{ "Event": { "published": true, "date": "2021-09-11", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-09-11", "timestamp": 1631404981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "7a263c80-2764-49ad-b5f2-7ae3b48c7028", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e4c81cd-1337-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631388826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631388826, "uuid": "e10bd555-4a3d-4efd-9f70-5059d4f42e5b", "comment": "Malware payload (Mirai)", "value": "01d77100a2cbb533913cf1a9d60b97a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631388826, "uuid": "0d6ad923-5be7-42fe-a4ce-e5909170d075", "comment": "Malware payload (Mirai)", "value": "0076876d46673961e89d92def74ac404a2157682962c0db80f952fcfd63d56e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631388826, "uuid": "022e48a0-3b93-4017-8076-ac10e0aa5c14", "comment": "Malware payload (Mirai)", "value": "da961ccaa600b593520995ff32a0a97586f54533", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631388826, "uuid": "48873a22-380e-45f6-b766-4e012cd8ca42", "comment": "Malware payload (Mirai)", "value": "6c723659d30230cfe6ff56e1b121d361d23c361e1dabaa3b48844a7dc9eab3b5053149971ce9d146fbf86bcd37cc10c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631388826, "uuid": "2f3735ff-98b4-4816-94a9-a39482ea51de", "value": "T12C63AF35D026A6E4C0854238A0A88E751F53E5C043633EF66FDE86E290479BCF50AFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631388826, "uuid": "7f0b5f3f-30fe-4ce1-985f-2bb440224464", "value": "1536:QO/ULnCRkY0A7Nh+1sVfdMxdtn4xdLW3eo3C4y:QOcLULesVfpxdLW3eo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631388826, "uuid": "572d50ba-35d8-41c3-b4c2-72db73dab07a", "value": 68592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631388826, "uuid": "0ef1ff1f-c818-46b8-bb8e-bbe1693e4619", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631388826, "uuid": "090d7ac1-b8c2-40ad-9b95-bd2a78e8369f", "value": "01d77100a2cbb533913cf1a9d60b97a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1538ac03-12ec-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1631356571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631356571, "uuid": "43244de1-c33b-4829-ba81-c0fc25242d0a", "comment": "Malware payload (RaccoonStealer)", "value": "241e902c0d538548be6b89a94771aa07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631356571, "uuid": "b7ad6843-bc7e-4332-b064-757b4477fcd6", "comment": "Malware payload (RaccoonStealer)", "value": "04157eb6cdd54ef10f305bb2feb43eafa0c0335dea91afd4c153101737fa3dde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631356571, "uuid": "dca91068-844f-488b-b032-ab072fc5eaf2", "comment": "Malware payload (RaccoonStealer)", "value": "697045281146a2e7dba7ec5ffdd587985e6adf67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631356571, "uuid": "aafcef87-7324-4361-b552-97bef54ef2c6", "comment": "Malware payload (RaccoonStealer)", "value": "68d475e746264960144d0915d146df4b7dd442f7b0d742ebd226a23669d8c77ff16d3b7a5a0785753bca4ba1c789a996", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631356571, "uuid": "a0f10d00-f4b4-4d2e-af81-6ad201893695", "value": "T1B7C4E030B6B0C035E8B726F889B997A8AD2D7DB16B3050CB62D536EB57346E49C30753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631356571, "uuid": "46dcb747-0945-488e-b3c3-9c7d89645e65", "value": "69566d56ce8187d49438dd02ea591694", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631356571, "uuid": "e2b61a41-8cb5-4e8e-9e5b-45f67248f663", "value": "12288:7mYdiI2ZKtXUOKzpueiU6rRMleHrm1FtPnBcab+QR:6Ydk1xg261M48r5cab3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631356571, "uuid": "1cb63d10-ef51-4242-a913-8f2a505d42e9", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631356571, "uuid": "2d3e23b2-9062-4dba-a4c3-78d81e86a4d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631356571, "uuid": "94fa57f3-fedb-4f90-91e1-e18cd18d203f", "value": "Intaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e886768-12ec-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1631356614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631356614, "uuid": "cf4e7780-275f-4bb8-84cb-0e39b9587a24", "comment": "Malware payload (RedLineStealer)", "value": "2a44baed152259656afb0a34cd131277", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631356614, "uuid": "e24d3f54-d84f-44ff-88ec-95664f6421be", "comment": "Malware payload (RedLineStealer)", "value": "04897f8d3178045f6b56cb25bd2ff5325011d25f8a8b5c469ea438aab549ebf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631356614, "uuid": "8023333c-aba4-4a59-88b6-5d2618d7644c", "comment": "Malware payload (RedLineStealer)", "value": "7a01571b233a03434d9952f6045e0c0612a5c369", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631356614, "uuid": "5744c400-0f6c-4404-8aad-6d19076c2699", "comment": "Malware payload (RedLineStealer)", "value": "bee369632f8ac51e1f0136d9e757528425a5c3503645e98887444ed22e49abd681f60c819fa2a0ccc40a4434ffe835ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631356614, "uuid": "27725a38-56e7-4552-bf5a-90487a59fc86", "value": "T1D3252304AD38867BDF87C7743FAB422666A459422062ABAB73059FCCF723D52442B71D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631356614, "uuid": "98ecb19f-798b-47e9-bc0c-80013dc6d2d1", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631356614, "uuid": "3312de33-6291-4e08-82f7-1c7e70eeaa4d", "value": "24576:OMwStoOL7OwaY83NgLfLkP+g/KmkzxbEU20DzV+91hJ53mo:OMwkoOLKSagLG/Tabt20UKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631356614, "uuid": "8406f476-d535-4b54-b458-20f35038edbc", "value": 1035861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631356614, "uuid": "fe532908-2114-44cb-9407-69065d0914ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631356614, "uuid": "fdad905f-8bff-4001-be83-807de4f626c0", "value": "Trainer v9.3.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "496fb3d8-12cd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1631343345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631343345, "uuid": "9f427bbd-70bf-47a8-aa2a-bc901eca8c9a", "comment": "Malware payload (njrat)", "value": "2f087c02e5a65fc3a150ba96ddde8a0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631343345, "uuid": "1f6b7e8d-0178-4fd2-88dd-dcf378ee1302", "comment": "Malware payload (njrat)", "value": "04c164391efcedd93b5c04dc137e8b80336265246fa15318a67d4b2d20bf257f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631343345, "uuid": "3eaae940-204f-4440-8f22-0759af9a63f6", "comment": "Malware payload (njrat)", "value": "d8b02d1cd0d582b93866ea2e2da10cb148828566", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631343345, "uuid": "bdac4417-2e3d-4166-b1f7-d6cb602cea25", "comment": "Malware payload (njrat)", "value": "02541dbb726a7b195c5eac38fd7ef43599ca939ecea92a6d0c7275e9a3ddfa64db9b4e7acb23313d7523dd542275c3a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631343345, "uuid": "460eb01a-eb8a-484c-bc2a-0a58daba0b33", "value": "T153F49F31F2C08837D9321E7C9C5B92E5982A7E212E39B54B3AE51F4C5F396C239162D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631343345, "uuid": "2caae1f1-0cf2-424f-a85f-1edab67f31b4", "value": "e5b4359a3773764a372173074ae9b6bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631343345, "uuid": "d7914e99-384c-4156-a1ad-37585682d652", "value": "24576:kZ1xuVVjfFoynPaVBUR8f+kN10EBeupWq:EQDgok30C8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631343345, "uuid": "6ef44f81-850a-4103-b4cf-5af92724bd19", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631343345, "uuid": "b5aaaf76-3010-41e5-9056-44ce267cc435", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631343345, "uuid": "37cb4ca6-f0f9-4374-b1b1-81acb2d7fab8", "value": "04C164391EFCEDD93B5C04DC137E8B80336265246FA15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14fe9be4-12d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1631344545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631344545, "uuid": "0d3c69a5-69f6-4184-8399-9d89fd0dcdc7", "comment": "Malware payload (RaccoonStealer)", "value": "534d0c4c689c99de5fa06068311f10d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631344545, "uuid": "b42844ab-5eb5-42ec-9da2-3a8d45b1ff5a", "comment": "Malware payload (RaccoonStealer)", "value": "05fd359e1bbd54a0884da07fc0f09eb66c86c9059e492efc9c9376fbf6469eee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631344545, "uuid": "751357f6-a0dd-4efb-bc92-203daf4fc8a7", "comment": "Malware payload (RaccoonStealer)", "value": "3639f3b7635e692ea3a397d34a37cdd771c4ed73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631344545, "uuid": "10ff0e84-aa53-43f7-9dd8-d6f4e89d264e", "comment": "Malware payload (RaccoonStealer)", "value": "95b8cbbe5081a45ef9b808c40ded1fec60a91da7f65a2d2b9aa90da2c5e213fde3d51cc89a9f144c0dd96b0395e5f5f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631344545, "uuid": "7632c035-b6ef-45d3-82f6-c1a4afb2abd1", "value": "T125D62317F398553EC4AA27354673A25068FBFAA9F417AE1A67F0C54CCF351C00E3A6A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631344545, "uuid": "075fafeb-4917-4ccd-a7c4-284291b32e59", "value": "eb5bc6ff6263b364dfbfb78bdb48ed59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631344545, "uuid": "0d2e7057-b41c-4a0f-b49f-f00d658bf34a", "value": "196608:5utpW72KEhMq2zUS+Wdr+qPYoatl0+t/7I9K6Td+70oeQNEZhp7LdCQMGjwQM7lW:Y62HhM9JXdKqPQzcY6k7uQEF7EjlrcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631344545, "uuid": "587f29a1-1737-4a78-89c3-5d1bc4764dc2", "value": 12639183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631344545, "uuid": "25c9009d-42a8-4527-b2d6-001806984bf3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631344545, "uuid": "a6663692-c85c-4b78-ab3a-d77a195bb842", "value": "534D0C4C689C99DE5FA06068311F10D3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf3a33c-12c7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1631341039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341039, "uuid": "60c598b4-560b-4e98-a995-d5240006bc14", "comment": "Malware payload (BitRAT)", "value": "070ce7af84a021805e3e6d4c490d8fe6", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341039, "uuid": "6f9f72b4-cff1-46af-ac85-232efed8ed50", "comment": "Malware payload (BitRAT)", "value": "0734fd5a6556fa59a0685c5fc1e6ab2d37a36cb742d0027580cb755c8dd08c67", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341039, "uuid": "68812ed7-a55e-4f10-aece-4c6425ee6890", "comment": "Malware payload (BitRAT)", "value": "b455f1665b98288781905f10c6399cf03e62557b", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341039, "uuid": "16b27a1b-c03a-42f4-bcc0-182dffa95b32", "comment": "Malware payload (BitRAT)", "value": "9dbe573ec299fe6bb1e1a61e1788e15a2d20b4cfe5f212eb81e7cd76930e798e7585430e0aa9414d2c8e5e1d70bb141a", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631341039, "uuid": "7067a69b-dfe0-49dc-a38c-57ef97fb63b8", "value": "T162155B8A930344B3F0639379C8874CE5AD17BD102B1BA542EEB03A7B5F772617939187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631341039, "uuid": "2be9dcd6-e0e0-4675-b833-a01176e12e95", "value": "eeaa79131e1869974d006dbb2ecdb12b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631341039, "uuid": "f7199a9e-6eb2-4db2-bf0d-4b69167f0bd7", "value": "24576:sORzbL0pn/Qi+fOTFZ0IDx83FMKqVYsqS8:dmXCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631341039, "uuid": "31f1d9e9-87d2-4738-9540-a9ed6047709f", "value": 912896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631341039, "uuid": "22f9f9b4-1c07-49ac-b150-6493952051ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631341039, "uuid": "061bfcad-c9c2-4a60-bc1a-e800c49ef254", "value": "WEJZGOCF.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3ebab2-12f3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1631359756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631359756, "uuid": "712b27a5-0a95-491e-8e53-aed29bc84cbc", "comment": "Malware payload (DanaBot)", "value": "47c51374ad72d0c0faf7da8ab1cbf46a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631359756, "uuid": "927239c4-f085-48b6-82ab-fe443f8f7c0d", "comment": "Malware payload (DanaBot)", "value": "09a6f1762ad56add49d58eb4d3b4dc7efeb72599c641d3ef2c6dbe3488196166", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631359756, "uuid": "0373b16b-c179-4e1a-96a1-1a77eda1ed7b", "comment": "Malware payload (DanaBot)", "value": "82e8a4e8806a57e2c9f0ecdb9f52b801d18e4fcf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631359756, "uuid": "8e393804-711c-443d-80df-16445d582282", "comment": "Malware payload (DanaBot)", "value": "2a6a2cfe496f5e1767211dfd1abba7cb14e1b6b9c54d8606c6a6055a09e6c0cb1997b5ae0e34637a527c62f7d7360f54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631359756, "uuid": "ef0bd0c9-6537-4ac8-96bb-667db9aa7e65", "value": "T169451230B6B0C036E9B707F9597A87E8652E7EB1AB3041CB92D525CB56346E8CD30787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631359756, "uuid": "2178665d-463e-412f-8a95-74485e133973", "value": "7dedca7bc07f096eb3cce2bfad6fc32b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631359756, "uuid": "54b17f98-342f-4f30-a9c9-e2b827b3ee6f", "value": "24576:3ArhsXMIt7EAY7u7eFmE2wtOB4PdQmxkW26MigM8b:iqWxS74tG4p4c8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631359756, "uuid": "0f7d2476-bc91-4a79-8cf9-4095f47dcb70", "value": 1240064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631359756, "uuid": "e41709eb-4978-4e7c-b5ae-6cd10c1d5c05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631359756, "uuid": "8392d470-126c-4176-b5c4-47d0f6432c6e", "value": "47c51374ad72d0c0faf7da8ab1cbf46a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c882ed21-1337-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631389084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631389084, "uuid": "01469faf-9f14-4d68-8e62-a8d2e01bfb36", "comment": "Malware payload (Mirai)", "value": "fde285bad565f25dc0ec286324495543", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631389084, "uuid": "d2fa4dc1-bb43-4a95-bf76-72d5267ab3d0", "comment": "Malware payload (Mirai)", "value": "09ee792750f800512bbdeb1c82e3c484c0ac7133c58e99ae8956747208d462eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631389084, "uuid": "1f6e07f7-2e02-45a8-aa7b-a0524411292a", "comment": "Malware payload (Mirai)", "value": "6c29e53b5e53ab35d8c7477709b5f4241ef099af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631389084, "uuid": "9f259a6a-746f-4781-801b-d0eb60ffd6ff", "comment": "Malware payload (Mirai)", "value": "227006254638433ea9533ed5c8cfbe96196eff142693dfe131c269537471e3b8bf2f3bb66909ad95de7be30173e4df0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631389084, "uuid": "edc308c6-04c4-4b7b-b31b-132c1f222768", "value": "T1CE634B0232284E17D1E70AB0253F2BE183FEE9D021F4F685255F9B664676E37548AF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631389084, "uuid": "f416c398-5e60-4697-9a2b-7fa16fa95d86", "value": "768:/q9Krud97ChEdLGi0MUrgNjlR7ZRIUE7pG7PXOZpyrI5zALBKMs8BQbNmFI023fE:MCeGZF0NjlXVE71pjA1ybNXf0GzuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631389084, "uuid": "b68bc89b-ab0e-41bd-ba91-009fd148e754", "value": 72304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631389084, "uuid": "7624fdf9-e97b-4155-bc9b-20280dff6629", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631389084, "uuid": "3c9d83f9-6ad3-4371-bb22-0d3ccfbff062", "value": "fde285bad565f25dc0ec286324495543", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b594d19-12c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631341281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341281, "uuid": "f50c9316-8081-4ac0-9157-c0db04d14be6", "comment": "Malware payload", "value": "ab1770af60f6daabe6465ef249992169", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341281, "uuid": "ae417096-e335-4b4a-beb6-c343662b0911", "comment": "Malware payload", "value": "0a74a0e71930da1613c95a45c1397cb40ae642fa75a6fe36f5dc4b2cfee6f5cd", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341281, "uuid": "1199f5d3-8754-4b61-b8b1-3ee31483afbf", "comment": "Malware payload", "value": "0b0a53cea357e5758c3d77bd19e90b6339e70668", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341281, "uuid": "d172b2d1-915f-4f95-837a-9145cbd1b2ba", "comment": "Malware payload", "value": "d9661aaf8a66a7514bb47b5d93dfe5a8303b7b2470d8cc39059dfe78a61ad51f7825fdaa488144ecca413dad74cbab6d", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631341281, "uuid": "b0192bd3-fb61-4ad2-b0c0-8069d99bd08e", "value": "T113942305E8287888DE7270FE77A8FFE41451FC899E2525F217B911F19CA9DE0F08A721", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631341281, "uuid": "e64a6442-29e5-4241-8686-6ad32667d698", "value": "12288:YkZbwoLjijvUM9hSNYFblzRNIODex4cuUTg:JbwoLjAUMHSCblzvIODUu8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631341281, "uuid": "6449c48c-d7f8-4809-a850-3cbaf19ab9cc", "value": 434485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631341281, "uuid": "06a88866-e3f8-49e3-986e-b426143c5850", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631341281, "uuid": "38050734-acea-4b0c-8b23-41f168d76c7d", "value": "awb-1330740456.