-47560678fde6", "value": 1123840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683217244, "uuid": "3f7a7097-a3d9-488f-9aed-af02d28dd518", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683217244, "uuid": "519375cd-fa10-4a93-a20a-1670c444875c", "value": "8bbb41df39a0fb84c4065fe92ce5a775.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b2be7c-ea64-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1683195214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195214, "uuid": "01ab22d7-934f-454c-86b8-366a363fdefa", "comment": "Malware payload (Quakbot)", "value": "52d96ebabe2bc08cb504f4b7b29b5f65", "object_relation": "md5", "Tag": [ { "name": "1683182516", "colour": "#CCA21F", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195214, "uuid": "9d903a46-10f7-4862-a840-b05eb4f763b6", "comment": "Malware payload (Quakbot)", "value": "ef023b0a3aa55f424298cb1f64a496392c61c02b8167b04feedc7cc31d123f2b", "object_relation": "sha256", "Tag": [ { "name": "1683182516", "colour": "#CCA21F", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195214, "uuid": "ebc9501c-538d-4714-8f27-f47111ffb7a5", "comment": "Malware payload (Quakbot)", "value": "a609c8c0fbd4867421d65fa79834c3527cbb7690", "object_relation": "sha1", "Tag": [ { "name": "1683182516", "colour": "#CCA21F", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195214, "uuid": "1d757ce6-7b4d-4094-aabd-7aca07fc5648", "comment": "Malware payload (Quakbot)", "value": "16fda7605a3c611ef25bd96aca95aea3eb4c6116e7727647181a083b937735659f2d63e9d0e8514a108078e2adb4e044", "object_relation": "sha3-384", "Tag": [ { "name": "1683182516", "colour": "#CCA21F", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195214, "uuid": "054769a8-c0c2-4394-9955-c57bd5c638ed", "value": "T185430C804B511669AB3BBD22BB247771F6A41A31C390874BF4AF736563CE91CDCE05B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195214, "uuid": "21e5e741-bcea-4bda-b552-b59fc36897d4", "value": "768:VyMNhRhlTosj7PJMenmwELqOttPki0P9B9VosNMaEiGHGr6kQ7Ig1KzHyyLdSmKl:fUsZnwGGkQ7A0xherXT4EANnOvwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683195214, "uuid": "d06fe76c-201b-4d85-ba19-f7f573dd4ee7", "value": 59373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683195214, "uuid": "3f8b9b46-bf65-44fe-b2b1-332691ddaae9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195214, "uuid": "d7463e91-dd91-428c-82d1-dacc72d3975b", "value": "B.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f29e05c-ea43-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683180979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180979, "uuid": "31ecd1f3-883b-4637-8a9c-09041f05b188", "comment": "Malware payload (RedLineStealer)", "value": "ddc9d943b2293245d5300d8473c3be16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180979, "uuid": "a718279a-fe2e-4675-a535-a4c3cf86b27d", "comment": "Malware payload (RedLineStealer)", "value": "ef236f863f1b753ae043e1d863cac676c169ebba141f568f0d9875c458a37bf0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180979, "uuid": "20e0f694-a494-41b6-b6ef-c6a644eab036", "comment": "Malware payload (RedLineStealer)", "value": "ea25e2d78f7c97d6afb49ba252f223d9da9726c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180979, "uuid": "9d4fb339-2cba-4be0-a19f-37ba8cf2a50a", "comment": "Malware payload (RedLineStealer)", "value": "38468693b4383de323468b350ffbd97deeb0b538354fa317e9437a154e3dc933b1f2350d98d169f3dd5aa1b4851a801a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180979, "uuid": "b511a1a1-3ca5-4a15-b3ef-a56f8319aad7", "value": "T1D0A40216BBE48073DCB5277058FB07930B35BCA2597883272741A96A4DB3BC5B432767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180979, "uuid": "ed664af3-431c-454e-a2e7-644036359667", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180979, "uuid": "d4e1cef4-2f25-4ca2-9266-39346ad3ca21", "value": "12288:uMray90hFMLfKOXbXDs5fADQ2zW0EMaCHrtC6:AyoFyKQXg5fOQ2zDtLtC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683180979, "uuid": "3cb0e0ba-8764-41dd-be06-69cd312780b7", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683180979, "uuid": "8e19b379-214c-4f0f-8d32-023673ce3109", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180979, "uuid": "03e0bb0c-73e4-427a-9e69-edce7cbccdbc", "value": "ddc9d943b2293245d5300d8473c3be16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79483de9-ea53-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683187975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187975, "uuid": "4c0984ea-c7b6-4673-80ea-01624fb38f1b", "comment": "Malware payload (Mirai)", "value": "e921c9f7487b5f34ba9871a9684efa1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187975, "uuid": "ea1b6b2b-2f9f-4f9c-8d66-5649791b7bc1", "comment": "Malware payload (Mirai)", "value": "efaeb67f8c72e68b7d12d6ba6f806f9e8a928a2d7242ba8dc5f2097dc6837214", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187975, "uuid": "29ca877e-664b-4722-9a92-0123636a87cd", "comment": "Malware payload (Mirai)", "value": "1e44704a705e79ea86726270a2427e29a1ac70ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187975, "uuid": "d6e6a8ce-02b1-4dc5-9a8c-f58242582713", "comment": "Malware payload (Mirai)", "value": "b785d420c12e37c641d0c5cd083ac4734c7146ac621ecf2e7b06295a63036ca1de4734f8ad3d251c6b89e3e513bfae6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187975, "uuid": "12f7872f-ebff-4e22-b808-2748d3782e9b", "value": "T1C783B40A7E218FADF79D823547F74E21B75833C527E1D285E1ACE9015EA024E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187975, "uuid": "ce7ad854-4a42-4b54-a9a2-0cd93ad98448", "value": "1536:riBHps3jc2OGarSxQs5YUa/+4bienUJ+wbZnLWr:riBHpsTc2OGaCQs5YUa/+4eJ+wbZnLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187975, "uuid": "8e1e66d3-1b62-4dd1-bd79-41a91937cfe4", "value": 85708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187975, "uuid": "043dc9f1-418e-4df6-9afe-df19c7b84502", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187975, "uuid": "66c07179-b592-44de-9a76-ab05811b2014", "value": "e921c9f7487b5f34ba9871a9684efa1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56b8370-ea51-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683187324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187324, "uuid": "714f0a79-95e7-4023-ab22-df626209d992", "comment": "Malware payload (Mirai)", "value": "c720fac0ede0867769b75b22bfa9b97d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187324, "uuid": "3e89ec44-03a4-40a4-832c-266f870dbc81", "comment": "Malware payload (Mirai)", "value": "f327f2eaac873c46df78a27087072531956aa5942c89ef0dc00f6c78c418f8e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187324, "uuid": "7ec7ff32-9ec8-493a-a6b5-90f5dcd34f2e", "comment": "Malware payload (Mirai)", "value": "33e1c88f46ac869c612768285770bca676a728cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187324, "uuid": "6eb1bf23-38e5-411b-8203-2e92091cac22", "comment": "Malware payload (Mirai)", "value": "0a69276cb3ae856d7f18dbd9a9b24ebaec859f8712c9826d13ceed9cfba241a54fa898eefcc8fbb14af4e8694265388b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187324, "uuid": "abb9f58f-ba5c-4aec-a98f-bf966e2462ca", "value": "T15C634A95F9815A13C6C602B7FA6E428C3B2153E8D2DF7213CD216F217AC781B0DABE51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187324, "uuid": "df6b42cf-2a77-4636-b9fd-9a2ce5bb4cef", "value": "1536:D7NoX04aEix9dknmOveA3GAhWXeyil63vOKwbZnN:D7YUHNs3zhWXUsOKwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187324, "uuid": "22325d03-0d53-4e7b-8d81-93e148e29eaa", "value": 70972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187324, "uuid": "46ea6d5a-7b74-4418-bb1b-b95dc07136cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187324, "uuid": "c4724439-8503-4db5-89de-432af3a03179", "value": "c720fac0ede0867769b75b22bfa9b97d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d5f748-ea64-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1683195190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195190, "uuid": "f886f997-bd0c-4a2a-aae7-28462a056709", "comment": "Malware payload (Quakbot)", "value": "49200ccd13e3dc44481ca6511253d25b", "object_relation": "md5", "Tag": [ { "name": "1683182516", "colour": "#CCA21F", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195190, "uuid": "662cb76b-5ac6-4b2f-80fd-ff14d473da72", "comment": "Malware payload (Quakbot)", "value": "f38520c0bf30f595753d163ed1063e31be08d4fb6e170d8a84f57920abc8fe9a", "object_relation": "sha256", "Tag": [ { "name": "1683182516", "colour": "#CCA21F", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195190, "uuid": "54e09f6c-0001-48fb-b863-b690f744b8a7", "comment": "Malware payload (Quakbot)", "value": "d29bdbb212c74065106c890f73bd56f5c566626f", "object_relation": "sha1", "Tag": [ { "name": "1683182516", "colour": "#CCA21F", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683195190, "uuid": "b0cddf79-f468-4b2e-92fb-4519b73e71e3", "comment": "Malware payload (Quakbot)", "value": "8c899b786bcafa114c0b0d6dfded58dd7580cea092d761003bf98749d590c3d99b2531b553cf2b2a1be9f582a07a2a5e", "object_relation": "sha3-384", "Tag": [ { "name": "1683182516", "colour": "#CCA21F", "exportable": true, "hide_tag": false }, { "name": "BB26", "colour": "#3AC8B4", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195190, "uuid": "37a92cab-7e00-4823-a6f0-cc857c99d2f4", "value": "T11DA3D058F667EC9CF8D1B7B390B474F8865E7963CFD61CE71E400E6AD00246AC68A1D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195190, "uuid": "da940246-8794-4b3b-b1c5-abc624536f97", "value": "3072:xdp5F1u9bQaY8P3QYYYYYYYYYYYYYYYYYYYYYYYYYYYYYBqPcOCL9wKN:Xh1u9bQaYs3QYYYYYYYYYYYYYYYYYYYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683195190, "uuid": "e4f29a46-81d3-46fc-bf7b-d1aaa6ec31cb", "value": 104233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683195190, "uuid": "de8ebd44-51a9-4503-9312-43c12b070503", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683195190, "uuid": "56cf8e84-000c-4c65-aaa6-b40f58aff696", "value": "Qui.