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd24d09f-12e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631352988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352988, "uuid": "73b31b1f-80df-47e6-a388-21019284fe43", "comment": "Malware payload (Mirai)", "value": "c74d023d4cfcc7fb3adc12b8c779f694", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352988, "uuid": "162c7ef3-ac4e-456b-a72c-ef4d32c5ae13", "comment": "Malware payload (Mirai)", "value": "0adf43a3ebff9cae2f902aac69dd66986b84a2c803e0c07bbb321eb366081d93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352988, "uuid": "b88cee2e-ead1-4f70-a2ab-eafe8681e823", "comment": "Malware payload (Mirai)", "value": "836bdc2268a33f19d917e437e746028d11ac95b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352988, "uuid": "19d8f032-3115-45f9-8c50-a486eb548974", "comment": "Malware payload (Mirai)", "value": "0afd44be32e808ab41ff4f6f0a2d7a2203f86736b049c0e73928740690d65af31038df2c39e82d5eb633084aaec6002b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352988, "uuid": "3a58a673-49f9-42c6-9725-71b76e7bd8af", "value": "T16AC32993F800DE66F40AEA3605D74725B630FB720F531A7263573AA69E362E47827F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352988, "uuid": "a68cd7b3-df8c-47e9-bfef-cfaf487d3b78", "value": "3072:8EiHDFHe69owRBpE2yI2YJ3sPrILmvI0PDGnSQNER:8EiHD9e69owlyIDJ3SkLmvI0PDGnSQNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631352988, "uuid": "9ed9d5aa-3794-479d-8ef8-1ffb4c910eb0", "value": 118298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631352988, "uuid": "e040ef2e-046b-4ff0-b9da-0540058ea477", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352988, "uuid": "2214b43b-409b-448c-b198-e21c16087cf3", "value": "c74d023d4cfcc7fb3adc12b8c779f694", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03fcf2ec-130c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631370286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370286, "uuid": "1804912f-6f1d-49bb-b408-a8a8ed031d04", "comment": "Malware payload (Mirai)", "value": "ad13e6f282b3138e00ae8c317baf6715", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370286, "uuid": "d7d13f5f-2de1-47dd-b931-b356b8f532da", "comment": "Malware payload (Mirai)", "value": "0bcdaa1737dec39dd21feed07061c190bf8f438979e39179ca5eeaa9cc5bf118", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370286, "uuid": "6fc39b77-bcec-4010-948c-ecc1d515760a", "comment": "Malware payload (Mirai)", "value": "34be2c86d9db793a4c4a2cf88101008479e4afee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370286, "uuid": "9b2a195e-48f4-4f3d-9c2b-5c9e5f614c92", "comment": "Malware payload (Mirai)", "value": "168f138adc8e1782b4b10ea74e11a5ed779a42eb76645ff7f9462d272a90d102a60c25696ecb0777fba181d3cf0f10fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631370286, "uuid": "e908f291-69ea-412e-95e6-f2a784f087fb", "value": "T149F3962E7E22AB7FE168863207F76F70C39521E726919382E16CD6585E7134C1C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631370286, "uuid": "9f4ba457-74af-4453-8cbc-6e2c3e0ef201", "value": "3072:eiv8Mnik6o/P3YBoPfdTlW/8uhmvjKq8ebUz2j:XEMH9H3YBUfdRSDhmvjKq8ebUz2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631370286, "uuid": "e6506af2-8ae4-4d90-a2af-977ae412a5f9", "value": 160642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631370286, "uuid": "c944d14f-17bf-4f37-b643-cb4a593c7ac3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631370286, "uuid": "c64cfbdb-86bd-4032-95f1-fa6f615c2898", "value": "ad13e6f282b3138e00ae8c317baf6715", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11fc37ca-12d5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1631346688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346688, "uuid": "3b2c906c-273e-4221-b065-84e52347d26b", "comment": "Malware payload (a310Logger)", "value": "7e016097a1123f48ba3d36b09b626190", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346688, "uuid": "0a7d57bb-2c85-43c6-a3b8-610c392b270f", "comment": "Malware payload (a310Logger)", "value": "0e0ccfc2fc413a387f833261d58ce176fa8178d30709b183f65cd255933f2172", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346688, "uuid": "f535d7ae-876e-41f7-823e-0b79b8cbcba7", "comment": "Malware payload (a310Logger)", "value": "9aea4a68624bf33b9ad957c7d9fc8ab26cc9665a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346688, "uuid": "e11eb172-5251-417d-b131-e5e20be54a7a", "comment": "Malware payload (a310Logger)", "value": "3511fd77312011c2cc4edaf99cc29a3d1234e2c1f2c6ad8d7b80fb73785eb0c3c067eb494361e3cbdfa8cafe6a29b9f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346688, "uuid": "ea8ea90b-124e-430c-8e4b-2c317a8485e3", "value": "T1ED55AE326BED4D04E59E1BB490707630D3B8BC1B66AACBCED848B96E5C33781A451377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346688, "uuid": "018d71e7-3182-444a-85c7-2f3aac9d336a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346688, "uuid": "d8c4fb05-7ddd-400a-9478-fa942c00d14e", "value": "24576:k8j9LpXk+b6umJBDAJeqtgzKmtwpfw77ztazgfoXXZb6GazF:kw9LfqBDAfgzxcI7hBQXbazF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631346688, "uuid": "a7e7db69-e813-446c-8059-259cb3214dfd", "value": 1324544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631346688, "uuid": "1b22587c-c41c-41fb-9a2a-15f60d57f69f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346688, "uuid": "8b9170ef-6c79-4f6f-ad86-fbe5a84db076", "value": "7e016097a1123f48ba3d36b09b626190", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d930ae-1338-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1631389375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631389375, "uuid": "a4f7f965-2de4-4b09-98e9-5cb3e34744c4", "comment": "Malware payload (CoinMiner)", "value": "9774cdf92008b796b09b39ee32e48821", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631389375, "uuid": "3e85b1ec-3501-4479-bd79-a608ba55a143", "comment": "Malware payload (CoinMiner)", "value": "0f29ab9350ea8ef259a4bade5c1f7fa4f7850ad75f123ee868c7d581817fd02e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631389375, "uuid": "d7d35012-d308-4af7-8161-e2646af97bb3", "comment": "Malware payload (CoinMiner)", "value": "24653206d995c907ff8e6f5f4eed7fb1c36cb33e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631389375, "uuid": "3425f39e-f129-4edc-b873-5875541ffd23", "comment": "Malware payload (CoinMiner)", "value": "ec0637aea95f79e10ffff06372d727432f1a9617a0a93de1dc7d933995a3fed6f4f5a3018a1bb36e7ce2b61979832bfc", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631389375, "uuid": "0beb5d01-0b7e-4496-80d2-5afe498e697c", "value": "T1A33733DAAD0DE738DA300D6D1820224F9F90D27B5284CC37B549914EBDB26B69EFD127", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631389375, "uuid": "6e4da45e-914f-4623-af43-ed6f834b3ec0", "value": "393216:z8Y6FB4KRu8ysEmoydsxA1YIS5nxX9OvtoaukC+dAt+MUOBwdT2lPsLUX5:aBRuFTLxAonLaoaA+dAt+Mbad6lPsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631389375, "uuid": "2a855aba-7143-4d23-b660-a157f2430724", "value": 22619648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631389375, "uuid": "56d96e64-d943-4e5a-bb63-fe1c5d7588aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631389375, "uuid": "cf6e5d52-b00a-45eb-b69d-7481ea69361c", "value": "9774cdf92008b796b09b39ee32e48821", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d08525-12f9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1631362394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362394, "uuid": "3813d31b-49a6-4c16-aa76-574dae7b1558", "comment": "Malware payload (Gafgyt)", "value": "0116e4a67eae16163e6f42997da19764", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362394, "uuid": "7847df34-6b61-4aa1-8ffa-40ab7c0ee274", "comment": "Malware payload (Gafgyt)", "value": "11cba4232423b44c2c1257b956ddbddbe1f2a04339d0bd992d8cd06fca858920", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362394, "uuid": "06c3d301-5143-4066-a33b-2d55d685551d", "comment": "Malware payload (Gafgyt)", "value": "ef395a69af23bd63aa9f3eeb8d5167224945e3fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362394, "uuid": "cc012a07-61c9-4b94-9a67-f063c216f966", "comment": "Malware payload (Gafgyt)", "value": "1dc2c261870ce766eab3667cd8a9610e089b2dee33f76e78b4d2785c21050851c16b43a83d820cd2be33227fc75de61c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362394, "uuid": "9813f098-076e-4f95-84b5-2885d9ae1ef3", "value": "T19D932A03771D0F83C1CB59B129FB27F19769B9E502A36181A91BBE905B33A782513FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362394, "uuid": "fa5bd106-9c77-4f2a-a21f-f5b6521c11df", "value": "1536:a347i0UzozNrQ35XeaaV8x6IfoSIhKh+wT5hiWXTL9mQmV6qDjjoflee:aom0GozKuDe6IAS9D5hiWXTL9mQmV6qA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631362394, "uuid": "a9ec9868-5c4a-4e36-9812-fb0e1fe2e554", "value": 89920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631362394, "uuid": "34f81007-cbfb-4627-b13e-3a8c17180383", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362394, "uuid": "f88b9996-a929-4cac-a5b0-3dc13090a40c", "value": "0116e4a67eae16163e6f42997da19764", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "270f090d-12b3-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631332120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631332120, "uuid": "c6a34560-4348-48b8-b9c5-aef341eaedd8", "comment": "Malware payload", "value": "ae20da9a88c7624a6b3f81a20bc8065c", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sidecopy", "colour": "#84635C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631332120, "uuid": "0efbb4a5-e034-4e94-b2ba-913f90860235", "comment": "Malware payload", "value": "124023c0cf0524a73dabd6e5bb3f7d61d42dfd3867d699c59770846aae1231ce", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sidecopy", "colour": "#84635C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631332120, "uuid": "39b986ec-f68f-4a92-a802-4bc3835a324f", "comment": "Malware payload", "value": "34d3412727fa1053661e0b17632eba3c160e77bc", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sidecopy", "colour": "#84635C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631332120, "uuid": "e5267467-0894-4836-be51-2b3e0fdc0842", "comment": "Malware payload", "value": "8aaaa057a168e48e30ae5cd7396509aa9c41b15d194c02953ea9d9a9c0cee1014d776673348d2985584f21e428db939c", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sidecopy", "colour": "#84635C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631332120, "uuid": "ccdef701-14f6-4f0a-acfe-164ed744264d", "value": "T159D33BFEB2BCE122D18B41356665D7A2C6337D3E5B53F7212AD8765817332B18208E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631332120, "uuid": "46f6557e-6701-4c78-9e52-94b8f0ef2462", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631332120, "uuid": "dfeb3bf5-93dd-406e-b097-b7ae45f157f9", "value": "1536:SKsxt6D6SRRSBOksZHaSLs/UdikOK0U9fEzt:SKsxt6D6SrSuZHaSLs/UdikOK0U9mt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631332120, "uuid": "05d03fd4-c8f9-4421-bcc8-d8c3bf65e0de", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631332120, "uuid": "dc29eb94-ba90-400d-8ed7-22820442f4db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631332120, "uuid": "474296e4-a571-41ef-8c52-335a436fcdb7", "value": "#APT #Sidecopy #BackDoor.SiggenNET.sample", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92625acd-12e9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1631355493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631355493, "uuid": "7e0692c6-ec51-47ff-a7e3-5e5c63ea97a2", "comment": "Malware payload (AgentTesla)", "value": "4a1e60481534959bc39fd5b492f050b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631355493, "uuid": "13d9af16-880b-46ae-85d8-ac270f5a8241", "comment": "Malware payload (AgentTesla)", "value": "1275762d43e5076e465aa230fa9763cd9b76add7a3dbfa3eeed8f9464f2e1eb1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631355493, "uuid": "2d25b043-536e-4088-badd-dc521fbb7f04", "comment": "Malware payload (AgentTesla)", "value": "5c1f955f08af250a110913b5cc6c120e5cfe85ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631355493, "uuid": "a7828966-314e-4680-8833-e439ae8238b2", "comment": "Malware payload (AgentTesla)", "value": "59125bee0a1f4772c07cbe734a901e1dc7eb8a578b3b11416d9dcb652794b96f3c7aa01e4e0fcf23ed6d619707038643", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631355493, "uuid": "d502ed81-4718-4426-96b7-182410af107c", "value": "T134F428343AEB901DF273FFB95FE434D7AA6FB6633606A45D109103860A23A41DE9153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631355493, "uuid": "dac91ef8-4033-4303-aa55-5ae2fdf54852", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631355493, "uuid": "87a247c6-2a7d-445e-b770-466d3c7a59be", "value": "12288:BnXgZRO3+VUPObK1Cnf2VtYLrlz1+e+CCnnHey0qjOzD83SsxjGfadhm5IFh:NwZWHwlhqHehCqD8LdpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631355493, "uuid": "c9866893-7a0f-4f9f-9184-b328aaa39894", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631355493, "uuid": "ba15e286-1d3a-46d7-8d8e-743a6336fcdc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631355493, "uuid": "8c6ea0b8-d06e-4fb6-89f7-5309c13c1a9d", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14785f1f-12e4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1631353134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631353134, "uuid": "eee6dd95-d9e6-46e6-bfe9-de0c383c39de", "comment": "Malware payload (SnakeKeylogger)", "value": "c78dc582473992e26b204107ae9352b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631353134, "uuid": "1a620e91-abe0-4521-8c8a-f9f5dff13a49", "comment": "Malware payload (SnakeKeylogger)", "value": "132482335f028ceb6094d9c29442faf900d838fb054eebbbf39208bb39ccf5ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631353134, "uuid": "c2d97d62-a0c7-479e-aeed-965468fa76b1", "comment": "Malware payload (SnakeKeylogger)", "value": "392597dabf489b682dd10c20d2d84abc3b49abaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631353134, "uuid": "5bb412d6-9894-416c-8dc9-6155e6ae998e", "comment": "Malware payload (SnakeKeylogger)", "value": "9b4bcd94350ce6cded779e50fa126635f4d075a8ee2deba973e0ed93461a1adff52b5a1a5e49d7eccff63998082246d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631353134, "uuid": "d08ab023-6dd2-464a-87fa-013de800f272", "value": "T112E407243AEB901DF273FFB55EE434D6AA6FB6633606E45D109103870A23B41DED163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631353134, "uuid": "d4799aa1-64d0-4b30-a535-4365192af86d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631353134, "uuid": "13409c54-3774-4dc7-957f-9d59c2acda43", "value": "12288:DEO3+VUPObK1Cnf2VtYLrlz1+e+c8IvDUoHZiJ7RGN9PqxbJyB2k9DE:/Hwlv8IvQoHZiJ7EO1kB2sDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631353134, "uuid": "ea77f964-d9dc-4671-a113-3fe385fbe249", "value": 691200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631353134, "uuid": "6a1b9c2c-a2b7-420b-9879-b7abbe708677", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631353134, "uuid": "9ea789a4-cf28-4491-849d-f4c3890603de", "value": "SeptemberOrderlist.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1dfff1-132e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1631384905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384905, "uuid": "26e6f295-77cb-441f-8d0f-5e431a9e3f93", "comment": "Malware payload (NanoCore)", "value": "0a70dcc13c355fa22933b6b545550224", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384905, "uuid": "8ae53f87-fcbc-4faa-bb13-d47b26e7c88c", "comment": "Malware payload (NanoCore)", "value": "133b41483de61855d7b8723f773f588812f111ab76290fe31854f9e19d421f80", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384905, "uuid": "931b3f88-d736-4e32-a06c-f755974dfdac", "comment": "Malware payload (NanoCore)", "value": "1511f4fe84f67536046bab761335e6437f0b2975", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384905, "uuid": "aa90968a-cb46-4152-8284-467259464e88", "comment": "Malware payload (NanoCore)", "value": "8f15922cac516849933c9717f78a2baf819fa220794a2ea40b7cf945baa6180a5fb41a90366a33f3257f7b0598daf380", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631384905, "uuid": "f4698896-d030-4b82-86db-ac0becd1aac5", "value": "T13D9595F1FE543ED80E1DB6D0123C7BEA3C1A4A97DD09E50A7DE106A074368F56EB90A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631384905, "uuid": "f5eebacb-aace-45e7-bdc9-2cea2482f2f8", "value": "24576:e8srvAia5WrV0Fw/TWGHVmVnQeGDbw984XnNAhCROAoCFb0WNNyx5USc9f:xiaTGTWGmpQfg98cyQ10L8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631384905, "uuid": "14ae792b-5808-424d-8209-35bcd8ec6ea6", "value": 1878433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631384905, "uuid": "5068e933-7749-41e5-8597-531a4a45dcd0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631384905, "uuid": "7353d105-7cf9-4843-a38f-e266d112876c", "value": "09112021_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430a9c68-12fa-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1631362661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362661, "uuid": "42f4ee61-1d59-4655-bc16-626d45e69611", "comment": "Malware payload (Gafgyt)", "value": "e91bcedfb4415ad8bf523eab0aaed94c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362661, "uuid": "25635986-96fb-4ded-a0c1-80a51f16e672", "comment": "Malware payload (Gafgyt)", "value": "167e4f945d150172febd2d559e381f12e755b8df374d30094d2da2f2aa2d1c94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362661, "uuid": "ebf8608b-e83b-472c-8142-e3fd39658d6a", "comment": "Malware payload (Gafgyt)", "value": "60f37c7eff4f7e71bc5ffac7f89e2fbeec34aaa5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362661, "uuid": "b8f7602a-e6b6-42c4-9ede-819dc40b797b", "comment": "Malware payload (Gafgyt)", "value": "352d8cdf46989d230058930a85c6e79269db9f66243efa1565fedd915fce3f81c51e39a67d6fd706febf0325009d1b47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362661, "uuid": "2fdfab99-05bb-4bb7-bb32-d7df4b77597c", "value": "T1A5A32B05F9114763C1C327BAB68F474D3B2267A957DB3302AA357EB02FC27991E25A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362661, "uuid": "35a0a8cf-28e9-42b3-8c82-6a4c22ac2f30", "value": "3072:IG8es2aOt85haG4uKtvmCyrQ0Knm4XnTe:oeKOt85h6uKBmCyrQ0Knm4XnTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631362661, "uuid": "b63144e2-45a9-491a-91ab-3067a5c0d543", "value": 103742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631362661, "uuid": "509b0c6f-3fe4-4743-9e20-67b801de9233", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362661, "uuid": "6bfb4c0b-b8c2-43ed-8892-5e0c0e39f158", "value": "e91bcedfb4415ad8bf523eab0aaed94c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71bca23-130f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631371929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631371929, "uuid": "dde6ff3e-f22b-4845-918c-d11653bfcbcf", "comment": "Malware payload", "value": "9ad8c7cce30ba9a95ec2422cfa54b973", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "TeamTNT", "colour": "#6D445E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631371929, "uuid": "b303c1f9-d967-4228-a65e-7ea6d63673d3", "comment": "Malware payload", "value": "19bf6023c07eac0aa88793a3322cfc32385bc00360cedff41c1f8c1f724cc8da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "TeamTNT", "colour": "#6D445E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631371929, "uuid": "90b3c1ed-8f47-432d-9a65-a74e97bf007a", "comment": "Malware payload", "value": "2d2459e689f07d358740932d2c083cc3cc413b36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "TeamTNT", "colour": "#6D445E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631371929, "uuid": "5dfde8cc-1cbf-4770-9f9b-50422fb0158c", "comment": "Malware payload", "value": "6547ecdfa75a9918f79987f858e86478765d1836fa07c8e6455093de837024eb8ca2ba1a3322b7b4769aa4dbaba3c85c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "TeamTNT", "colour": "#6D445E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631371929, "uuid": "cf862e32-2279-4ae8-8eae-ae0cde161aa2", "value": "T19EF33A0776E108FEC1D2C875879FD1A29D35B4910315393F798AAA723A6EE301F1DB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631371929, "uuid": "da51d9ae-0d0a-45dd-b894-e20dff9944f8", "value": "3072:erGCYFYtMqD68hp82BqKNkf+wcoot11jy88jUppiWSIonnCgEM9ftBZwXZflvrH4:Ep8Wq8kf+wnot1qq6nyiBZqTH30h4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631371929, "uuid": "c0f8e7e8-d165-4c1f-b2cc-ae547004b4bd", "value": 169448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631371929, "uuid": "8e700390-6601-44d0-a185-ed1c34758ae3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631371929, "uuid": "c989aa49-e54c-4f06-b97c-571250f0dc1c", "value": "x86_64.xmrigDaemon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c45545-1308-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1631368843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631368843, "uuid": "944ad36a-4bfe-4c9f-a2fd-21c51500d16e", "comment": "Malware payload (NanoCore)", "value": "d52ab1a834a7c98038b62653984b9d9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631368843, "uuid": "4e39b169-3329-46f7-ae0f-535f7a7fd678", "comment": "Malware payload (NanoCore)", "value": "1acc33db801054b60eab3f53788882563ebb7ffeb7a8b9240e7c1780361ed7b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631368843, "uuid": "4bd6d7f2-0878-45bd-822b-342e06b4240d", "comment": "Malware payload (NanoCore)", "value": "45f07ca77ddd5691b8ebc7052c3724b54a83c3a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631368843, "uuid": "cb32de4d-db9e-4552-bd1a-9553ee66eed6", "comment": "Malware payload (NanoCore)", "value": "156e9377bb757e4eafeeeccf06ba3fc4e1abbe0bac7a6fbffd132a9c2f99a14859b4fc50cfc8aaf56cbe2d99236d349f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631368843, "uuid": "b8daaac1-88e4-443e-b320-acea72964144", "value": "T1DCC4026537A8462ED1DF86B9701256179779C2F69CC3F3DF18E816BA4E2A7E00A071C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631368843, "uuid": "5039f1ef-dfb7-4a0c-a1cb-913aae0ca50c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631368843, "uuid": "00fea097-9865-4936-be33-9251e8dcda09", "value": "12288:QLV6BtpmknRyH2l1vUVyEtMIzNr26VDWXZqlIiAER:CApfRpl1voMudVSAzA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631368843, "uuid": "bdd7bd24-74cb-48c4-8e91-0aa8b66f84f7", "value": 566272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631368843, "uuid": "3a1b7f71-5b0c-4ecd-998a-6a1f5b7fbb9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631368843, "uuid": "adf2890d-9d19-418d-960f-611437022e9a", "value": "1ACC33DB801054B60EAB3F53788882563EBB7FFEB7A8B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9618ce49-12a6-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631326723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631326723, "uuid": "85e5d82a-5222-40b7-a024-85e7655128f8", "comment": "Malware payload", "value": "547da30fa5d1ffb8f7cceca7a2b1fe86", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631326723, "uuid": "7b0e3909-0234-4484-8df5-6d29c7a0bc2c", "comment": "Malware payload", "value": "1ad5818d34e19d939c23c6fb4a24a834ade7c75fc270a938b726cc4392539bce", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631326723, "uuid": "2bee0e19-20ce-413e-aa73-5b4345c42c4d", "comment": "Malware payload", "value": "b95ada46c5fcf87b58ee341cb0de79d738257b16", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631326723, "uuid": "cb606c7d-fac1-45eb-9143-baf042cc712b", "comment": "Malware payload", "value": "f6fb570909e355d291f224bf5de4902469bcc5bedcac0fe582cb0f097fdc4c35e1d552d2fb4084f4e9af4634be9e18c4", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631326723, "uuid": "80456f44-e418-451e-93d7-c6efb8d727f2", "value": "T1A4C211E7B6C6AC45CE59033948A787A06727FC215B67838B3389F7161FB1BC08A43657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631326723, "uuid": "355a171f-eecc-4316-ae17-7d33b4ed15ea", "value": "768:ePpRk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJeq6M:irk3hbdlylKsgqopeJBWhZFGkE+cL2Ni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631326723, "uuid": "0126727c-623e-47e5-ad77-16419221b85f", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631326723, "uuid": "ed5c2393-841a-4bcb-8ad7-6cb2f6e88dc0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631326723, "uuid": "3027dcc3-10d4-41c0-ab02-b7e95471bcce", "value": "SecuriteInfo.com.Trojan.Malware.121218.susgen.12402.11514", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a25de24a-1305-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1631367546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631367546, "uuid": "e40b1c9f-fb21-473c-9706-7bfe31fa9158", "comment": "Malware payload (RedLineStealer)", "value": "4441d215388a2e04e4c81d021d0df319", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631367546, "uuid": "89b267b6-3c43-43a1-835a-629e9db3c18f", "comment": "Malware payload (RedLineStealer)", "value": "1bcc9e741ac9edde926319d56070589a987190a4ddf32eeca74ff3419bcaa49a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631367546, "uuid": "717e2f91-1da6-41b4-9181-5f349b1555a7", "comment": "Malware payload (RedLineStealer)", "value": "3bb39948844adf64c159b1f5efa1394a57c4d3a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631367546, "uuid": "baf88614-f4ce-44d2-83f5-4d5b3f6813db", "comment": "Malware payload (RedLineStealer)", "value": "61f9d54b57be82c6b8f0cd79d30e8189644b77825828bb2198df11fd8fb07021e18e99b203b9f789a5c1967ef8808593", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631367546, "uuid": "e7c6f670-6920-405a-b7b6-13efd27e0d79", "value": "T1CC84AE20BAB1C035E9F752F459B983B8A93E7EB1AB3050CB53E156EA16346D8DC30753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631367546, "uuid": "ab9ae817-8d3a-4c54-8512-362d1c39063b", "value": "7dedca7bc07f096eb3cce2bfad6fc32b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631367546, "uuid": "ea92c905-4c2d-4a7e-a823-0f1b833b8959", "value": "6144:yKlinoPhyrEmom1Yv2COPFRLeRzOgUj9vExbco2OFxDB3qlF:jIoPhyrEe1k2f9BeRzi5aqsxDBal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631367546, "uuid": "e6cf4705-c6da-4639-8da5-6fc91104b580", "value": 394752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631367546, "uuid": "2f399303-6b3b-462e-bb09-b22c3a374dba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631367546, "uuid": "d65c203f-83be-42cd-9713-cf276a244f21", "value": "4441d215388a2e04e4c81d021d0df319", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c26260-12e2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1631352385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352385, "uuid": "6b18731b-6cb7-409c-a046-ca4ca4797369", "comment": "Malware payload (Gafgyt)", "value": "e7dbf036a832e52befed6aefa870ffba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352385, "uuid": "938c4a07-5d86-434e-abe6-0712d3c197b0", "comment": "Malware payload (Gafgyt)", "value": "1c978be2c18fe3bf6de1cbaf17e05249c2ba1f9900b66de3a4de5bad3e0a232c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352385, "uuid": "f4d0ffd0-ac0a-42e0-8e9f-e598c0269ab7", "comment": "Malware payload (Gafgyt)", "value": "9457220f6eca323dbf08f1a461cd3bf704705cee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352385, "uuid": "b2c2c19b-91e0-437e-bd37-a748864d57b3", "comment": "Malware payload (Gafgyt)", "value": "c72ff16d9ce8c6de77c90555ef7ee0826585b3c1e5f8a756d32025642400c392e955e213d86562913bb697ffc97a43f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352385, "uuid": "1b4bcb9c-c008-4da4-ab87-bb8ddf834f2b", "value": "T1ACB34A57671C0B43C58B5AF12C7B37F187ADEA7112E225C5A40EBFC01B72A701626FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352385, "uuid": "285596f6-b127-4d3b-b76d-204f7549cd43", "value": "3072:JHXrsU7PNZMHNrONBbsQN5hkqu4CK2QnI0PDG4gQNcR:J3LTMHNrOwQN5hkqH2QnI0PDG4gQNcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631352385, "uuid": "6b79deaf-3e46-4b0c-845d-eab7e77e3abd", "value": 116369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631352385, "uuid": "625f41b8-c983-4458-92b7-82120f06f49a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352385, "uuid": "da9707f7-c5ac-47f6-83e1-7416d91dae40", "value": "e7dbf036a832e52befed6aefa870ffba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe885f6d-134b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1631397765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631397765, "uuid": "2dcec9d4-e9dc-4a60-ba27-f22406ce9dcd", "comment": "Malware payload (RedLineStealer)", "value": "a76149aa47d21e9425e8ba56285dbc2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631397765, "uuid": "3f22e6ab-375e-4b63-bdca-5b84df663130", "comment": "Malware payload (RedLineStealer)", "value": "1d8d875f0e1da3d678c0074a063d9d06d1c097e0ca986579f76b0df2c64ce93d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631397765, "uuid": "c7f10939-612c-4061-a8e5-838e5e30a129", "comment": "Malware payload (RedLineStealer)", "value": "fa37954291e13e285dd61758f1a8a91f3612c446", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631397765, "uuid": "c1c57c4b-9eca-40ca-b5ff-b6635de1b6b9", "comment": "Malware payload (RedLineStealer)", "value": "e36d929afe26ec945dcbf6014f78fe1d406bd44a45b8d2313d5c4f26d5d318811a0fc1dd0bb4addf89fc9b8930602fe9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631397765, "uuid": "779f1045-6b93-423e-a254-fb5c6fda0894", "value": "T1ACD4DC2466BFC019C4E7EEB12DDCA8BAD99A94E3640D76331174633B8B11B84DE0F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631397765, "uuid": "e39d03b4-cba0-4c0d-9eb0-2f241b22f93b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631397765, "uuid": "f32d20f3-146b-4950-ac95-3d807fd00ff2", "value": "12288:cG3fXU3C7b94xVC/hOndDUAvyCpkKJaLKpihxTEUZW+xowJYzu:cdkBedD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631397765, "uuid": "ab1f36e2-0a9f-419c-badb-ed52732931e1", "value": 637952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631397765, "uuid": "3060b414-dd41-40d4-b5e9-43ff78fa9c43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631397765, "uuid": "82ed8f64-0a7a-47a1-8928-3c157b77fa49", "value": "a76149aa47d21e9425e8ba56285dbc2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20260053-131a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1631376347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631376347, "uuid": "30ae5505-db95-44ee-8a5c-6e6623aba4fa", "comment": "Malware payload (njrat)", "value": "de3d6958f101e3b252f18168f240480d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631376347, "uuid": "6c68a27f-5211-4452-bc57-eefd2be28ffe", "comment": "Malware payload (njrat)", "value": "1e73294675f42df94d101ece8c550fcfa2746ae6f8bf3261e16d315c5d8de832", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631376347, "uuid": "9874feda-3dbe-486d-a3ae-bd38e0a5ab2d", "comment": "Malware payload (njrat)", "value": "4a2ff6b9018df0b31db61ce4f5a6d844c05dc3ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631376347, "uuid": "cf9902bc-5f00-4ff9-ae07-9306c90909dc", "comment": "Malware payload (njrat)", "value": "5673b27f7b1ff9ca814216c9dbc42160f7ccd4580cfde8b5a3f28d9d5c556148f77b9d794aa62332efc12340bfc67f1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631376347, "uuid": "67c733db-6c86-4187-950b-0e0ad251b58f", "value": "T1CD050201F6C28872E4721D365A366B04AE7E7D301F28DA2FB3E44CADDA755815634BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631376347, "uuid": "37e88574-ef97-4ac1-a347-bd3967e8a40f", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631376347, "uuid": "d9a4df64-4eb3-4c1a-b286-b91538c51f11", "value": "12288:BQnk3GDYKGcbloXh8I8NrcimffmgMlKz7qwTrm3XFQYncgPa6yJggRpFs7nC:rAOcZAhrMQZNM2GwTq3XFQYcqa6lCKjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631376347, "uuid": "f455f4de-8913-4ef1-ad16-cb882a282d88", "value": 839051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631376347, "uuid": "96754163-ed14-4d5e-bd19-d3318e0c136f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631376347, "uuid": "a0b188ea-58e4-4749-b9d2-a994bc23df80", "value": "DE3D6958F101E3B252F18168F240480D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ef6957-12c4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1631339443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631339443, "uuid": "95189829-fce8-46de-8703-bad650a24cd0", "comment": "Malware payload (RaccoonStealer)", "value": "f5adcdbb7218943286f8ecf304a6e01e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631339443, "uuid": "47d083d5-b0ba-474d-b281-f39f1fe238ac", "comment": "Malware payload (RaccoonStealer)", "value": "1f33aa224f3464124f8f62a38f34e907e38d85af939cbb9156d058e172b6de04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631339443, "uuid": "21c9ac0b-a562-48b3-bcd9-6dad3be804ed", "comment": "Malware payload (RaccoonStealer)", "value": "d90b467c3f4f2237881e7d849f8e9bc98ad49025", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631339443, "uuid": "6433db3d-1e65-45bd-9b95-a9fca3843814", "comment": "Malware payload (RaccoonStealer)", "value": "896ca4f72faced2301944e31b76056b5012f2f13bb328103e76ea8d307e52d5f4f47fb35e817f7c0ff94cd8b0a97446d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631339443, "uuid": "58bc52ca-5665-4f30-9224-7534f37a95de", "value": "T1A4C4E030B6E0C035E4B712F899BAD3B9692D7EF15B2051CB63D12AEB56346E88C31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631339443, "uuid": "23086328-b771-4cf2-b38c-3c09b7392806", "value": "69566d56ce8187d49438dd02ea591694", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631339443, "uuid": "4d351704-d516-4cdb-b0e6-fbad6252b4ea", "value": "12288:hMQeYtxZRA4YSFX6EKWBh7rvv3LdujWJxckTEPM:aQe8SHGrH7Dx8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631339443, "uuid": "e52a0814-b1c0-44de-8d97-dc1468b7b0b5", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631339443, "uuid": "e77cb3d5-bb46-42fb-a064-deaca7bbe16d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631339443, "uuid": "d86939dc-7b86-4496-b3c4-57927afe3fce", "value": "f5adcdbb7218943286f8ecf304a6e01e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311273aa-133d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1631391407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631391407, "uuid": "98a96d71-dc9a-4fef-8c56-ed123c1edce2", "comment": "Malware payload (ArkeiStealer)", "value": "3ccf44c470e00c5f42ca53044a0609ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631391407, "uuid": "e231468f-b85f-411a-8b86-7ea7d473e3b9", "comment": "Malware payload (ArkeiStealer)", "value": "201b9ae09934efbe33dd9ac919d1a6600cdf336bf60ea50c8d2078caed49dfe3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631391407, "uuid": "362dc3b5-601b-4bbb-b791-6933e9a51b8b", "comment": "Malware payload (ArkeiStealer)", "value": "66f43a87c7166f1c7a82460543847fc50b195313", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631391407, "uuid": "ae14288c-b541-48f4-a9ae-02d6e15cfe57", "comment": "Malware payload (ArkeiStealer)", "value": "02e86bae6a9f5e41c284a2039030c011a43aa4fa6f93b893080c9c3be1e37942480c41c1b1960786d903b24b899c94e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631391407, "uuid": "74a5b069-13c8-4282-9e1e-c7b663950c35", "value": "T1E9F4F120A6B1C035E5F361F569B993F9692E3EB15B3050CB22D42BEB6A342E5DD30353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631391407, "uuid": "dba59aae-acc0-449d-a10e-cc8914afcab0", "value": "69566d56ce8187d49438dd02ea591694", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631391407, "uuid": "47783c38-70f8-4dae-a91f-17dfb95c2962", "value": "12288:JhADa9u8u86WVmbFcuuiyWiQfVescboK/0uMV+1Es5JhrMpQSAe2PiukC/gTBSY:zADEr8bFpTiwVWK+as/hAaaKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631391407, "uuid": "f4a8863e-5f84-46d4-af0d-d19bc7176eb9", "value": 