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df1b64f-ea42-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1683180682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180682, "uuid": "30f53594-d18f-4e05-80ea-63ae6e74d69a", "comment": "Malware payload (Vidar)", "value": "fc132bc11e3b04630ccf796597d0afbb", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180682, "uuid": "34ede363-a438-4c33-bcdb-d36e6f1e2dd2", "comment": "Malware payload (Vidar)", "value": "f387a8332e1765f0cd71cb73aad027dea840436e6879cdbd103ee19cc04a1b81", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180682, "uuid": "7d9e4336-a45f-4e4c-ab17-6bc54732acf6", "comment": "Malware payload (Vidar)", "value": "5afead39f8807ca8817487c76405362c75ad133e", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180682, "uuid": "58288cd3-c436-45e1-9a55-87d633121aa5", "comment": "Malware payload (Vidar)", "value": "7b0d15217daa2da166e55524085f2a60675aac28a777b6586432f0268ab0de2f58fe91fca5335c5d741cf0ca319defc2", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180682, "uuid": "09dbd014-d472-47e1-878b-1017519c2801", "value": "T133C6BC5B28F8B772A4C48F73D9EC397006B9746092963E193FA79F1C3B553298C9D062", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180682, "uuid": "9babe376-3d47-45d4-8748-f8defb09731e", "value": "49152:Z0zuzLyZTDGcUiIOy0LzH44VhGUnNvYWgiTgPYC8Fpy9LpjPQgDg3:ZWuzOGRV4LnNvYC0PYCTjPQgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683180682, "uuid": "d4033e03-2070-4a08-9103-f030d3f6699f", "value": 12244462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683180682, "uuid": "fe067edc-f801-4e58-bcca-fe64ff6960fa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180682, "uuid": "ba8da1f6-8a49-4a9c-83ff-7e9e2fad6b25", "value": "Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c461c03-ea6c-11ed-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1683198557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198557, "uuid": "19ee2913-0d64-4783-968e-e6f60175e926", "comment": "Malware payload (AgentTesla)", "value": "d6a2a1601b3a43ea50d15552111ba64f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198557, "uuid": "92a8e7a2-e2da-4109-83f7-5f982c13a143", "comment": "Malware payload (AgentTesla)", "value": "f5fe1fd83e3b37b312fe50b0e29321cbb5499683d2a4b3d694a6d0adb3f43155", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198557, "uuid": "ea161879-a09a-4d88-946d-b2f2eab1b55c", "comment": "Malware payload (AgentTesla)", "value": "5948bf4eb588c45a72538f0fc311627135388a94", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683198557, "uuid": "343124dc-56f6-4bbb-86df-e10c53502180", "comment": "Malware payload (AgentTesla)", "value": "43153647cc8d7dabf4a1800a6b73d7f4fd5cbee1dd31316970045bf69457a11806ccc81c4c481e75a92fb580fd691a7d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198557, "uuid": "9f5e34cf-42e4-45ee-9318-ea7ff75af521", "value": "T112E4238465A0D496EC7217319D3F1A2952B7CF4716A4EF3F13027AA2BC761907A0E73B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198557, "uuid": "fc88aa7c-e726-49a7-a97f-ed0760ed317f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198557, "uuid": "21dcd679-476b-47af-9217-46d31c099b20", "value": "12288:8Y0SJL4XphH6PQcj0NThmYtzqUyEcv16x58lkbbfFMTMS0bLTmZNlsWjr:8Y0SJL4XSH09hPmhEa6x58lq2oj3mVsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683198557, "uuid": "d1256b1a-c29d-4812-ad5c-edb380f05a53", "value": 672442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683198557, "uuid": "36c75b29-64f8-4bd7-8410-459acc92a662", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683198557, "uuid": "a6ea1ca3-e94a-4b07-9d17-81857fcab565", "value": "f5fe1fd83e3b37b312fe50b0e29321cbb5499683d2a4b3d694a6d0adb3f43155", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18331a52-ea52-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683187383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187383, "uuid": "c69545b0-a9e1-4a37-b249-5de775cfca11", "comment": "Malware payload (Mirai)", "value": "f39a94f6f0bf86478dcbc4d59131715b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187383, "uuid": "9ebe195e-3b22-426d-97d1-00c5a55aa68e", "comment": "Malware payload (Mirai)", "value": "f7ffe9e39bd2686b2fd7021ce699939f245fb6e412513e04b0879ff6717ad479", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187383, "uuid": "b982226c-f267-4041-bf3c-afc0537e9594", "comment": "Malware payload (Mirai)", "value": "46106b3c70b3d956f87194611a32ffbf2685569a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187383, "uuid": "0867bb95-3f8a-429d-8be5-a8886fe02aec", "comment": "Malware payload (Mirai)", "value": "4203e279f9ab15abc49ee644b6592b89db363595d3e804f131aa2134726751d088614b1238e37e2cedb744286d632ca5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187383, "uuid": "a43f997f-f1e9-4f86-a061-c62b943c05ee", "value": "T1B183095AB9814F12C5C6127AFE1E018D371357E8E3DFB2239D206F20B7CB92B0E66955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187383, "uuid": "a810429c-f246-4a3e-972d-3e621dbf24e4", "value": "1536:7FnIZUXHKgW6i/2QV1esGzsriW8p8fbaRVo0oIdi4eaWo5Hy8785dYofwbZnJZ:aUXKb91eAiZmzafedo5Hy878jBfwbZnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187383, "uuid": "1b4213b0-752f-4047-bf63-73be016a33f9", "value": 83256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187383, "uuid": "3b3dcff9-84b3-4f6a-b2f4-a7ce927b9bcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187383, "uuid": "fa3dae2c-e42a-4ca1-afd9-6a1163a226d2", "value": "f39a94f6f0bf86478dcbc4d59131715b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1855c771-ea68-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683196832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196832, "uuid": "9c42ad39-fc93-4f86-afec-2cfb68026465", "comment": "Malware