756736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631391407, "uuid": "4c40d164-95ba-45e8-bdec-b5ce3e5923e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631391407, "uuid": "ca0f76ab-983e-47d6-bba0-8ece24a74e7e", "value": "3ccf44c470e00c5f42ca53044a0609ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4951ea93-1328-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631382429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382429, "uuid": "fefcc4de-348a-45d0-b1c7-f24ea3d711e6", "comment": "Malware payload (Mirai)", "value": "03056bd94166aa924ce2a95b180adfd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382429, "uuid": "b8fabdac-b4ad-4a53-a818-631f78c961ce", "comment": "Malware payload (Mirai)", "value": "2083a5f39104c1207137785efdda03032abbf3a614c4e92da2bb0a18e6a31f55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382429, "uuid": "df046d95-3046-46f2-89d4-c07469b9a995", "comment": "Malware payload (Mirai)", "value": "e29ef85916390379398ef32c28b2ba9543402499", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382429, "uuid": "3139351e-b1d1-4fb3-9ce4-e33b2bee998c", "comment": "Malware payload (Mirai)", "value": "4520a5046e3b60e68c0e7394b61904863af0e07e628bb81e48c93d3bbd86a5c78c253badb212042b85a28f354149a49e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382429, "uuid": "098c5d01-51de-4a59-bebb-b173e3122c44", "value": "T1B53329C4B583DEF9DC1206743076FF334FB6F1B6211AEA87D3A49523BC52542990AA9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382429, "uuid": "a969310b-6d4e-458e-849a-99c2f353a644", "value": "1536:gv7uJ5ilPhYdBPUCKYe5DL/TrYw0+KzGfueHgLelt:gTE5iphYdBPUCQ5//TEwXKzG2cmelt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631382429, "uuid": "2ad2e809-ac18-48c3-8360-6a24d8d35ca6", "value": 54224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631382429, "uuid": "4e387413-6c27-4cde-81d9-6c7844bca351", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382429, "uuid": "5f3e30b1-9e60-41c4-a660-ba20c3e60455", "value": "03056bd94166aa924ce2a95b180adfd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed6ddf2-132f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631385525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385525, "uuid": "1a4701db-130b-4353-9d09-e7316c1f3926", "comment": "Malware payload (Mirai)", "value": "30495129e6ad7ed56edfc31a96708e83", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385525, "uuid": "51adb738-5fb0-4eba-b58b-7df3441ead8b", "comment": "Malware payload (Mirai)", "value": "22b9df6940a4163868cf3474f3003bd5811f827e34d8a1e15219187aaa0f9f6b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385525, "uuid": "90cb56b2-9561-4674-9935-dff56d8ceec5", "comment": "Malware payload (Mirai)", "value": "20d143ca5634dcd1612d811e2ee07b8d173c8e48", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385525, "uuid": "7b4c2e31-eff8-4feb-9df8-a4624b7763b6", "comment": "Malware payload (Mirai)", "value": "0b3a693a4ec38504bfb8074a9e66503684088242f93ab8458389618822f0ee074996c5680576e09093e6bb120a9b871d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631385525, "uuid": "29c3980f-3509-464d-853f-9789fc84382e", "value": "T11093950E6E258F7CFBAC823547B79E219A4833D636D1C545D15CEA022EB024E345BFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631385525, "uuid": "1a8400b1-5149-4608-a753-00c98eed1da4", "value": "1536:+7zGUlB79BHxi0aRiaHTVffoffzbffrCceoTb9M92GwcILhP2iIu1vuDUgddlAHL:aB9BHxiVaTTb9Ec/Iu1v4UgddWHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631385525, "uuid": "dea4f3e9-0d86-45b3-a226-80061cdbf2f5", "value": 97352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631385525, "uuid": "f49a0dcd-bdcd-4715-afb5-af2aebead369", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631385525, "uuid": "45860485-5008-454c-a2c8-847318242832", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c61a77c-1343-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631394003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394003, "uuid": "1844f677-75fa-4a81-b625-f7424b3488cc", "comment": "Malware payload (Mirai)", "value": "51cd3d53041f4e7da57a5c1dd7f78017", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394003, "uuid": "8d0b45d7-ad7f-4461-8410-a08df244a65f", "comment": "Malware payload (Mirai)", "value": "231cfef8d9f05ecb43cefa7c9d8a21ea5ff381be6ce1f8f86c5e4999720453f5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394003, "uuid": "b6b487d6-a221-498d-b807-0dc724f36938", "comment": "Malware payload (Mirai)", "value": "65feb8b524bd7bb7a5f74511c7a2797fc435c425", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394003, "uuid": "d55593d6-1f91-4639-ad2f-2ce64406d2ab", "comment": "Malware payload (Mirai)", "value": "45326f3af2bd6d94990fc0c1efccf824b6c5d99ec92ed60acdc72129c7bb6b3f52ecd09505525c734f3967ca9346fbe8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394003, "uuid": "01bf76cc-817a-4640-989e-7f0765f2142f", "value": "T12503F232D68D47E1F82ADA3D28EBB45C4871132DE056AFB9FBD215160C62B532ECD5D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394003, "uuid": "73564c7b-5b1f-45ea-ba39-a6d7a0541668", "value": "768:XNbw5uKBgFVtzAlPg3nSLBRB+2/GBUdCIAItAnnMVnbcuyD7UWyq95OVbYhg:XNuhBEzHy+LBUdoHnwnouy8NqKbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631394003, "uuid": "1e3c7e53-7667-45d5-8621-03afcda45087", "value": 40964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631394003, "uuid": "1f700050-0fd0-400c-8f46-4073f64420c1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394003, "uuid": "b49b1b1b-57ea-4fef-b77e-d7b0cc334ae1", "value": "okamiii.16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "342e93b0-1322-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1631379816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631379816, "uuid": "e478629a-2978-437c-abca-d4641a7ed754", "comment": "Malware payload (ArkeiStealer)", "value": "c808d765c682f1c26f06e0891b803750", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631379816, "uuid": "f58b7ea0-89f2-4c79-9fe5-a65037716036", "comment": "Malware payload (ArkeiStealer)", "value": "24d277d8c080aadf18227eca5e5a18b247466e4e53fcc975a7894e8af6717ae2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631379816, "uuid": "57b5cc3d-ab8f-4be4-b3cb-9f7bba529887", "comment": "Malware payload (ArkeiStealer)", "value": "5cdb995c146feec2d99dfa87c8b8c1cf0ace0f2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631379816, "uuid": "e9c73c98-b1d8-450e-8bd9-ba47457bd8b0", "comment": "Malware payload (ArkeiStealer)", "value": "c2a03b7636b48ea63dd791ca869d22c3489061121794ec47a6804dad6589c5632d560ee61140152ced3947bd486a61ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631379816, "uuid": "3dec1366-c331-4e67-a1d0-7e886168bcbe", "value": "T1BFF4F1207AE1C035F5F726F459B983B8A92D7DB2AB3450CB63D52AED16342E58D30783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631379816, "uuid": "c625166f-f671-4704-b77f-a1c362d79892", "value": "7dedca7bc07f096eb3cce2bfad6fc32b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631379816, "uuid": "b332089a-6cd9-473f-a9dd-c18180687b8e", "value": "12288:JNsis2a0gbMqzIFO46Xj6mmqpRnZAYtIRzHlhxxTz8lvecTCUBW:nsVdbXNj6gnKUIRr19gvecmUBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631379816, "uuid": "d86cf20d-8433-40b3-8169-3d35fdcfb0d7", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631379816, "uuid": "d0c60d98-06ae-4375-8db3-c696bb36ab53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631379816, "uuid": "232ce9ca-62a3-4c33-a240-0c2802dda276", "value": "c808d765c682f1c26f06e0891b803750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acaf1e03-12f9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1631362409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362409, "uuid": "ba50f780-883f-4897-be8c-ed042df4c8fc", "comment": "Malware payload (Gafgyt)", "value": "add8759b4aea24032b642be2a03658dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362409, "uuid": "5bd92faf-9008-4c4c-98c0-531e60e8b249", "comment": "Malware payload (Gafgyt)", "value": "2600760f193ed5153a3dbdacbc8d53e255050d05d226c3852a8c2996f377cb8c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362409, "uuid": "dd4e93c7-3dcd-4491-8abf-8adbb7883e15", "comment": "Malware payload (Gafgyt)", "value": "fd0e61184e7a57c69e31055913435320e9c7eefb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362409, "uuid": "5d4b3305-3617-40a8-85ab-d29dfe741845", "comment": "Malware payload (Gafgyt)", "value": "6795dbd58d8ea967b395e271a0ec222e0f7ce66a8288682029f4a5e20b701f196f11150e043f7ecdeeceffcd425361d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362409, "uuid": "6e09963a-418c-4908-9c11-b7f63827c036", "value": "T1ADA33A377B130E23C0CA947112E31731BBB5D2DA39FA5243B9A16DE86F266843562FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362409, "uuid": "5020ad2d-46ea-4db9-b947-5103eaf320ed", "value": "1536:XBJ2MNM5oqtkUtnMphaK6igkvmQmF6OXj6ufeuTe:KMN8v6phaK62vmQmF6OXGufhTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631362409, "uuid": "2d541fb4-8074-4f98-8f6b-b9a351c03dac", "value": 101398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631362409, "uuid": "f9af57fb-f12b-4814-b03c-e5d0322c9a26", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362409, "uuid": "27dc738c-7d9b-4b72-ae8f-9cbdfee6c6b2", "value": "add8759b4aea24032b642be2a03658dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c99ba8c-132f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631385521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385521, "uuid": "99aeafca-fecf-4fef-a308-f781c79a466a", "comment": "Malware payload (Mirai)", "value": "ce46024520b919af3d5b151c0a8a748d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385521, "uuid": "49abfacc-122d-40fa-8570-5d292ba4df12", "comment": "Malware payload (Mirai)", "value": "268a1a5a642e3dc0145d7e75ba61d540039029dbbfb3258b4f0070a88aba3061", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385521, "uuid": "ea2daab6-fc11-4a95-9998-82359fcabc1d", "comment": "Malware payload (Mirai)", "value": "5d4c9f0924e58fbb5295a4bae33b39578279544d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385521, "uuid": "f02196e3-4df8-486d-a0a2-f4dbff4c7574", "comment": "Malware payload (Mirai)", "value": "b3c4537f1a5750de263c8aa7af1fa55589a8124e3c764e881d5888782edb8006e03637767b0254f25aebed9ac06bc850", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631385521, "uuid": "a42bd90d-353a-44c7-bddd-3add0d827c1b", "value": "T107E34B46FA818A13C4D5237ABAAF414A3322D794E3DB73079D185FB43F86A5F0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631385521, "uuid": "67600778-5c55-4d7a-8098-7e2c536a16a5", "value": "3072:jdDA8QNZNNhcBSmbp63U61EYxH6zda1g+ZymM/9b1jZk:jdD8NZNNCv6k61EsaX+Z/M/9tZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631385521, "uuid": "24fddf85-55af-48a6-80cf-7bf3e7c4910d", "value": 150579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631385521, "uuid": "1b4ebdc6-da1a-4ccd-a8c1-f22060660572", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631385521, "uuid": "2fcf7521-df57-4ef5-bd4f-31df018faa39", "value": "arm7-20210911-1838", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f43e5032-12c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1631341484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341484, "uuid": "9767a34e-98fd-4b53-b14f-23dbd625ec0a", "comment": "Malware payload (AgentTesla)", "value": "1b005c3e4b3b51a7a271f0dcfed88f16", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341484, "uuid": "25584d3b-de65-436a-ba77-ff3e3916a8c2", "comment": "Malware payload (AgentTesla)", "value": "274dfbbc0adab4ad1fe4e213bb27de83ceccaffa0af2b0ca715becd6c6b7c53b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341484, "uuid": "fb62333a-e391-4bbb-a314-270d95292e6f", "comment": "Malware payload (AgentTesla)", "value": "53af53cd56ad7d0e8e7e53502c43ab4de88ceb04", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341484, "uuid": "0406ebe7-a1c8-4a6d-bf20-cc878b2d9508", "comment": "Malware payload (AgentTesla)", "value": "81cd193a165664c74a70112671c4d76cfa1988657fa0b06e5de50490d29ababd1662fabd61e3f04bcc91487611ae7446", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631341484, "uuid": "aefacc03-9b89-46c0-b48d-3c32e5d7fd8a", "value": "T147D49E2C3DE5B45EE137DE768EE42C52DA6AB5732707D60B2043038D4A1FB86CE506B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631341484, "uuid": "ab1e51e8-2bf5-4e5a-a11b-f306423db432", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631341484, "uuid": "2fdb40ac-86db-4da7-af70-c8b6b2896303", "value": "12288:T/1ILdMHSO2McqroQMw0crVh79QK+y7E0IYfXu1uzmNoik4DbF53e0IUFL:KxjMVroQecr79QKhg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631341484, "uuid": "e8dbfa96-a05a-40c0-861e-2293719dcede", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631341484, "uuid": "3cc01eac-b5cc-46c1-a2f5-aa961efa2c7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631341484, "uuid": "8274d92e-511e-476e-a851-e6cb25fc1369", "value": "New_Order_PO#960780_MT_Quote-MT-RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032bc9c8-134c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631397773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631397773, "uuid": "f351db6f-2541-411b-a73f-6b246bd9e329", "comment": "Malware payload", "value": "3b29fe3eb1892fa6e766bd039b88eeec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631397773, "uuid": "19e27796-ff26-4cb2-b92c-1906486f75ec", "comment": "Malware payload", "value": "27e2593d29c04065445c5462b5af5f77d555dc00318afa0cf7c68e70bbaca739", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631397773, "uuid": "4e9ed480-76d8-4936-bcbf-c01dff016def", "comment": "Malware payload", "value": "ba86c60f4339af2e284830041d399d1afcb90e9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631397773, "uuid": "33b3dc4c-514c-4a37-9f95-822961fe10b9", "comment": "Malware payload", "value": "eb8520785cbcddcfcec92e4cb5f294a97297f87900e2d7e018132614a7d5635babc6daa0145b41ee6e8c993785c66ec0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631397773, "uuid": "55906a1e-0d80-475a-b973-69fe2c6c79e1", "value": "T17916AE12BBD58F2BC5564B388AE783647379DC904B43575BA34AB12D3DB23E02B871D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631397773, "uuid": "a0143cfc-a437-4989-8be3-9e38271245ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631397773, "uuid": "d01e69ed-65e6-4185-81ab-5673b76d2baa", "value": "49152:qNDFFPJu8fBsVE6ij+RNg+UKpBvtqB3m1RC3:4zP88fBsnZTgOtqB3m1RC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631397773, "uuid": "b7b6b711-96e1-44aa-b96c-af59ee5a7920", "value": 4156928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631397773, "uuid": "9eabc4e1-3c2d-4365-902b-0ad36c4d68e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631397773, "uuid": "287faac0-1595-4b57-86bf-df84553389b7", "value": "3b29fe3eb1892fa6e766bd039b88eeec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd9b5485-133f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631392502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631392502, "uuid": "84fe39f6-a3ec-401c-8ade-56bcdceff8e0", "comment": "Malware payload", "value": "f59a5fd82eaf0088e7853c09922ce477", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "installer", "colour": "#FB677E", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631392502, "uuid": "0d9e2b45-8607-4d59-bc0c-117008208861", "comment": "Malware payload", "value": "291505b584fdf540a1590ce7181d85cee7967f99cbf05aeb7b7031b6a9b4f2cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "installer", "colour": "#FB677E", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631392502, "uuid": "eaab4664-82e6-47b6-a97d-fe50fa12e6de", "comment": "Malware payload", "value": "969d1debc32996a4d53c4a36d2241511cb8b77ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "installer", "colour": "#FB677E", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631392502, "uuid": "c3a8ec89-cebd-4ed0-88e1-84f1c1ca2457", "comment": "Malware payload", "value": "0d9f445bd742176a0a3ba26588656292ab60f77b3872d34f73c20df7d63604ff66192aa5700d6392080dad8cad6809b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "installer", "colour": "#FB677E", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631392502, "uuid": "d821cdd4-491e-43bf-aeca-29ae0de9b2da", "value": "T109F533D094B2515BD8B2A37805E2AF152E7769251303E5974FA05E842C2EEB8CF7371F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631392502, "uuid": "efcd9cf5-f5f5-4710-946a-63d28384d1dd", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631392502, "uuid": "8248505d-778d-4460-bba5-2117c5a6ad28", "value": "98304:y8ROl6teZsmz3LA6T2H5wexAGEH3iqILuWr:yhIepz5T2ZwXiqwxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631392502, "uuid": "572b5cd5-ebf3-4697-8007-51ac71fff659", "value": 3525566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631392502, "uuid": "705c16a1-d9d2-4299-bd4f-19b2e95d8f07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631392502, "uuid": "b1687ef3-e01b-4cc8-810a-a73e3342f0df", "value": "setup_x86_x64_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724244d2-1304-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1631367035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631367035, "uuid": "10a40972-e854-4824-86b0-2fed41d40b27", "comment": "Malware payload (Gafgyt)", "value": "2d51b6d89fd419d4b3c085a9cc085b01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631367035, "uuid": "931e58e9-a8e0-44ae-a8b5-2ab095000ba6", "comment": "Malware payload (Gafgyt)", "value": "2afee96b6fca484c638f24735b2e105c165a6b1b614f310615f27eeea2b89409", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631367035, "uuid": "44bc6f65-6571-4060-a60a-64cd57fa71e2", "comment": "Malware payload (Gafgyt)", "value": "a7ed8b055553d218e21734495c884d0448774da3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631367035, "uuid": "e45b7da9-717d-4383-b973-5f531dabc47a", "comment": "Malware payload (Gafgyt)", "value": "f533d386d69edad9ee090b3c0c8d9d877ff6f68c6bd657b7d8d8731541c5271190c421fee09a668c677ec3055787aa61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631367035, "uuid": "1b42b544-883e-4e20-b16b-7670d405a857", "value": "T107930941FD418B27C2D237BAE78F435D37366A5467DB33016A396EB42BC27982E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631367035, "uuid": "46a182ed-4e7e-46f7-8442-b0a8109d4a38", "value": "1536:LBkF9VQPAGaHYyEfgcqpq1innPTxHOxAePczYrmREqQ4b/X7XSee:OQ2HYBv1WTNePcKmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631367035, "uuid": "c5092f65-c996-4354-a48c-e1cd923f3be8", "value": 92448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631367035, "uuid": "0c98325d-5d74-4641-8573-12d7565b3c6d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631367035, "uuid": "310f8dc6-30b6-491c-a388-402b114ab60a", "value": "2d51b6d89fd419d4b3c085a9cc085b01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae5ca8e1-134e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631398919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398919, "uuid": "559f9c8e-6599-47f8-ab40-9dc4d1d1aa31", "comment": "Malware payload", "value": "803ae3597a1f6b670955d7b3c043dbc2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398919, "uuid": "c2da03fa-fdc0-4a24-8b34-e2128d4aaed7", "comment": "Malware payload", "value": "2cf7e12aa12b4a2cdad55db3e75b1873bc59f6a010f037ad05fa82853319c4f2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398919, "uuid": "6d38c7f3-c9db-4a34-8af7-912ca3012848", "comment": "Malware payload", "value": "2fb646ad4c0d463f5eaebecab28eab82ed135501", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398919, "uuid": "d074915f-ec31-4e0e-8b6a-f7e8380c9086", "comment": "Malware payload", "value": "d64c944711b3b5f509de4d75c764d3765e0d65df2b85e9d26e135999cb6b4ed8283c1afb2a86784b71fbf5e7767a6507", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631398919, "uuid": "4aa281b1-18dd-40d3-8087-c586240bef2e", "value": "T192C3642ABB619F77D80ECE3301A94901148CA99A53D92F6FB5B0E61CE36BD4F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631398919, "uuid": "94e7e024-e6b3-4691-914f-de4a2d01c8a3", "value": "1536:MSeTAWtPX7tVT/rFhr2G0yX0fZe4GFpOUUOfESVlREhqMV/:MVtPB0vfXyvsUEUu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631398919, "uuid": "0c056501-4982-41a7-ac3b-38c5e05f3ab9", "value": 128912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631398919, "uuid": "2ffdb320-dbb0-453e-a60f-a8e2f40d1f5d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631398919, "uuid": "3f8a952e-ea93-4d8e-bbed-70636d816fb7", "value": "MIPSEL", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74109282-130a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631369615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369615, "uuid": "89d96a8c-c7db-4ce3-acec-d10dc1930a59", "comment": "Malware payload (Mirai)", "value": "c2c29a5bf0d5e8b59bd5e6820dcfb40f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369615, "uuid": "f09d78bd-65e2-48e8-acc1-22d34717cd01", "comment": "Malware payload (Mirai)", "value": "2f1d90d8e3d8d3606798ac6eef0a87aff904b67fc96cbd5cfe6deb634fd0302c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369615, "uuid": "c5ba253f-0ceb-46db-b9e8-62b09c329b69", "comment": "Malware payload (Mirai)", "value": "c0fa28c57b9979e9807592f59e6860700d008798", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369615, "uuid": "68a618b5-52e8-48fa-9a78-58870bd2a480", "comment": "Malware payload (Mirai)", "value": "f02eb6fc37abf4ce7607a204d8a8c269fa26f602435dc0675b30ccc2f633a4e4768e1191957be7735480e081f97a9b57", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369615, "uuid": "fe703570-6e2a-44bb-a798-a33e49d4e0a6", "value": "T1D9E32902D4905767C2D3237AB78E424D77231BB593CB33159A38AEB42FC1B9E1E79861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369615, "uuid": "2a184365-8310-482f-9346-bd0f7d04eead", "value": "3072:06dq7BAPyzBPaSvRySK1r+nHa+Qqbz/tHMssjbRjm+QdhXXHY8:0qJPyzBPaaySMqbz/nsvRjm+QdhnHY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631369615, "uuid": "cc805a5a-0432-437c-b330-0e177db49730", "value": 146586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631369615, "uuid": "8c2a49cc-620b-4d5e-9e62-16bfdbaca9ff", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369615, "uuid": "084145e6-65f3-4e3c-b36f-c0131310d138", "value": "c2c29a5bf0d5e8b59bd5e6820dcfb40f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ef3a3f-1335-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631388189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631388189, "uuid": "671a628a-cbef-4079-9585-7183cf4a428f", "comment": "Malware payload", "value": "234fad127f21b6119124e83d9612dc75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631388189, "uuid": "425e79d9-b070-4bc4-86cf-07e46a62d36d", "comment": "Malware payload", "value": "32668075f8c859636cb19de60d5ddc6e4fa1bfbc94eb6504636946d641110876", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631388189, "uuid": "49ec65c9-bab7-4885-aaa5-8b4f42c20f49", "comment": "Malware payload", "value": "01de838b449239a5ea356c692f1f36cd0e3a27fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631388189, "uuid": "1ec9e87f-8248-4d90-baeb-be94b8201d86", "comment": "Malware payload", "value": "896193a8ddef96ae085938d4062dfad711ad85a0a2c427ee5aa306d86d18f420670ac2b2962f6c68dc04d46fc21cd042", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631388189, "uuid": "25137b0e-a83b-4421-99d6-a48163160447", "value": "T109649E306B91C035F5B722B44AB69378A53A7FB1A73091CB63D43ADE56306E19C30B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631388189, "uuid": "de82fe42-66e2-4c3e-9b0f-6dbec5afae0e", "value": "bfbc360c6a2a20fc6e98b50e62a61f43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631388189, "uuid": "7adb6363-23ae-4d9a-95dd-6536ba55ba96", "value": "6144:dz8yqHNE17Drj+IzgKLhdq8SIkIcPzCoI//7Xwcb7Tz67EMExxL8:WyqHi17Drj+Iz3zmItcb6/FHn0LExxL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631388189, "uuid": "65a5ab14-5dd3-4861-be4d-4b4a6dcdf58b", "value": 333312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631388189, "uuid": "4641743e-2beb-4b47-9070-f982a4cbc589", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631388189, "uuid": "a6232ec1-10d5-4558-ae19-2206cd5cb58d", "value": "234fad127f21b6119124e83d9612dc75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b403c18-12f7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1631361333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631361333, "uuid": "31472b47-ed92-4ad5-a47f-355a43c1cc05", "comment": "Malware payload (njrat)", "value": "12fcd9494fe933014ef9e9d501f815a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631361333, "uuid": "e418240b-f7fd-4356-82ff-ad9e2e6397cf", "comment": "Malware payload (njrat)", "value": "327a3182d9600ce08cd59ecbe4b5cee6e49736cb6b02749fd57972007d6bea11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631361333, "uuid": "775ed18b-e2bf-468b-9acb-e012bd6e2a36", "comment": "Malware payload (njrat)", "value": "6a64df986e28df14268cce47100213d4c5b1ffef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631361333, "uuid": "d708d138-3744-4c9b-8f86-49a6baced0d6", "comment": "Malware payload (njrat)", "value": "76307949590550fde2f03a2c1140782e69fa4513449f9eceba882ddb81ecf8844d6bca2c7d6deb2a40fff494aaa3448a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631361333, "uuid": "49162ed7-3913-4c55-b033-005b5bb777d5", "value": "T1BF542305B1896F6AE1980077EE3A7FF36129F790F0A0B5031DF631607C84F689B82D99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631361333, "uuid": "136fdbe7-0226-4491-be81-ed771909c9d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631361333, "uuid": "e7f308c9-3216-4caf-98ce-78ebfe5aa042", "value": "6144:CPyutInGYEJiY9P+BcgvmdW+pY6IfzyAbuKHOtKZ32D:vGYE79mCCcY6I7y+uKeQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631361333, "uuid": "935ecac7-cede-474a-a4db-2abe5c9dbfa8", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631361333, "uuid": "9237e87c-d097-4824-88d3-8a4d2f818cee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631361333, "uuid": "94d71af0-7655-4d14-a85e-79d181f63dd6", "value": "327A3182D9600CE08CD59ECBE4B5CEE6E49736CB6B027.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "781c4dc9-130a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631369622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369622, "uuid": "fcbe916e-4c9a-4f8c-9a98-aae234e8bfcd", "comment": "Malware payload (Mirai)", "value": "e123d65a25d4a0f7aaa2ba4c0ddf4b5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369622, "uuid": "053a546c-0f4b-485a-857f-2407782f0c4f", "comment": "Malware payload (Mirai)", "value": "3438fec67d32b98d8b2f488e6f8371e2f008ee43f1f4f8eac0432049baadc5c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369622, "uuid": "4f36182b-06b7-4c7a-b213-58e3a4115675", "comment": "Malware payload (Mirai)", "value": "791985ae007f7ebcede1c67955164e5566c83efb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369622, "uuid": "b78bc287-bf27-4549-bcac-5cf520ed9f3a", "comment": "Malware payload (Mirai)", "value": "794bdeb9dc85fc08b10f51a05e1af5043879c9e467e9b030683b2e07be87b3fa7a9e473ceaf6a6c973b45fa0a59fffd3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369622, "uuid": "b5cb4931-c49c-4c9e-887e-c4ffa3163d9c", "value": "T153C308A3F800DFA6F00BE67604D70B156670FBB60F932526721739A7AE721D52867F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369622, "uuid": "8ef1188f-4218-4e3b-a72d-caf491546cbd", "value": "3072:fUN04OXJQfhvyrnhsxy9HXQ1NLmaz0Vgx0fLfj:fUNJIJQfhvy6y93Q1Vmaz0Vgx0fLfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631369622, "uuid": "5dfc9038-4e41-4a45-b86a-58d7c88b9032", "value": 119341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631369622, "uuid": "044a3ca2-3fab-492e-868d-0ddcbdade84c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369622, "uuid": "ad7862ab-d1e5-467b-a8ec-10e2898baf5a", "value": "e123d65a25d4a0f7aaa2ba4c0ddf4b5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f2cad8-12f3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (FluBot)", "timestamp": 1631359551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631359551, "uuid": "54672453-d648-4fa0-a676-87c681c17945", "comment": "Malware payload (FluBot)", "value": "6a7e746ade78143f4ca2a7a4ce33f250", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631359551, "uuid": "d3560102-90cc-457a-a48a-c6ebbea3bbb8", "comment": "Malware payload (FluBot)", "value": "34d3338408dfd8244ba7ee655f558f0e06e0982cb76584f88707f6d0bdcf6a2c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631359551, "uuid": "7f938413-e7df-44e2-b052-4e0ab360c743", "comment": "Malware payload (FluBot)", "value": "452abfbc77dc37780b571d0ce4f623ac960d89ff", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631359551, "uuid": "b3bbc416-0d03-4f80-b76d-c474b0d3cbde", "comment": "Malware payload (FluBot)", "value": "9397cc75d497eb81bc34073f2f1a435dd7c7c739606c3aa90adeed94a4a5ef1697170cbc40c91b00483f9067b95e2e0e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631359551, "uuid": "e44aa61d-f5e2-48ed-8fb3-efbc3b902aa6", "value": "T175D52209FE9FE017F103E1B5A164B98F850840498A88FE4B2A2D926C5DFBD449747FDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631359551, "uuid": "d9b727f1-50da-4cd2-9843-5246d0921574", "value": "49152:uM7gzj8zOKPDuGpZ5pYklV4DM0qRNwjCRHeA3na98rjZHxcTngX3BH:utj8zOKrV/lV4DRpWRHhaQcTn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631359551, "uuid": "5794ef06-447d-4040-ab96-214ac4c83eeb", "value": 2778048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631359551, "uuid": "c36179d4-0099-4394-90f5-4caaf664e9bf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631359551, "uuid": "e8ab1024-14af-43b3-b021-db1f854c4c0e", "value": "DHL98.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214cbcb9-12ec-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1631356592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631356592, "uuid": "77f63f37-ec22-419a-8780-57b30bc6fcdc", "comment": "Malware payload (RedLineStealer)", "value": "a1383b30bf5478f053d19f10cb85f31f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631356592, "uuid": "978aa623-41d2-41f0-acd7-67a9c5977c71", "comment": "Malware payload (RedLineStealer)", "value": "35e741535c766f539a8352d384112e210fdd8e47e2d4873facee8f2d4e2b1410", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631356592, "uuid": "e2c068b7-d9db-4c6b-8884-123cb6602f0d", "comment": "Malware payload (RedLineStealer)", "value": "7cae18e3250fbd68dead221d078194d3188c59ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631356592, "uuid": "484e9eac-a418-4cea-b6ee-0e8bdf78563d", "comment": "Malware payload (RedLineStealer)", "value": "731ed146a1725512cf4e460e6d8365c7b63975603f10f82136bc45241a66dfb706b89b3288875a19adf5ae51564c99be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631356592, "uuid": "98505c13-1b9d-4ec2-8fd9-6bb5eee371ae", "value": "T1AF95231AD7C80695CD543BFC28C2E8D9039E9D7C4826A79B10B9BADA0BB0F66554CF4C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631356592, "uuid": "09401ba7-3c92-49f5-a9d1-fc162820d896", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631356592, "uuid": "5c6065a8-1851-44a2-8ed2-1c9da400825b", "value": "49152:i/Vh5hkQmdViB8zO7iWVnD8VElFSddDVfa10AVeKItUXjhY:CVv2QoViuzuno+2dLa10A0aXjhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631356592, "uuid": "8a3258c2-84e0-464d-ab79-470baa7b9fc7", "value": 2036776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631356592, "uuid": "741db194-425b-49c5-9c59-c0d037d5633c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631356592, "uuid": "eb29aac0-4d12-4ad3-930b-0ffe247ca5c9", "value": "KRAKEN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac789cd9-134e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631398916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398916, "uuid": "8bb57706-90af-4fd5-bd00-b76882ee9a07", "comment": "Malware payload", "value": "f63656d2fe81e3e8a047d61cdc6aa1c7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398916, "uuid": "850fcd24-c7ec-4614-94a1-d96ed2e5c921", "comment": "Malware payload", "value": "3723be289290e0f80f21e76120c11129074cf886e3d284c57a5015b1d0c670aa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398916, "uuid": "60f59240-bc42-4751-88f8-ca3854f450e5", "comment": "Malware payload", "value": "747b4f1dc0daff535e2d0df84f072773f79f1fa5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398916, "uuid": "66b7aa86-0388-4a97-a5a7-9eb0795e1f8b", "comment": "Malware payload", "value": "d47bcddb8f8c023cad05a92e8a028414f6f75ca6ec4e64590af16acfdb693e0d7f7aecb89806727ff6147dada9d069bc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631398916, "uuid": "a36defc1-85f4-4870-9386-a0cf5be4a674", "value": "T10E93F844FD15972BC2D372F7EB5D468D3A3A1FE8A3E731269930BEA023F56D02525920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631398916, "uuid": "1d9dda36-ced4-4c90-89e5-ab7e23641811", "value": "1536:7a2axTRplXWIIQ4nNE2dqJmIvYBPu8S+qu5OSN4FSb:YTZmISNE2RIMPxqpFSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631398916, "uuid": "4f833554-6128-4106-a966-fe20de029cae", "value": 90612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631398916, "uuid": "543c9047-4b82-4f94-9e63-90a4cb201494", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631398916, "uuid": "2b65223a-3aa6-4720-b282-7f0b1fa1e434", "value": "ARMV5L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c820a90-12e2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1631352396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352396, "uuid": "fc7836a7-58b7-49b4-b956-86fedfdd3de7", "comment": "Malware payload (Gafgyt)", "value": "96aa83dee46998da0a16ef52af6d4c83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352396, "uuid": "12eb2879-2ab5-4bb3-a749-bdf337665233", "comment": "Malware payload (Gafgyt)", "value": "37d7fcbd9235336d7258f63dad9775232c82d53aee2a3bdf86527eede7fcd089", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352396, "uuid": "06d56a3e-5fca-4c17-be78-91678e8c5922", "comment": "Malware payload (Gafgyt)", "value": "111718d2c3a643278d13c4eeee99bc2ff153486e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352396, "uuid": "19016d91-5f10-44c4-ae3e-bf9b02139a74", "comment": "Malware payload (Gafgyt)", "value": "aec5784e137e0ae7583fa04a325c40226ff020404ed3c4ba109352c43860c55c63e35f62a092c8b8685d93701c549b60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352396, "uuid": "497bda2b-d4d9-44cf-b7d2-100f3e5c8c3e", "value": "T131A34982A740D5B3D1A306B6129B8B150133FB3F4A6B9EA6F35D3CF48B509C57221B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352396, "uuid": "2d1e4249-d19b-4c05-ab45-9272adb05317", "value": "3072:Jg4eodUWUh917j8mc2deiPUDAZURyPft5hQTSvxinf0OzTyoQQub:JdRu917j8mc2H5Z5P15h8cxinf0OzTyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631352396, "uuid": "5c97789f-5b8b-4353-9d89-278e80e21acb", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631352396, "uuid": "0521d763-8de5-493d-a970-73f96859d8c6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352396, "uuid": "f07f4398-9ef5-47fb-bed3-c3b0d69b0693", "value": "96aa83dee46998da0a16ef52af6d4c83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad14eb5-12f2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1631359238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631359238, "uuid": "6aef7f05-237a-4ec3-a31c-2842321586a3", "comment": "Malware payload (AZORult)", "value": "b556526e3da710a1bdf1d8f27b75feaf", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631359238, "uuid": "ae969658-90ce-4e97-83b1-36b4d3c50a2c", "comment": "Malware payload (AZORult)", "value": "37e292496f057cbbba45f28b7510c8e4b555dcb2ad4308e1df9f251c9980830d", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631359238, "uuid": "bd616adf-ce53-49b1-9191-b16f71aedffa", "comment": "Malware payload (AZORult)", "value": "c7d412bef31e46c9bb9facbe37eb6862ce38ea63", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631359238, "uuid": "2257173c-6cb0-4c09-826a-c8ae95e7bd94", "comment": "Malware payload (AZORult)", "value": "9e5a81152b29c6d44a5647fbdc5fbc85cfde7884411bc9e3baed10e709394964e1adbf48a37240a02f30ca87d789b027", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631359238, "uuid": "17760637-4ff6-4294-b638-56c39877ec09", "value": "T17D1402A2A73C4DDEFA3D5530A9B7BC7143696CB499A40D4792E7B03B4837312AC1924F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631359238, "uuid": "e26489e1-888f-420d-8e23-3aa36a86b944", "value": "1d88d597200c0081784c27940d743ec5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631359238, "uuid": "5939b86f-8ae6-4d0a-bc6a-b813a1cc414c", "value": "6144:Ti2gMUk7PDUnsIVbk5ofoSM7NbjI0yZdBu4H:Ti20E4sIa4oSe5su4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631359238, "uuid": "8d831d23-2e02-44fb-a2cd-b2ffb5e387c3", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631359238, "uuid": "b0fc42b3-bc45-49df-8ad6-1205ab8b3d59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631359238, "uuid": "2ef37518-59c6-4769-a862-43dc1fbf7797", "value": "37E292496F057CBBBA45F28B7510C8E4B555DCB2AD430.