payload (RedLineStealer)", "value": "7ca61beb85520d7d987513ab3da2eb84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196832, "uuid": "e08f0ef6-65e1-4814-8435-36ae4a02c313", "comment": "Malware payload (RedLineStealer)", "value": "f8602cbbd833ac510fe4b748ef3e63acbc9b865891b5ada57c3a7867bf50b0cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196832, "uuid": "67d469cf-13c3-45ad-94f8-810f5e05d67f", "comment": "Malware payload (RedLineStealer)", "value": "b76c9d7bd876e1d0d6ec9b6f7fc058b7f5116296", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683196832, "uuid": "c912d7ed-5838-4c5e-a770-7a596ba9dcf5", "comment": "Malware payload (RedLineStealer)", "value": "8c88bb08f33a5bdc8af105eaceff9ecd9f1c743cc136f4dc8c2fd8c1c8d49751167297d3168552b759252abece71833a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196832, "uuid": "d8d5fda7-3f88-447f-b4f8-83235bdeecf8", "value": "T11CA40253E7D8D072D8B5277018F612870B32BCB2A874872B3346EA9B1CB3194657677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196832, "uuid": "fed54136-779c-4015-8de6-20d0d4209e12", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196832, "uuid": "9a35e324-914d-4df0-89e9-dfe739421efd", "value": "12288:MMrRy90j53nPkKl7SoX1I/HFsYevUkkonYjo:dyI3nPkKNSga/GdnYjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683196832, "uuid": "e3b20bd2-097d-4698-b4cd-dfdd3f1e7305", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683196832, "uuid": "780bb639-e609-4a64-86ea-5ca1a7cc11b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683196832, "uuid": "cc649638-2393-40aa-a6c0-d5152f0ea6b1", "value": "7ca61beb85520d7d987513ab3da2eb84.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da082feb-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1683194150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194150, "uuid": "9c95dc40-e0c4-45dc-8aa2-e9d7be00747f", "comment": "Malware payload", "value": "5984f6d0696242b764885c666d12855d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194150, "uuid": "cb3bfc4f-6fb4-4358-91de-793bd8494513", "comment": "Malware payload", "value": "f8972a83560590bd57010eb5e9da2b927f3de9415eb55ac64859b97b062d9b46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194150, "uuid": "9b0674ea-d114-41f9-8a28-d9b6f147f24d", "comment": "Malware payload", "value": "9d2a8e5d8b8a1fc987a4e39c06bcf61a690f5c04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683194150, "uuid": "b8c48bae-b658-4a75-93fe-d68cd586379a", "comment": "Malware payload", "value": "208e4bee9c085a2ce0b64e6f38044c00c6106b6311fb4f2ebf381eb37438e613c3569a54876ef4b1cf236f34424d1e81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194150, "uuid": "fa139fa8-b674-4249-a3cf-7ff0491875ce", "value": "T19AA302A2569C4068CD7A4B7D783F2F160F2F44E31560461A31E81B533B11A6B3A8D6EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194150, "uuid": "a92f069e-5dd3-4c69-83a9-ad493c9b1b43", "value": "1536:sUCzf+I1mIWPhQU5wXn/3Ko5oTxEhRWTQQiw/xxD5Pfx1J7sYXKZD4k6T6hB:vO1mvJQ9X/3ylsWQzw/xx5x1J7sYR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683194150, "uuid": "09173d35-fb76-40ce-a788-06512772b582", "value": 100008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683194150, "uuid": "932278e2-7752-499b-89f7-e2652aaa755f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683194150, "uuid": "ef85cd3a-e280-4f91-b737-801f6b49d265", "value": "SecuriteInfo.com.Trojan.Heur.DP.gmGea83ID9p.16074.26350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9788b11-ea42-11ed-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1683180808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180808, "uuid": "f28c5407-6158-4239-b1b6-9e2254f5e2c9", "comment": "Malware payload (GuLoader)", "value": "d425df0a2f01a0a02a5db20cb56f3732", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180808, "uuid": "493a4948-8328-4514-8ff7-a4d0ced018e3", "comment": "Malware payload (GuLoader)", "value": "f91c9bdc14e36774ed8aed734de4c793ead4537dfcab4b7e341961142efa406b", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180808, "uuid": "162a675d-8b49-440e-986b-3cfa9911d62d", "comment": "Malware payload (GuLoader)", "value": "ea56891c938533dab5832091e63bc1be57789f2a", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180808, "uuid": "354f7651-4e8f-4492-a2d3-cc91ca8bcb12", "comment": "Malware payload (GuLoader)", "value": "d82ef358fe8b98234d6da906b12df9efec55bbe6ea800f62c42e81a174ce2cf280bd2a5e237f124580a1368beeecb78a", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180808, "uuid": "e0383bde-b2e3-4b21-b392-9a8252eb9b2e", "value": "T1EB7402A665D28857D74552B0CEB1CA37E3BBFA400837465B3B9C2F17BB273219E04399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180808, "uuid": "72793051-259f-4d5d-a947-3ed41ae7e866", "value": "6144:S1onEmMMMMMjMMMMMMMVm674BZiOoG67WoTXb0ZEQkOZIFujo1XN+KO:+odMMMMMjMMMMMMMVmA0QOsvbfCISS4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683180808, "uuid": "7daab2c1-f60d-41ae-848b-48b5bafacbf4", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683180808, "uuid": "136caf2d-9b0b-4c31-9f05-6df317da8869", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180808, "uuid": "915081f7-8907-4a26-8732-effbb0e4361d", "value": "newXorderXS-01091.