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8977f63-1301-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1631365945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631365945, "uuid": "45d45bbb-4ae6-45ff-bcb0-31a7621cd9e3", "comment": "Malware payload (RedLineStealer)", "value": "84d729286d1b4aa46e7a9a98d3fead68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631365945, "uuid": "7ac52a33-ce53-4d7a-bd18-63a8607567c9", "comment": "Malware payload (RedLineStealer)", "value": "3929767d901ede913a57de5ea4ebdcff06b840f762d8f33e0b1d5eec8b570cb0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631365945, "uuid": "aa41b9e7-d559-4714-8939-e7ae78788b01", "comment": "Malware payload (RedLineStealer)", "value": "4934716c1a2e33dada7a549dada8877b408ecba9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631365945, "uuid": "89ae43e1-9222-4be1-9189-ea7fae5da9e0", "comment": "Malware payload (RedLineStealer)", "value": "4f7149374b916778e8144d933806a42ae0642833cb5419681f07fba89c7352d71aae830e1daec6836805e70eb2bb0d0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631365945, "uuid": "280e032d-b2c5-4398-885a-f4d5fcb1114f", "value": "T1B984AD20BAF0C035F5F752F859BEA7B86A2E7EB15B2480CB52D116EE16346E49D30743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631365945, "uuid": "608b5750-d787-49d1-a620-053bc36bbdb2", "value": "7dedca7bc07f096eb3cce2bfad6fc32b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631365945, "uuid": "ee99c1c4-471c-42ef-98bb-5cf0f5dcae38", "value": "6144:CKWiioA6rrTJom1Z/Sjz5R4wra31JhImIlekCjfDVBm:QpoA6rrTj1dSvc531JhZIlekCjfDVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631365945, "uuid": "1a49dc79-a878-4b12-a45f-b8dbd8ce428d", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631365945, "uuid": "685ff5cc-dcd0-4ef0-b1af-2e26fdea9f32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631365945, "uuid": "fcb8b4f3-1de5-4649-ae1c-76fd6001fcaf", "value": "84d729286d1b4aa46e7a9a98d3fead68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e0ee1d9-134b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631397496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631397496, "uuid": "2c92829e-6cde-4f94-9d44-5a3995c999a6", "comment": "Malware payload (Mirai)", "value": "3e0e937a50815027a38c63418c80e76c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631397496, "uuid": "eea3ec2e-ad4b-4450-b8b4-ababd2a0d64e", "comment": "Malware payload (Mirai)", "value": "3af6cc5d30dbf8d269867c7d6266d2d9709c3a0b6bba15e35657f901236ca77a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631397496, "uuid": "6d81eb57-448d-447e-bfba-68b77fe831d0", "comment": "Malware payload (Mirai)", "value": "2c5e8bec686cf19fba76506bed76d0ae4503267e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631397496, "uuid": "8223e936-a71e-4bc1-a557-763e2d496761", "comment": "Malware payload (Mirai)", "value": "23d292c581bf514d617c49f77fb5e94d7e5675df6aa5165500cd87fca261366479621c68004baf93b316d69927cedda0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631397496, "uuid": "8597fbb7-24b2-4ca5-80d6-033bacc65a75", "value": "T1ABC32A3B7B270E23C0D9447115E31332BAB5D79938F953D7AAD06DAC2F1A6843416BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631397496, "uuid": "f40d8bde-b471-47ba-b053-e8b9c977b478", "value": "3072:9VxmuPY/pNP8pha+fUwXDdU9A2/YGu2ETN/:9V3P0l8phaSUcDdU9A2/YGu2ETN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631397496, "uuid": "f81f3982-0205-437e-aae1-1a8a4646e54e", "value": 126182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631397496, "uuid": "014dbcf5-0685-4583-a0b5-3eeed18f1a61", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631397496, "uuid": "a4a68c98-0eae-49ae-9859-d961075d0040", "value": "3e0e937a50815027a38c63418c80e76c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c880bb-1328-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631382710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382710, "uuid": "f3ea779c-9c23-485d-93f9-8385294fccf4", "comment": "Malware payload (Mirai)", "value": "1d1d596c2d1e3874ef2c24dc8b013e11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382710, "uuid": "45be485c-9953-4339-ae66-d03ff2899e69", "comment": "Malware payload (Mirai)", "value": "3b3850321ab41f64e7ca7b8facd8dc242034af13cc7fd934b2b20d1c79e06577", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382710, "uuid": "a8e008f7-acdd-42b7-b460-992b964643a5", "comment": "Malware payload (Mirai)", "value": "fc0c8e1ec8dfca03d910107e203c08ef25061125", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382710, "uuid": "6c234c30-e5d7-4a75-8640-45eb4db9995e", "comment": "Malware payload (Mirai)", "value": "d414422a3f1aeb412232b7f0fdf26faf8b30bd313eb871725376b78a9b60845dc26b01a4b4792121c01a239dc1fed218", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382710, "uuid": "151348c5-fd11-426b-8012-070b88615483", "value": "T17F632B55F8818E12C5D512BAFA2D018E331267E8E3DF72239D206F607BCA52B0E77D56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382710, "uuid": "9db1508e-6c0f-4cab-acfd-6c543bd28bd4", "value": "1536:lQnyl3YbHEY5yiA+ZYjxBJPFKYggx0xPOqU1H4PfzvITiJCBh/f:dgHEcyeZUBJd3ggxEVU1gCBh/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631382710, "uuid": "d95e55e0-a789-4493-b2a6-2159a4bc56d9", "value": 72736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631382710, "uuid": "34079791-d18a-4719-8654-c8efbeed4b1c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382710, "uuid": "e6bf651c-45f3-42af-a9b7-a72fdb345783", "value": "1d1d596c2d1e3874ef2c24dc8b013e11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87be1caa-1329-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631382963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382963, "uuid": "81b6e4d1-1d0f-483e-9ee9-258d8082d633", "comment": "Malware payload (Mirai)", "value": "36938cbcc3ee068d02f9b426ce9a6058", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382963, "uuid": "bcab3b44-4332-4096-a003-7636f5852af9", "comment": "Malware payload (Mirai)", "value": "3bb964a7df3034207e491b7a1813441adaf1e26fca95f698c4816efaef5a267b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382963, "uuid": "35ad5634-73eb-41f2-bb8c-3f1780fba15f", "comment": "Malware payload (Mirai)", "value": "a7877025f470511f5dd86742936314cf72eb5875", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382963, "uuid": "1ef956e3-811a-4ce1-baca-0f375fe5d44e", "comment": "Malware payload (Mirai)", "value": "52bf5fd8322c7a690384ba719bf8363213d26890cd465a294ba5552dac70cee28687320ec3d56ec9da86841a17708a9f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382963, "uuid": "b1bfa281-7f7c-4063-a9fc-683acc4caf5b", "value": "T1F583D609BF611FB7DC9BCC330AA92B05288C655A22A97B367D34D918F64F21F15E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382963, "uuid": "00413e51-fafa-43ed-9390-2ec8aa2f4f37", "value": "768:sx7pqC77Es6GF2Fx23pkG1WxDiHv+jL5xmz5Ofeuet1eb8lYkZ607XiV0qu/zH:sx7kC7YsaGv+jGzwTY1Q8lvZ60uuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631382963, "uuid": "f88f2dcf-6be1-4fc6-a549-4d054b652fd7", "value": 81068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631382963, "uuid": "a0d9227b-d0dd-4419-bf60-41ad2e91fac1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382963, "uuid": "7e167ff3-88b4-4d0c-bfab-b004062a81a8", "value": "36938cbcc3ee068d02f9b426ce9a6058", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5777697b-12d4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1631346375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346375, "uuid": "317f7fe8-d8f3-4c9c-b6b3-4b21043703b9", "comment": "Malware payload (Formbook)", "value": "e3ce454bea0677f6fe837524bb992be7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346375, "uuid": "9d164857-8387-4c42-9537-b3f1efae873b", "comment": "Malware payload (Formbook)", "value": "3be8a41bb629cd3aec0ad28a8f7ab3d1645a538f233dceefc78332c4c48aebdd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346375, "uuid": "f161a36b-fe6c-4b4c-b9c8-1aa01317b731", "comment": "Malware payload (Formbook)", "value": "a2704c3f0128abd6a3d2bd5cc0bd9a0859ba7516", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346375, "uuid": "1e5f82cd-0998-4ba9-97f5-dd97b740e87f", "comment": "Malware payload (Formbook)", "value": "b260459bc4f81c458ad2fbe1fb321ae5181356c086f6258857cde72be155e36a2d1c28eb4594f9a6852f1e3715c02edb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346375, "uuid": "a5a25f97-8778-45f5-97dc-7db647c7b16d", "value": "T14305AF076118871FDF3DA3A71F90A12B91A21CABF34496A4DAF3C358DC956C6712A7C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346375, "uuid": "d53eaa21-cfaf-4204-bf88-213a7cbfe50f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346375, "uuid": "9693e913-27a8-4d24-b659-2f7f5aebfb3a", "value": "24576:jrECkXXai8kVpy1cq5AQ0kYLzmwpZNo9y:1kXXai9Vw1lAQezmsr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631346375, "uuid": "5459cc57-dcd4-430c-8125-732f97297bdd", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631346375, "uuid": "878c314f-2422-4a9f-ba64-1fa26a4a0809", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346375, "uuid": "430f2853-e140-4986-97f7-9d0ad086e864", "value": "e3ce454bea0677f6fe837524bb992be7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "139ce47d-132e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631384916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384916, "uuid": "e8b321dc-0c05-4241-b6a2-01bfd6a66c34", "comment": "Malware payload", "value": "a5fc0d2c2f9c0ab661825e05125bf65a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384916, "uuid": "a4f3a562-044f-4ebc-9bd1-a6861563f949", "comment": "Malware payload", "value": "3c2c2a4ca33333636c60a0c5747ac694e1f844de3249a2f84f0a13b75f20d3fe", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384916, "uuid": "f5c19c93-0f42-4654-9c11-55407665240d", "comment": "Malware payload", "value": "009eb1e77bd92ce02c64671f158706422aa8f9d1", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384916, "uuid": "0dd32c0d-44d2-49f6-b435-6a4d761d64bc", "comment": "Malware payload", "value": "04be62a86e1c1f0b0a85b4f13d36977a2974c3ba1f9dec37e0a4c54558a5990c39ac785ae73010187d66412103b84a51", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631384916, "uuid": "69cca0ff-e742-449c-b502-34dbc38f00bc", "value": "T1C5215410C927FFF648627529BC5B7C90F0722A9583FC9AC8E0B5C2549C6A7DC05C0252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631384916, "uuid": "0caededa-890c-41e7-a6b2-bf4047d8f0ea", "value": "24:HlrK8GBg7rEcmJpb+JZYpiu7dLJyJMgoZ1yscxYFwuquJOMgM0S:HlrK8GC7rJmJcJZYpiu1J6Mksc3TuJOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631384916, "uuid": "0c50f44f-7227-4af1-be97-13f13370e073", "value": 1236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631384916, "uuid": "33442b4b-0e1a-4d8c-b904-6c2eca822e56", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631384916, "uuid": "5d21066b-c57b-40ba-afbb-9e746398f9fb", "value": "myckSgvGfuPeu.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136623a6-12f9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631362152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362152, "uuid": "21536675-7a69-4bc0-a218-38db9bb7b99b", "comment": "Malware payload (Mirai)", "value": "b5cdac99961cf89cc1831d456c0d818b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362152, "uuid": "e9c6960a-aca1-4caf-ae62-5a398f7b22a9", "comment": "Malware payload (Mirai)", "value": "3c359f49e4c141b20039ba4742f949c3c80d3c30cd92e3fb6d83916c551108b5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362152, "uuid": "47404b83-d2e9-44df-bd37-8efd773dc8d4", "comment": "Malware payload (Mirai)", "value": "fe13454695914b702f1725bbaa9a9588af58dc22", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362152, "uuid": "dd608c91-7dd8-404a-bd56-bf49f9c490ed", "comment": "Malware payload (Mirai)", "value": "40e5969372c97e528a03c7ab4ba1ad57aebdef90d6dbde3a47ca7623ca5174028e7ace58bd0c50cd74e7a17b6b3cd10c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362152, "uuid": "73497e2c-1550-49ca-baac-986b347038a4", "value": "T1C2E35C46FA818B13C4D5177ABAAF41493322D794E3DB73068D185FB43F86A6F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362152, "uuid": "25e1ea7d-789c-4147-bb71-f1be6094a200", "value": "3072:h5F1RN2Vu4bvvMH5GPDU0n6E4hgH21RqRNM/93Yk:h5FZ2VumMH5GPDxn1H21RKM/93Yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631362152, "uuid": "b9e7bc5d-5532-4e65-8e8d-58cd211fd624", "value": 149203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631362152, "uuid": "c0b79e75-615c-4f5e-9fa9-71efc464872c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362152, "uuid": "bdb57d0b-f44b-498d-be7d-cf89a181dcbd", "value": "arm7-20210911-1209", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02146a3d-12eb-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631356110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631356110, "uuid": "e5ac77f4-bdd2-4ab1-8c55-ad4c51744026", "comment": "Malware payload", "value": "d08b2b94629465c55c305e7e8dedabfa", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631356110, "uuid": "71c9d1a5-b511-4eef-bf4f-917a421a1e28", "comment": "Malware payload", "value": "3c65d9d79a87aa34d26841692a24caad7a88edf4ec75f68765a1ccbc929340be", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631356110, "uuid": "6426d3af-e1f8-47f3-bd5a-b5e2e51c72b8", "comment": "Malware payload", "value": "684789686fa236fe02237bca57765735918e4408", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631356110, "uuid": "d798d959-2d84-4e1c-be4d-faaab9e4eb82", "comment": "Malware payload", "value": "0254fbee4a2bf537cbc56598b9f467760bbb573cd8e7dbd1adadd4defce538726bbdbc408a3eb0477155421c83c9d70c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631356110, "uuid": "99fa6e26-cbf3-49e0-a601-694f5ce81a82", "value": "T13C8533D2BCA2057DCC8C7CB7CA568392D901A7DA120599384F738C98B74DE83B7D7A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631356110, "uuid": "c6922815-8203-4253-900d-4c7a5015102c", "value": "49152:SNZIZ1WrfvIJMdEXi33LajfQIIhjQuuB1/V:WIZKfvjgi33L+Q5jTuj/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631356110, "uuid": "803cd2ed-5173-425f-8bef-596ea2d43a6c", "value": 1784163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631356110, "uuid": "50212ae4-e824-4c51-9de0-cd00407e3329", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631356110, "uuid": "45f0dd0d-b773-4061-bda4-3597862a0537", "value": "d08b2b94629465c55c305e7e8dedabfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de4cf42a-12c6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1631340588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631340588, "uuid": "98c97d7f-0f90-458d-a009-a7698f74e0cb", "comment": "Malware payload (AgentTesla)", "value": "adff3a4078d9af3a6e0b819ab56a8764", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631340588, "uuid": "8c9fe95b-13e9-4d8a-bee6-1b6b08850737", "comment": "Malware payload (AgentTesla)", "value": "3ea4e94bbdb0079f62dc91efbd83e8ad04b20629dc559a115ccb56980d307c21", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631340588, "uuid": "820a3bb3-a429-4adc-bfd9-6e86fe32efc1", "comment": "Malware payload (AgentTesla)", "value": "b075995da8d4886fc2446fa2fa4754613e20766e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631340588, "uuid": "8fbd33da-db46-4eb9-b2bb-de6eba2b94e9", "comment": "Malware payload (AgentTesla)", "value": "529b3a7c74b3ca7e5c64719d2307585f8880889293072474054d9e20b0537e36725da88cad11807947ce74c46370cec5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631340588, "uuid": "40d73562-6458-41ed-900b-f1270dff86a5", "value": "T17BC4338740F164EE6A523DB53E3E81F468B71A73CD9ED6444EB530CB2B4E276E0C5984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631340588, "uuid": "00c37e50-391a-4908-a155-21e9b15b494f", "value": "12288:um0oKDr1WuRtQNtgwTPE2v6lFGPspiQp3zk1SzYr+:uzocbQNGf2wGP5Qlzk1H+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631340588, "uuid": "1f348c4d-4ce7-4deb-bc08-44ea750ac130", "value": 551208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631340588, "uuid": "cd73b2e2-65db-475b-901d-3c99243cbc6b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631340588, "uuid": "a20c6ae0-ebd3-435e-be5f-a1f2f75e785a", "value": "Revise SOAINVOICE for remittance.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519f33b5-12d4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1631346365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346365, "uuid": "ae9f98bc-6672-4b14-8fe6-c52ea274706d", "comment": "Malware payload (a310Logger)", "value": "144c71aa3c0921610e282c58749b5e39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346365, "uuid": "3fa125ac-54c4-4315-b6a6-c7b74a5dafa8", "comment": "Malware payload (a310Logger)", "value": "3fb623de58c14ac8cd4d6e7248d1a05f511b5c39bb868c1d5dc57b7854e84cde", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346365, "uuid": "8d36fb45-1e41-4a50-9403-9ec9cb8d2370", "comment": "Malware payload (a310Logger)", "value": "0bfcecd9b23b2e2ff7af91e7355ac7ed2705d995", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346365, "uuid": "92eb416e-867c-416d-b197-ec1bd02566d7", "comment": "Malware payload (a310Logger)", "value": "e305587a7822a62d73900f2a1f27b5fb53c76de71c35903fb43fab042ecbbc0749bb44d9f4e0f72d0eb7eb8ab2f06013", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346365, "uuid": "d4061751-c87e-4af9-8e6a-fefb83194371", "value": "T1B5559D0073D89E99E0DE2F34D0B12E1557BAAD12616ADF4A5D31B5EB2C723C0681B7B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346365, "uuid": "7facc7ad-5eb6-416c-8c48-694491b4cc8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346365, "uuid": "a9bdeb58-d4ca-452e-8b04-335f9bf14c45", "value": "24576:GLpXk+b6umJBDAJeqtgbv6XFz4BD2kghLPwPJENfUO0hmh:GLfqBDAfgD6X5xkBha0hY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631346365, "uuid": "8c9a3539-6f9e-489e-a33b-9022566f88d9", "value": 1363968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631346365, "uuid": "ca73ceb5-8173-457f-964c-85eacc8bc7b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346365, "uuid": "003b1b71-c867-4cab-9203-b66100a98601", "value": "144c71aa3c0921610e282c58749b5e39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d366230-130a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631369604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369604, "uuid": "094afa52-3b4b-4e0d-9bbc-96182f6ec152", "comment": "Malware payload (Mirai)", "value": "8ea691578146c3e150d601da190333a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369604, "uuid": "98e96ec7-301c-470a-9afa-c2c12c28787b", "comment": "Malware payload (Mirai)", "value": "3ff6755fc52749244eead0b6f5f41d671707ab9fb6032fa084a5c535278d4bb0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369604, "uuid": "b85501ed-78d1-4b05-bd90-4ef0c7c97a6f", "comment": "Malware payload (Mirai)", "value": "c2033a82934c04b269e67944201e1015052f2674", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369604, "uuid": "d1c057d5-077d-46d6-94a1-e1448e552d8e", "comment": "Malware payload (Mirai)", "value": "12ee6fffae286a40dee80e9aadc437a173f10b527be81433659d8b5b51d4781df0c944d4fef7f970487bba2b89057862", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369604, "uuid": "0d901fef-9ea8-44fd-b1bc-00efa9392a18", "value": "T1B9E30911F5458462C15F1E3321FB87243B62B1F35B63A101DE19EA9CFB623D06DA9AA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369604, "uuid": "340a11e0-b4d2-44b7-9ee8-69ee3397182b", "value": "3072:ctBHhw2EX7e8juqvSzppVfyhq6fDmjQMQ2XDZ8:sBHhmVjNSzNaq6fDmjQMQIDZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631369604, "uuid": "45043394-3f33-4472-8308-ee7372b44a6e", "value": 146466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631369604, "uuid": "802662b9-1d68-464d-871a-4d3682e514eb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369604, "uuid": "2c0764fe-910f-48c4-9514-c54aee7db4d6", "value": "8ea691578146c3e150d601da190333a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5051443-12f7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1631361645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631361645, "uuid": "80ca3e3e-44a6-4917-b701-84bde1bfd537", "comment": "Malware payload (AZORult)", "value": "59e2c9c861cfd0e2114f51d9db476476", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631361645, "uuid": "0c7f0c84-78c5-4d7a-b556-404789f44bd2", "comment": "Malware payload (AZORult)", "value": "42caa5a2e19134770914b3b33dffaceaae03a44fc52babd8abc250d7d7696945", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631361645, "uuid": "a1c140ae-a846-4b73-af31-8c25b4009c67", "comment": "Malware payload (AZORult)", "value": "307e889a3d28e50c959e94923197dda40d56b000", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631361645, "uuid": "8477b83b-a306-4db2-9fbc-652bb28f2311", "comment": "Malware payload (AZORult)", "value": "b1b70a90e235451aa5f034853f9dded7ad3a6066d059d9acee395d860a5d59dfbb16bd771eaf36b93af6688ccd5f7500", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631361645, "uuid": "d858f845-4ed2-41d4-99d4-8310edd6aad1", "value": "T17125011799B909A2F04909B10AD184F84B7EBC636541AE1FEB81BD0D1CF2AD75CE0B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631361645, "uuid": "287ef96e-3136-4406-8d20-5eaa0097dd8e", "value": "ca357d1c9b605d95e9d31e67e1c53033", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631361645, "uuid": "1bf25773-a0dc-4840-a0b3-77dcf17b459b", "value": "24576:nlgL3p+fExQILTglykduYmNWCxv//Y9TJSjUcvBvr:nlgtgQbUlBuYKZJ//Y9TJyN5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631361645, "uuid": "1c23c12d-8156-4342-af56-a770051c3b45", "value": 1032192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631361645, "uuid": "5218e326-8748-4f53-a586-24e5a3b488c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631361645, "uuid": "ff9367ae-08de-4f07-a362-9e8dd200df06", "value": "59e2c9c861cfd0e2114f51d9db476476.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e2c805-132c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1631384146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384146, "uuid": "b296bb9c-46ee-465e-850c-52a8049ccdad", "comment": "Malware payload (CoinMiner)", "value": "e0ae7add4a87b6a9e5161006e4e4e40f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384146, "uuid": "cdf00c49-e8ca-4549-b3dd-d3ffd2787471", "comment": "Malware payload (CoinMiner)", "value": "435ecb52f149f02217a2b205a39e68776923f4c16a9ca4b8f2db0b3a9f297670", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384146, "uuid": "de32b997-6e84-4be2-82d9-6113744e8301", "comment": "Malware payload (CoinMiner)", "value": "6c7fdde057c09a1694012ce68339978a4bc5d190", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384146, "uuid": "cbf3a8d6-eb0b-430d-87d9-6c561566288d", "comment": "Malware payload (CoinMiner)", "value": "42613264cef364ee7073b151227e8bf87a17f3e8af0eae76b24ebb350d71e99b40622b36dfb507e637fd14a5a7f407cf", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631384146, "uuid": "c7c17126-7432-4ce1-9f59-c72821e635bd", "value": "T1A1753A31E200C239E8E725F556BD3A79356CAA71470439C72BC81EF99B222D97E3416F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631384146, "uuid": "d65c26a4-c173-48ad-888a-493bd7106f99", "value": "94a38222f822f877e3097bc3f229e72a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631384146, "uuid": "50350d18-995e-4aaa-9806-8275ae9eed46", "value": "24576:vUtTGJUVtqb7xAkmijauMug/iyFzb2DfsPV8A4C2vNI1cPdf8xZLGNfav9f:8NG+HuxWiOuRg/iyFzb2QN83XfeYaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631384146, "uuid": "30e9a01c-2ce0-4ee2-9dee-3985e1df7562", "value": 1636352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631384146, "uuid": "356265de-6ca9-4421-9d32-a00e25bcb76b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631384146, "uuid": "c2081610-6b4b-4b75-b8d4-e614863807cf", "value": "E0AE7ADD4A87B6A9E5161006E4E4E40F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "455c3959-12fa-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1631362665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362665, "uuid": "6bcdbbe5-b23d-4209-9f3f-1488e956605f", "comment": "Malware payload (Gafgyt)", "value": "969aed38abc54278b3c79e07ef908157", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362665, "uuid": "b9b1bfcd-65bd-4443-8fc9-6ec825441122", "comment": "Malware payload (Gafgyt)", "value": "4598d219e7a3993eaacfe200b7903cc0a180fe54c7489f91973df90e9c0ce6cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362665, "uuid": "66c224e1-3165-4383-b27d-6b964390f239", "comment": "Malware payload (Gafgyt)", "value": "f6d12d6b789d0bb0ef8a112ad6090467b68e8873", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362665, "uuid": "a7739b8b-77eb-42d5-8b47-a9c821180d41", "comment": "Malware payload (Gafgyt)", "value": "ca7de569c2dbfc2a58aec2f46a341071eecd8da19f0116250f3782c70f9441656a4d95a93fd2a96c5527a296f2d19661", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362665, "uuid": "9a1870f8-26cb-432c-8a73-1def8e369fbf", "value": "T1CDB3D86A3A21AFFFD06986310BF7AF2087D422D626915383F15CD7585E3128D2C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362665, "uuid": "b4fdf471-6501-4f6e-ab2f-009164694cab", "value": "3072:0VW0fIHznlZU5h50qBkxmkizF9GhsRiAe:0APT3U5h50ZxmkizF9GhsRiAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631362665, "uuid": "ebb1a14f-1182-4b12-a697-0c2542d73fa7", "value": 115243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631362665, "uuid": "aa7fc9cf-5b33-4867-84e0-58d46ec840ba", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362665, "uuid": "b1cb43cc-66cc-4b43-a6e5-ca0f37046b79", "value": "969aed38abc54278b3c79e07ef908157", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e3cbb25-12e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1631352721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352721, "uuid": "85194c19-5877-4e16-918b-63e1a789fff9", "comment": "Malware payload (Gafgyt)", "value": "a7269dd396f9ddee182acaf37f2863c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352721, "uuid": "867eab24-d229-4df5-9293-62bf95bbaef9", "comment": "Malware payload (Gafgyt)", "value": "4674ac0be223e3952d0f1719d43169ea8455b030dee60d5750088e29dbe31dc0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352721, "uuid": "c17ea40f-ef18-4206-9654-d591a333a232", "comment": "Malware payload (Gafgyt)", "value": "7ecee1a72ddcc065acc777ba614d7537279cb2a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352721, "uuid": "5b80975e-cd32-42cb-adf5-e11fefc122dc", "comment": "Malware payload (Gafgyt)", "value": "a245cbca7075a9d5bf6313a8f2b0903bccef0f5be4949124439f9f88638de1931ef64a1e0c8f7bff2a1c1631d85e7ae0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352721, "uuid": "8ce194ba-e7f2-4670-b5a6-a6df87ab8ad3", "value": "T1B7E3756E3E21AFBEE268867107F75F70C395259326A19382E26CD7085F7128D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352721, "uuid": "ee9466e9-80b8-4059-8467-91ef2bac83bc", "value": "3072:AvtLZpuGPyaT/z5hKWEfSaWURxuZq+1uPNd5R:cQORz5hKWLURxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631352721, "uuid": "db9e6185-e97c-4699-aa6f-9f0ed1ffb03b", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631352721, "uuid": "b03224c5-c30d-45bb-bad6-48b65a1d3b04", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352721, "uuid": "cb749910-040f-4f35-9ce3-c27d3411c246", "value": "a7269dd396f9ddee182acaf37f2863c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10790bbd-12f9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1631362147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362147, "uuid": "553391cf-b577-4e52-a2b2-8d51d556b47f", "comment": "Malware payload (Gafgyt)", "value": "02fc391072331584c2af0b584e8b1a44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362147, "uuid": "784e87b2-205f-4485-ab0c-09ef3c86dc83", "comment": "Malware payload (Gafgyt)", "value": "475bf1f84d003ea2f50a943154b0ba1855f381594b7c49304176e45859041562", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362147, "uuid": "cc694680-cd8e-44fd-86ec-8262fac8a5ff", "comment": "Malware payload (Gafgyt)", "value": "de4e8b85cc26b0a5adf9e66367def790c8072538", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362147, "uuid": "1e3873b7-1801-4495-ae1b-a689db26057b", "comment": "Malware payload (Gafgyt)", "value": "4da97282a7b38d9a941fb6af6581faa33648412b8ef8cf9c663b00dbd79b04af6a4911e2db84e99f054de142636350ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362147, "uuid": "a5a482b9-877a-4a7b-9507-dedfb75b0993", "value": "T1E7B3E867BB11CEB7C85FCD730AAA8615108DA99716D47B6BB3B4C95CE70694F08E3C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362147, "uuid": "85643bc2-bf30-48c7-bba9-ba3c7f5527f8", "value": "3072:RdbrMMuPEqcx5h1znqQxmkizF9GhsRiAe:R1uMNx5h1znqQxmkizF9GhsRiAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631362147, "uuid": "107fb6ab-a396-46b6-99d8-c66472701f6b", "value": 115387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631362147, "uuid": "76305e5b-c6d2-4e3f-93cb-b7bd2306d857", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362147, "uuid": "e49bc6ce-8e39-453a-8930-f3d08cca80e2", "value": "02fc391072331584c2af0b584e8b1a44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d899ce-12b9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1631334908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631334908, "uuid": "47c5be87-8d29-4474-b448-7fe57891b84b", "comment": "Malware payload (DanaBot)", "value": "643203bc80de891208614cc77925373f", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631334908, "uuid": "3fbbfe87-f1dd-4af8-89c4-1ec3ded06d05", "comment": "Malware payload (DanaBot)", "value": "49f3d49a89443de2c5c954803aff0e8891c6a87c069c784dd67e373204590cd5", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631334908, "uuid": "edc765fe-617f-4fcb-bec4-891de01efe69", "comment": "Malware payload (DanaBot)", "value": "0df0efd8a4d0cabcc8242d708e72cd11ec70b19b", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631334908, "uuid": "b6983b50-821b-4c1b-a14e-8744fa121a03", "comment": "Malware payload (DanaBot)", "value": "b1cd8cf62352e762e6bfa4be1a4d5563750c3d196ac1fa12bcdd95dd7b90fe7494e5da4054d135ed2eaf3a1293c165e7", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631334908, "uuid": "48f7fa42-c6fe-481d-bc16-a415bc14c7aa", "value": "T16E352322F431D47FD01A68F0D1AAD5E01AAFF8710A31A08F3BA72B7D19702D55B6936D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631334908, "uuid": "83dbafa3-824b-41fe-9693-55c8f8121f22", "value": "af15f8c81f40203c694f921fcf93798f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631334908, "uuid": "bc4b46bb-7fc8-4b4b-95a5-a4d5b21428cd", "value": "24576:HXTxHjyhGvhudC7IinQZi+n99VAD41ZxB3IsfVH3KcSVn:jQGhuPkQZx93F/rXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631334908, "uuid": "784520ec-7550-4f2f-936c-05bbda57ef01", "value": 1095168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631334908, "uuid": "b5514584-60fb-4791-8178-ed4791637773", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631334908, "uuid": "f2354384-0ef1-4687-9053-cb57a24546bb", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.27858.20227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed3f3de5-1328-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631382704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382704, "uuid": "02a73da4-538c-477a-91d6-baa49f6b9f33", "comment": "Malware payload (Mirai)", "value": "d6ef1c83f60a7269b56fae03a7801029", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382704, "uuid": "adc794f4-f560-4dfb-bea1-c85e14b72714", "comment": "Malware payload (Mirai)", "value": "4a88396bba406dcd81f8f0b765ec2676f9bd45263c46e376cf654c120a31357e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382704, "uuid": "b55a9c51-8580-4ae9-b94a-4ada0d9683b5", "comment": "Malware payload (Mirai)", "value": "ea14962480f5e32345e3936acaea401aedc0c7bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382704, "uuid": "d05d2009-d5bd-4372-a8d5-264c4c07d391", "comment": "Malware payload (Mirai)", "value": "e749c2306bd4afd001d98736e9aeca528447a314020edfe676fb7b1154150c1f70653b8aa439ffc9118adf18952d064a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382704, "uuid": "f30058da-9ca5-4579-8b82-17ebe90a4a85", "value": "T13C435C52B2180E47D0A31AB0353F1FE087BFEAD024E4B6853A5F8B568635E371586F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382704, "uuid": "3a1d2316-226c-4305-aab0-6b42cf63926c", "value": "768:Db1AjJcuVsRT98JrWb1eQsQWmhVXPxA1c2mwHljny5GjQfhPAm:NAjJcPjb1eQszRUUny5G8fhPAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631382704, "uuid": "c2700f6a-6a3d-4f2e-9b03-4f63a9fda926", "value": 