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25874709-ea40-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683179674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683179674, "uuid": "2ceb752b-6219-4d92-9e7a-359e3342a43e", "comment": "Malware payload (Formbook)", "value": "9516a8e0ed0e68fb2c89ac5ac3c4ae40", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683179674, "uuid": "0d60f3cf-a05a-4fcf-b876-5de6147b6a87", "comment": "Malware payload (Formbook)", "value": "f9b06f4bbf8b20a76d3352e3a41c7a32babb18cd12edf50406d4971fac5fec61", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683179674, "uuid": "1b119837-a9dc-4af5-9989-6e624988ecb0", "comment": "Malware payload (Formbook)", "value": "92c54db6e51ef86317259b370b666b45f369e3d7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683179674, "uuid": "618f2426-c067-4836-b45f-f09bbf353b68", "comment": "Malware payload (Formbook)", "value": "85bc97f3a4d73ab83c2752bfb642290adfc7f69ef745ae7f533dffc4f8e86ea0edca7f3577f6bb5cdb7649152b1ebec5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683179674, "uuid": "e1423108-f82d-41af-b531-992cab283ddf", "value": "T168D4233BEFFC076A6DEC6E68ACE1C94E7C67923D9080410627DBC784BB57486B2D0855", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683179674, "uuid": "0670451e-83c0-400b-a4b4-40c732c5d0be", "value": "12288:TvafPez0kttrFqQzSlwR4ZQ4/IV1AUnV/OXiX5ND2iyucL/TIuC9bBgA3zob:zafP7ErFCwKqIXKR2/uEIuMRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683179674, "uuid": "d19b661b-7b28-4d1a-be2a-1549e0aed122", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683179674, "uuid": "34e115bf-1df8-451b-8497-bfbd1078a968", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683179674, "uuid": "0affcb17-c60a-4675-a1bb-28c7705ceb7c", "value": "Inv_7623980.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b102ed8e-ead3-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683243044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683243044, "uuid": "a0c71a4e-ded8-45ff-be56-7ee1a1bb2073", "comment": "Malware payload (RedLineStealer)", "value": "bf91ae2bf0d6147258859d8eebe5bf4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683243044, "uuid": "c15582be-d331-4acb-9026-9f112965ebfc", "comment": "Malware payload (RedLineStealer)", "value": "fb0354354e5b916277c0fb167f89083c19d4ffc86218f9a75591a311f87fb4db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683243044, "uuid": "95df808f-343f-435e-be02-d2cd671e0815", "comment": "Malware payload (RedLineStealer)", "value": "74e33462c912acaba7b3523b8ec926ce4faa412b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683243044, "uuid": "5d22c591-06fd-41de-a64a-65d5c63d18dd", "comment": "Malware payload (RedLineStealer)", "value": "f41cbe5573f04e5dcf805e8f7511d0ada27ee8879430d08d929368ad650f3619bb98ee401def8898f2cd3b2ff0698b18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683243044, "uuid": "11e9dd3a-6b11-4b15-a739-d48b5f1e9a73", "value": "T18184F113FBE85133C8B1177058F602C31B367CA18D78836B2795AD9A5CB2A84BA75737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683243044, "uuid": "d5ff1b16-9a17-4d85-aa36-bb7eaa2f0f0d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683243044, "uuid": "b1a5da55-d5c8-4162-9d75-b344b0a17410", "value": "6144:KIy+bnr+Ip0yN90QEetmFQNztahkE2KcDI5ryLaXNH5345o2fGlF1ZqoInBLX3pQ:AMrcy90UtLNhjZPoW03N2fu1ZZuL3pXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683243044, "uuid": "1ff867eb-6614-46fe-a869-67025189fe2c", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683243044, "uuid": "b7cb2a70-0fa7-4fe9-9e89-3db0fba95d07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683243044, "uuid": "e6c807ce-6489-4bc5-82a6-bfe6a0210556", "value": "bf91ae2bf0d6147258859d8eebe5bf4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d5a383c-ea52-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683187391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187391, "uuid": "43e1c734-af2c-4abe-93df-9471c0c33dad", "comment": "Malware payload (Mirai)", "value": "b44075993aca70813569cc3283688334", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187391, "uuid": "a9d116eb-7eeb-4fa7-9a7c-a7a3b81252d5", "comment": "Malware payload (Mirai)", "value": "fb1b9e0a7f12671e137ad57949085d0197ed058b0d0f8d5558b4cd3100321dc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187391, "uuid": "a0a70546-d6f1-4ff5-8c9b-6ffd1aeda1d9", "comment": "Malware payload (Mirai)", "value": "f4bc3c17461bc26fae717bdb04490d64a617c2a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683187391, "uuid": "b8ba925a-c129-45d0-bbb8-406e72c699d5", "comment": "Malware payload (Mirai)", "value": "5012f0dce6ad24a0b967ebd368cc4c4207fb5c6cdb5a14ca50a16eb9899d529ed8b37b4798bc30270175c9d23443a598", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187391, "uuid": "5b7d2672-2c72-4c04-aee8-3ba2dba20ec6", "value": "T147633B95F9815A13C6C512B7FA6E428C3B2513E8D2DF7203DD216F217AC781B0DABE51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187391, "uuid": "4cf07e0f-b8b6-4d5d-ad81-978dca394f0e", "value": "1536:qnyorX4GaLAEVhWXi8/CAkXfzTUZYrAuvyAwbZnN:qnOHVhysA2fzTBvyAwbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683187391, "uuid": "4ca1db32-d99e-4043-80d9-09dbfbd85650", "value": 