59632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631382704, "uuid": "16d693c8-cef2-4a89-bbd7-bccb20d4b2cc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382704, "uuid": "3604a479-81c7-417a-9d1b-79a6c16569b8", "value": "d6ef1c83f60a7269b56fae03a7801029", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95fd6a05-1330-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1631385993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385993, "uuid": "dc656d74-cd30-490c-bff7-63dd0cb58359", "comment": "Malware payload (CoinMiner)", "value": "f67efbee10897235f033ca95576dc836", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385993, "uuid": "37d23fb4-7357-412a-a57b-e4eb3a2027a8", "comment": "Malware payload (CoinMiner)", "value": "4b347c6eade78ebc01ccf2df5b9c4b026ccda51c59ecd549bdf7186a5546724c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385993, "uuid": "5fb5aa48-a578-4af3-a05c-f2d512b6d5e7", "comment": "Malware payload (CoinMiner)", "value": "b89dc8dbadd4da23b78028e2e4c635c146ab30db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385993, "uuid": "df87c66d-c77c-4b80-b430-74d399714bc4", "comment": "Malware payload (CoinMiner)", "value": "799944655717c587d9d755e60a7bbaaec4b0517872fb7e24911b5f49e8f3f8733dd99ce782efff26e21833d994ba1b32", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631385993, "uuid": "7a9ba98e-5e19-4462-b04c-0a210b8d2c42", "value": "T102D4F135A281857AC16209718C8BD3BAF63ABB045F7C54CFB7DD0E1C8D3734A1A6529B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631385993, "uuid": "0cc01285-b7a3-45f7-902c-faef2370c50d", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631385993, "uuid": "2d9aa315-3823-42b4-9674-f4c99d289538", "value": "12288:pANwRo+mv8QD4+0V16XTfrUQRPTBLWKpimWx+TXeYhcQlM2Vj8UZe:pAT8QE+kUrUQ1TBbXSYhJBVjNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631385993, "uuid": "517afaa3-0bd7-486e-930a-ddc9341a4a8b", "value": 607061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631385993, "uuid": "5e31e7ed-8bd5-46ad-8e2b-91c84374d4d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631385993, "uuid": "ddd0a924-ac9b-43de-881b-42bc505ce0b0", "value": "f67efbee10897235f033ca95576dc836", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c6b0807-1343-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631394003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394003, "uuid": "11dd9cc1-3eb7-4c75-a6dd-f3bb1a461c07", "comment": "Malware payload", "value": "e0022339eab8768ee41344d054eb802b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394003, "uuid": "b53cf73c-021e-49bd-bc26-e8ad5dfa2c8b", "comment": "Malware payload", "value": "4c1fc01f9321a08180fb57cfc164e1fcdd786dd4bf565519897a32cc478ce720", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394003, "uuid": "fb53a5d3-496c-4127-8bd6-23fc7993e8bb", "comment": "Malware payload", "value": "cf098287528ba2740efe09fc8d79f43cf09450ef", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394003, "uuid": "c139315d-587a-4019-ab85-824496be06ae", "comment": "Malware payload", "value": "7a89800dde61e3f3778aa713c2a0478d0685e6e828d96bd35a5e3bc29337992859abfab57d9bd1b35657aca51c5ddb40", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394003, "uuid": "12bcf32c-d503-4b39-8899-47ac60ab64e9", "value": "T1792302481C48F8E2CB3D1FB9E26E02CB591D8DA0C8447F2F2A464BF2A956609473CD4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394003, "uuid": "e5744043-4063-4766-90f2-2cf3b1cecc13", "value": "1536:e1E/4kk15GbZwJyUtPuHjq1MJToh1ix8OZRO2q4txv:eaP522Hjq4M7YNZRBfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631394003, "uuid": "ef3de174-a637-4b66-83d8-5e38e62c3653", "value": 49308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631394003, "uuid": "fed6dca0-31c2-4f2b-8e2b-3b08cb36ecd5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394003, "uuid": "6e0a9e21-dd5e-4012-bf70-1e83e70f802a", "value": "okamiii.4rm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19bdc8b-130c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631370551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370551, "uuid": "c4cecc66-9b04-4929-a599-07308c3635fc", "comment": "Malware payload (Mirai)", "value": "d0c7170aefc4fc9c4af6c6aa95e35ac8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370551, "uuid": "dc3a9da7-c62c-4b18-89bc-f4526bbcbbdb", "comment": "Malware payload (Mirai)", "value": "4c6e346cf7e3eda7d711862c1189203e620dc19d28b8e848f31f41d34776baab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370551, "uuid": "5a98013f-0cc0-4b54-bac8-1567c04f2a5a", "comment": "Malware payload (Mirai)", "value": "c758242eb4dec725e66b6500d83348e331f89b29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370551, "uuid": "dc25db04-4a7f-4b4f-9262-58430eb7756b", "comment": "Malware payload (Mirai)", "value": "a7638a8a3224311b4112240c06c399797932dafec03da75473b1850beb231e9c483f1773b9a3309136330d3d3050cef5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631370551, "uuid": "f8167994-82db-46ea-93a3-bd27e61f3cd3", "value": "T1A9C32A01F8404767C3D327BAA78E438D7B3657B557DB33116A389DF42BC0B992E299A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631370551, "uuid": "c378cb93-b3ad-43af-8f3c-730243d72afe", "value": "1536:uqk3kl4WvG3mAyvODrWPYjoJMdPAjESjjZOxNidcTFgPMotTmtsDQ70kl5XHkrj:vI3ovODraMTSjdaTF65mtsDQ70M5XH+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631370551, "uuid": "8aef73f9-efbc-4ea4-8c09-c56c8e204807", "value": 127413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631370551, "uuid": "1c1d9992-691b-4e55-968a-7c58d1ec15fd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631370551, "uuid": "31c2157a-9af7-4f9c-9f9d-e9d24587f25c", "value": "d0c7170aefc4fc9c4af6c6aa95e35ac8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c46dea9-1318-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1631375696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631375696, "uuid": "8b90bb08-e90f-43b2-9dd0-903291bad05a", "comment": "Malware payload (Formbook)", "value": "717297fec68e9172593a36a67549619f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631375696, "uuid": "8435664a-81a6-41d7-a4d6-f0faa2a5dafa", "comment": "Malware payload (Formbook)", "value": "4d80ab79360b092bb5d8fa41d14388dffe5ef42839b6dbbf741f0ce5c3424d1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631375696, "uuid": "a53268e0-a797-4682-b385-ea84022a6d0b", "comment": "Malware payload (Formbook)", "value": "73e8625983cb413b91b608db347177584c680a22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631375696, "uuid": "c03db1aa-0150-4c9a-91e2-045debfc8d19", "comment": "Malware payload (Formbook)", "value": "7b9b5d33d7061b79cfc45e3f6e9e78c81ef5b0d4509da80c5f622747ac046a3cd99427fec2b636107f29e725ab11e439", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631375696, "uuid": "f121b0ff-ff72-4303-95df-e4c6470c3be4", "value": "T1F1054C35E1E829FEE05647F91C2971F684227E3138187CD96EB538C80EBA64361357AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631375696, "uuid": "4f56e135-c28f-45e5-b037-2863f7574f61", "value": "a6f9ce49927a1276962e131ee30a4701", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631375696, "uuid": "bef75343-e6aa-4b2c-a129-b71ee7911d6d", "value": "12288:GDylNhPTW3jR+9bHoraZlojpF/b8PmcuVpvC1VGEdPj:j7I3N8DoraZ6d8unzUV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631375696, "uuid": "d9e7f55a-690b-4c59-b0b1-5e52ff86ac74", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631375696, "uuid": "efa798ef-482a-4dff-8fbf-e39b0cfd510e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631375696, "uuid": "71bd83d0-3502-4ec0-a86e-730ec66ae958", "value": "Bdcuhmcgbsvmxhmuasrulqqnfbjdnogomk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a75b548-130c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631370297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370297, "uuid": "7cc60577-2a42-440a-aea3-33228c029f35", "comment": "Malware payload (Mirai)", "value": "702dcbf455196689596c3a01644012c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370297, "uuid": "b334df13-5a87-4b4a-8ae1-b29d4939b3b4", "comment": "Malware payload (Mirai)", "value": "4dee4ef4fb273b0e489eb909735d6bcbdcb5b9e0e006eb3a371deff440ee320e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370297, "uuid": "a3370763-3440-4c2a-be7d-488f396bd006", "comment": "Malware payload (Mirai)", "value": "f88f804eda6d85948c294a670857b0466080b90d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370297, "uuid": "66d505e0-3884-4876-ba89-ed51b0d3e0e2", "comment": "Malware payload (Mirai)", "value": "47576c4635ed06d70feb1749917b9e7d6c1fa505918b1e47b34fe875851d66ef16551c58e7552b943bd972711c9ee22e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631370297, "uuid": "8750dc4b-fa3c-44b4-a58b-61e6466017f3", "value": "T179A34C56EB42C2F3C4430AB3025BAA594922F67F5D2F6A49F31D2CB0AF124D67256FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631370297, "uuid": "d1ff66ab-460e-4e4f-8418-dcd54a01ccda", "value": "1536:L186m1QCitbWzd5PWZKKuOQEWOvp86qryUa6tcFFmKHY0Zhs9Yfoksd:e60/XecKuOzVvCU5meY0Zh6YfoBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631370297, "uuid": "0d22f978-6cd9-4bba-ac53-75d20b6600e2", "value": 106896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631370297, "uuid": "1d9a5f27-1709-4c3b-962b-dcc6dafc804b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631370297, "uuid": "a67743a9-965c-43f5-845c-102904896f94", "value": "702dcbf455196689596c3a01644012c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37493b2-12c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1631341375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341375, "uuid": "e5ed7c76-5dfc-4f96-a8d1-9612a8aa1dcb", "comment": "Malware payload (Glupteba)", "value": "3ae61e9f9aa3f193590c6c0ab2cfc1e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341375, "uuid": "c1e35e15-880a-4327-a5b0-dca9f28dc6b4", "comment": "Malware payload (Glupteba)", "value": "4e3740f106a2dd5ff862d1d88885e869a01fe7f3aac167e4d8eeaf7e9b2e5393", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341375, "uuid": "84333da3-5696-40a5-8671-6414eb7725fd", "comment": "Malware payload (Glupteba)", "value": "21f801a409f339a3a6284899a56345d81da729ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341375, "uuid": "96dc1c7f-4c99-4ee9-b7c6-449d9dd8a881", "comment": "Malware payload (Glupteba)", "value": "f4c921d9ea8a4d9481fdcf07980c01bd6567c6d9ab47873a8ab43c681c8679394a51c07d0d31b08e1f423a44d25d3299", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631341375, "uuid": "c666b68d-776f-4322-aaf1-0cb222564a34", "value": "T1912633333E81DC7BE35726B0B17188495BAE7DA65604A247972686FE1FD038C46F8B0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631341375, "uuid": "9d39be89-2d25-41f5-8b42-cbb3e17b0b3b", "value": "af15f8c81f40203c694f921fcf93798f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631341375, "uuid": "6eafd118-53b2-46ca-a5c3-fc7d27c4fc86", "value": "98304:mFr2HBl7R9Jqygm+4o9W1iCulD6zlEAsnIBdEa3YAEAsK1:mR2PRnqygmGaiLlehnBdEZ1i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631341375, "uuid": "8a8b5d2b-afc2-4f17-9be3-1af2bafbc3f0", "value": 4557824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631341375, "uuid": "5780ca0e-a158-4750-b854-f74bf024ed15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631341375, "uuid": "642f75a1-3d80-44ed-ade8-41a24b926e2c", "value": "Meta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6cd5c78-134a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631397242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631397242, "uuid": "4cae9aa4-841d-4602-8f69-c7f883ffb48c", "comment": "Malware payload (Mirai)", "value": "85e2cdea43f0f6c3190bc40fef261574", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631397242, "uuid": "e7057227-c258-4aca-86ff-5323a8256ae2", "comment": "Malware payload (Mirai)", "value": "4e73ad89846840984c4754eebbb1bb0122c456392d304fc5c86b1c7593884720", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631397242, "uuid": "8a352a93-a7bb-4e59-add1-c49beffc37f2", "comment": "Malware payload (Mirai)", "value": "eeed883acef3cc08cd3049821845ef1868458dbb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631397242, "uuid": "5f21f289-91fa-48a5-adf2-e2406480ac77", "comment": "Malware payload (Mirai)", "value": "60b32141d5776ba456700336a8889dc8bd71572c34e77487a6064abe52ab41be0cd45b259d496a08d248aabf8842ba6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631397242, "uuid": "5f01ed0b-7252-4b1c-aed7-b49c1e8ce25f", "value": "T139B319A7B901DFF2F40AD67604C74B157630FBA20F532622721779A6AE722D53827F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631397242, "uuid": "250fefc4-099e-40fa-8d46-c77ddcf2639c", "value": "3072:fN/Opaku8zZ+CjOwU9/6LGdEy7t3J3FEDH9g2DyGu2q2N/:fN/FUACjOwU9iy7JJ3FEDH9g2DyGu2qg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631397242, "uuid": "b9b025e9-353b-4e16-b3a5-f3f943c90ffa", "value": 114247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631397242, "uuid": "c53a41dc-44b9-4c01-94d2-e5add7c18f31", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631397242, "uuid": "ece00a94-d3b2-48eb-bdcb-4a0c82af8c1b", "value": "85e2cdea43f0f6c3190bc40fef261574", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f8a38f-12cb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1631342431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631342431, "uuid": "8cb39ba3-8059-4d54-8f25-399c63cd9322", "comment": "Malware payload (RaccoonStealer)", "value": "390c9fafd3b294a41982181dc9bddbcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631342431, "uuid": "f8517502-2b2d-4756-8b08-7515fe84b71d", "comment": "Malware payload (RaccoonStealer)", "value": "4f86bb133e6e11730ea9a42d2b199d6e28ac7e29add3250416b467212921a02b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631342431, "uuid": "fb84aed6-65e5-40ec-9e98-2b3b8f4b1fe7", "comment": "Malware payload (RaccoonStealer)", "value": "6ebe563483b1bd90f7b3b2175af1984f02340dba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631342431, "uuid": "a25cbbb7-429a-434d-86ae-257e2dafcddd", "comment": "Malware payload (RaccoonStealer)", "value": "12725ff9352dbce5f0674a23ec01e033847565db3ce13af734109aeace53b63a8cc932ab6a98682ac5e69bdd5cd0fbc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631342431, "uuid": "0d57da5f-67af-4591-b15a-be106337cb3d", "value": "T167B4E030A690C035F4FB21F859BA93B8792D7AB1977490CF92C52AEE17346E4AD30747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631342431, "uuid": "57669d6f-cff0-4aab-bb16-ce937b475cd1", "value": "69664ea36ab9a3e93e02fa2b7fdf56ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631342431, "uuid": "a6be334f-639d-42f1-a1ca-9410f9760333", "value": "12288:4039Nu2L7+n9W7+ydinjhR39xfpRGE8QgJr:/tM4aqijFRp8Xr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631342431, "uuid": "4b40f612-7010-44c8-aa19-a95cee276cb7", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631342431, "uuid": "303b09f6-ffed-4c28-af54-6369514cbf8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631342431, "uuid": "6bb84e2b-2b18-49f3-8f46-7766a97273d1", "value": "390C9FAFD3B294A41982181DC9BDDBCB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4758232-12de-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1631350879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631350879, "uuid": "dec30ab9-fb6d-40f7-833d-ae1b3d73c1c2", "comment": "Malware payload (njrat)", "value": "303c6c4a9296d2eb2346f3c457465556", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631350879, "uuid": "f8ef89e2-46ed-4495-9123-701c22f5e7c7", "comment": "Malware payload (njrat)", "value": "50577b8d20e216e731721c76975564ab1a6feeb16b168d7ff09e6e38b3eec0b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631350879, "uuid": "ed7cf73f-fcd6-4264-b4ab-3af90bda1d97", "comment": "Malware payload (njrat)", "value": "0d0432b65763d233b7369019ba1ab7bc9ff4209f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631350879, "uuid": "0e520173-eb27-4c90-bc1b-b7fd904dba52", "comment": "Malware payload (njrat)", "value": "2e3f355658d9dd3126b35f6d5ea0403773ac8a1cc4fac540ea7be5922b8598fe3f04cbfae34f47970eef5b9adab91017", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631350879, "uuid": "324946fe-3797-4692-876a-898253e1dee9", "value": "T1C244953E28142FF3AE71AD37E09A1086B6D0748127E31A4A369F561D757B643BC4B39C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631350879, "uuid": "0822c317-bf82-46f6-a0b3-478cf93a3efb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631350879, "uuid": "0e2e8f9d-556d-41c6-8431-05654636b4f6", "value": "6144:OXXXXXXXXXXXXXXXXXXXeS4NBzRqclMARpbY9Gsh7QJ8aBgd9GYjHsoXW91WAIr5:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631350879, "uuid": "ea872740-8ee7-4a14-aff3-dc49da831a95", "value": 264704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631350879, "uuid": "572d17ff-bbd3-419d-b432-c4cd21a03976", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631350879, "uuid": "1d1a86d8-6d26-4c19-a5c4-0ed3dfece881", "value": "50577B8D20E216E731721C76975564AB1A6FEEB16B168.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1878911c-133c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631390937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631390937, "uuid": "8efee2f8-8649-4af3-9071-46cf9cf9d6a0", "comment": "Malware payload", "value": "8f9aa685c34f790683dc28e33a314c1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631390937, "uuid": "783dc7ec-ab5c-42d0-bde9-75af721fc647", "comment": "Malware payload", "value": "508de64df862e583366fa1d6b4b933a8e85ac6f570cfd23fed57b5605dc2ccca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631390937, "uuid": "833e