70972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683187391, "uuid": "34722442-b978-4237-9d19-da2ceb14e2ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683187391, "uuid": "57d6a396-b28f-43a0-9e18-f742e0ad593a", "value": "b44075993aca70813569cc3283688334", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a257fbbf-ea41-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1683180313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180313, "uuid": "5bcb891e-9915-40dd-a849-940f51fe1126", "comment": "Malware payload (RemcosRAT)", "value": "e576e1e23be89a89c85dfce09541cd0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180313, "uuid": "2990ed62-2310-48f3-831d-9a79475cfdc2", "comment": "Malware payload (RemcosRAT)", "value": "fb27196ffe8eef17b80e96e4bc75edffe0585537161f22c27855a694526ff227", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180313, "uuid": "4942faaa-31f2-44df-b122-ca11955b5eed", "comment": "Malware payload (RemcosRAT)", "value": "ce7291cb11f3fa80f5ac1ff9b8e3d61edabf1e13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683180313, "uuid": "2c1d4eb6-2fd2-4a02-b5fc-3a99d5d20eb7", "comment": "Malware payload (RemcosRAT)", "value": "5e45111dbcb492999b35d3863ede6ca763b5c3d674e48fc230f8d2bff696848345d4716673cb851c0956624718aff61b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180313, "uuid": "640c4609-b440-492c-8eb7-ee8ea2b7df6c", "value": "T1326412055538C42FD0A14AF1197687A3BFFEEA216651661F3BA13A9C39793D28F0E303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180313, "uuid": "3804d939-3702-48d2-b5d6-bebda0745549", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180313, "uuid": "b63b1864-bcea-45ac-bfbc-aea3af3179a6", "value": "6144:0gORawU/WIfSRSGPu3OYN4HdH0iLqhJxckgjaPM9vlue7BBXc59voyqxSh7:0g8saRK3KHWvxua6t7BuTASd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683180313, "uuid": "bd213cec-7ce0-4bd6-8cbe-bec76a642282", "value": 312216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683180313, "uuid": "b8835c57-9a53-4f43-9f37-7727323a28f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683180313, "uuid": "3131f5b7-d20f-4900-a234-ef9797c5f2c2", "value": "Kraftfuldhedernes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c35abb-ea57-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683189533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189533, "uuid": "0c140d15-a61f-4f68-a572-9ebb8eef2067", "comment": "Malware payload (Mirai)", "value": "a97c425dcf9ff0801e25a8509f740f25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189533, "uuid": "929e6a79-b73f-4bbe-a82b-ac3a89ee78ba", "comment": "Malware payload (Mirai)", "value": "fc620247af0a07afdd926a9ae09c20ebcfe483bb0fbdc899bd46b7b68e81f0f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189533, "uuid": "cbe714f6-7604-4151-b75f-489aaf2fae7c", "comment": "Malware payload (Mirai)", "value": "58829b0ef4a29a3e6b056d7eb4f43dc105259eb1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683189533, "uuid": "85f274d1-e8e4-4721-8e89-5cdfe1e64106", "comment": "Malware payload (Mirai)", "value": "a8d5a04cc6fa18646139097b320414c47d135962205938fd1e0b56e8dd660436d19a1e28f951e079717b89bd92f6b937", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189533, "uuid": "34e407cd-1c6d-4626-9ef1-c0657f6d2fff", "value": "T1B8D2E092FD638992FB7FD9B13A64D5C07BAB47AD1FB8ADD320ED2A412409E164D00DC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189533, "uuid": "a0dda0cb-083e-4874-b3ba-d13fef4ab587", "value": "768:vRtVr1QC5J4H2TO1/kcDNotffW31hdhbThb91/v7X94uVcqgw09V:v11QweWfWwf+315TV/vh4u+qgw09V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683189533, "uuid": "2866400e-6a6e-4e94-b84f-3a0e85a1c659", "value": 28336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683189533, "uuid": "22153134-fc90-4dd8-ab8c-dc4fb21341d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683189533, "uuid": "2975ceb5-a6c8-4311-aa8c-719484653a34", "value": "a97c425dcf9ff0801e25a8509f740f25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46d06fc-ea45-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683182115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683182115, "uuid": "8fa844a9-1ac1-4f80-8807-8d7aae0486f4", "comment": "Malware payload (RedLineStealer)", "value": "ccb7198d648d1c0fc8597a495e461606", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683182115, "uuid": "193a46f2-29c0-410b-a168-fc4846f7f5a7", "comment": "Malware payload (RedLineStealer)", "value": "fcbea7df49d26db879d3619f03af1450e87e9207dd916eef15a073552723b194", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683182115, "uuid": "034b2b4a-ce7b-4447-bd3c-50afb4d15ad0", "comment": "Malware payload (RedLineStealer)", "value": "c5ff593e5a85995a03ecbb065ae90e9447c95d15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683182115, "uuid": "59e81816-0393-43a8-816f-ab9d31b78472", "comment": "Malware payload (RedLineStealer)", "value": "78d52f0c46557503df54febe289a0f78fb3f1fe3adf4b6e018d2493694e665a191e54cda5226923a3f0d1e013ae4fd8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683182115, "uuid": "fecc3bc1-106e-4b1c-9e00-f29bd5880084", "value": "T102231A0BB69AC565C255E73EC8D244140B77D6C2E55BEF4F39CE239E1803BEBC808966", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683182115, "uuid": "d0d96e74-7a51-4fb4-80c3-973c4a684349", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683182115, "uuid": "3290b36b-4e49-4e51-b873-3a31eea7f2a4", "value": "768:btYbR5GXfgGGya7YFVmbHVVYJZgJnj++ffqy33J5XO3/HfVY5/OUkr:ObCMYrmjAJZKj++fZzOHG55G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683182115, "uuid": "97203867-1a45-4433-98a8-12749630828a", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683182115, "uuid": "852580fb-3298-4fea-977c-710a6557b981", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683182115, "uuid": "2c223722-b0bc-4c14-b2fc-ad517f4447e4", "value": "ccb7198d648d1c0fc8597a495e461606.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df9e4023-ea9d-11ed-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1683219930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683219930, "uuid": "ebfc9cc4-2b1e-4532-99df-4487c947dfb4", "comment": "Malware payload (RedLineStealer)", "value": "b39a7bc324162d5bbe0ebb53c5f72a74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683219930, "uuid": "a7b15b95-54ee-4226-ba5a-bead9a5940da", "comment": "Malware payload (RedLineStealer)", "value": "fcc6630a3781bc584f63448d62e3aeab8c1b7287115cddf06edb4a88a4a7c060", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683219930, "uuid": "3b082701-2e77-49bb-8afa-177c4daa48e6", "comment": "Malware payload (RedLineStealer)", "value": "1c3cb0cba6b2aca973aed18953bf394c96aadddd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683219930, "uuid": "029f0a22-8eff-4508-b1fa-ca1177a77728", "comment": "Malware payload (RedLineStealer)", "value": "2312e96b3908310ead8f4cff50d4dc992ae5e43f7b1a83b9041d80aff008557fc9488bc016020e5f87a6593df611de65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683219930, "uuid": "a9c6e9bb-2ba4-4f7a-be55-84e45b911bde", "value": "T199C5AEF08EA1BD56D7AF0EB480EC19808D98174793A9D74DFC881516E6E2790EFDC272", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683219930, "uuid": "63d8db8b-ca51-4a4e-8df4-8b8ba91a01d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683219930, "uuid": "d72cef28-8a77-4244-80b4-454839bc6bf4", "value": "24576:W3Sui5m+5yX+RNFlnRgyuMnb9310oUUS/qnwpJDQgbf2Ma9yzncNsJPsHah+uAAw:cQNFRLgXD2NkznzAviKVCvbRN/sp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683219930, "uuid": "a2478712-162a-46c4-877a-94ddc0080a4f", "value": 2530056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683219930, "uuid": "fcfeeeb3-e74e-4983-8f10-88ea75d97978", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683219930, "uuid": "52fd6506-3aac-428c-99e1-3f9d024a41d9", "value": "FCC6630A3781BC584F63448D62E3AEAB8C1B7287115CD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b82ec30e-ea82-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1683208267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208267, "uuid": "0112173a-8408-4e61-8b47-9ff2df030c8f", "comment": "Malware payload (Loki)", "value": "972db0a413a4d80edde64d0f13ee2d4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208267, "uuid": "dc8d6c69-c15d-4b07-843a-f0fc8b9fdb34", "comment": "Malware payload (Loki)", "value": "fccd7eaee0eeecb3beab4005e428887eb9d25549d1c26d1efb50abe078202894", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208267, "uuid": "b3fb3752-694f-462a-873b-f9b9f50ebd7e", "comment": "Malware payload (Loki)", "value": "74e9e7038a1669a5aecb02047476e318b7c5700e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683208267, "uuid": "ad94a3fd-13b6-4476-8592-00d278842fb4", "comment": "Malware payload (Loki)", "value": "14fa7ba8d0aaaed54b1225541a8102f022d25ba95354cc34d9cd5f4ed85932212cbd92b3e5f09112a2daf4448f551f1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208267, "uuid": "61d0edd3-f86b-439c-adf3-f4a52f6bfbc0", "value": "T1F0E4F17714AAC390E03F8BB0B968BE2416A731D7F8D39E35072929C55E99B113C9D18F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208267, "uuid": "379d7716-2fca-4779-a0c1-0a72b0baf1f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208267, "uuid": "1bd78dff-bf5a-4901-9113-10db10db9b58", "value": "12288:YbkcdXHwni4IyS+sKzMQ8yFXXfuBzpmCQu1ttbE4gCQweGfEmgAA76HQByjD:YbJNwLVzR8ypXf+mCF1thvjQweGfEmRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683208267, "uuid": "25452334-d042-4ffc-a2f4-631c01419a6c", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683208267, "uuid": "86bb2275-f8c5-4ff7-9677-4e6cf4f8d9ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683208267, "uuid": "8a060d36-7c18-4ed3-9593-d50ed4fb1e2f", "value": "CONTRACT_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3657cff4-ea4a-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1683183997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183997, "uuid": "be3023a5-401c-4a16-b90c-3671c5e02186", "comment": "Malware payload (Mirai)", "value": "9775fe235c8a2389a551458925018a11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183997, "uuid": "58558906-cc88-4e58-af71-1b8c0ff93b9b", "comment": "Malware payload (Mirai)", "value": "fe3504437c753794348ab2a534a5163055aaf0581c6fe269d0e6ad85c12996e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183997, "uuid": "3f84d089-fc1c-488b-b395-71166c390ae8", "comment": "Malware payload (Mirai)", "value": "c49ee139100f2f088e0dd4cea22e4a0f45f58771", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683183997, "uuid": "9bacd110-7810-47d6-8322-0d0ffc7e7832", "comment": "Malware payload (Mirai)", "value": "73cbf86f16fa9c1518fae8b5e6a7dcdb9ce1b0e9cc80c5ac5710d6591cf83a2bfdafbd9af3ca3399522b77da065f3803", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183997, "uuid": "cbddd65b-77bf-4a60-a6c0-61f5e537e864", "value": "T1B9E33A56FB804F13C0D61776BAAF4249332397A493EB730699187FB43F8679A0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183997, "uuid": "67e934f0-434f-4670-b5a2-47fc1224eb50", "value": "3072:LVlbRK+N4MNspRa/beCn8EmGWNycUtxjwbZnIsXy0+M/9oYIC:LVlbIfWWRa/beCn87GWSLjwRIsXyFM/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683183997, "uuid": "afc522c2-2ee2-4a87-8235-11afe9adc17b", "value": 154960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683183997, "uuid": "0f30a577-25b0-4932-a222-c58ec96e9b8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683183997, "uuid": "32dc758f-c0b9-44db-8520-d66609b87b91", "value": "9775fe235c8a2389a551458925018a11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62547dca-ea61-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1683193950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683193950, "uuid": "28340156-4c18-43dc-8e8c-6c786459d6d2", "comment": "Malware payload (Formbook)", "value": "2ba9e51cc9466372d60ec01e5c629d7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683193950, "uuid": "9eede9d1-2770-4169-9997-64e818714081", "comment": "Malware payload (Formbook)", "value": "fe8988a0ee2b5c321d3538ed71519c3f3a73746a4a1adc9c84b3ce574fd353c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683193950, "uuid": "b8909f1f-65bf-4cae-84ba-ff2ee0b88394", "comment": "Malware payload (Formbook)", "value": "56e0a18b5d7358b644ae50cd20941547eaf9d904", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683193950, "uuid": "41feee50-7eee-40fe-81ac-35a9729a5308", "comment": "Malware payload (Formbook)", "value": "74b827fb1b72774a8ab14b17fc5866bad8fa3f68e5ab04cefc2c34bb8f0cb3187f141b3ea82653aa62e1d4f7f2ee483f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683193950, "uuid": "a835ba30-0a53-44a7-b228-cc62a4472438", "value": "T1B3D4AD3C89BD4233E6B0C2B19BAD8871F0ACA42F7191FE6A19D7D19512D3857B9C312D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683193950, "uuid": "37a8aac4-9fc0-40c3-a115-2a925735bfcc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683193950, "uuid": "ce32375a-3842-42cd-bc16-2e25d3ca486d", "value": "12288:atfRfGtknp4McQB+Vd/F7lTDoeYohzmB44u86O0FH4V2+Qdo:Qgknp4McQO7lPoeNY4R34VQdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683193950, "uuid": "275fb9e3-9eb7-469f-8ebb-756997cba070", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683193950, "uuid": "fa672854-bad9-46d5-8bff-04b620a7357f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683193950, "uuid": "daf0c367-1239-4aa1-b33d-8ba5f9afea0a", "value": "Inv_7623980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "172fa5a8-eacd-11ed-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1683240209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1683240209, "uuid": "8120483f-2c56-4d16-8ee2-86fcf1467f4e", "comment": "Malware payload (Amadey)", "value": "5ff3d855774195e95af9f739f3e9ad1f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1683240209, "uuid": "a1af06b5-8b07-4783-92c4-03e480762ae8", "comment": "Malware payload (Amadey)", "value": "ff938a0fd6ce680b7dd06af89b87a4d2b69cfcbf042e783c4f483cbf9dfd653a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1683240209, "uuid": "887107f6-6d7d-47ff-80dd-ccd36bf9bff5", "comment": "Malware payload (Amadey)", "value": "19bdeb285af259225b52f4b1b1392a0caa717729", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1683240209, "uuid": "4c7fd5e1-be4c-4e70-9796-73cdcb412e31", "comment": "Malware payload (Amadey)", "value": "ff15ff1491a83a6402c598b53108616d50b85d8d50530f850b33e549290759b9c07d5e6312e3f89582a4725aeb9a2259", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1683240209, "uuid": "a208c86a-c03f-47b3-83d7-1634f5d07293", "value": "T127640A1343E17D88F9268B729E2EC6EC771EF2508F59376A22199E1F04B12B2C173B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1683240209, "uuid": "1ab4e1d3-19d7-4172-8365-df312990cfa1", "value": "4972919a898b59dff1b6e51b24f75db5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1683240209, "uuid": "c01b7815-9b02-43c1-84bd-437d5b0e5c12", "value": "3072:jA0VUI67IaIr7rVP8MFanrRv90IrtRo2dKlsqp5Bq4UPFqx//tgr/3:E0mIkM7FadWIZRpdCsqNNG+tgr/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1683240209, "uuid": "d8defcc4-112f-4302-b679-906e0b42aafe", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1683240209, "uuid": "a92fd68c-b0df-4b0f-a549-35ce015f3de8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1683240209, "uuid": "0f9c2dfd-e25f-4cda-b2a0-3e7183390d79", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }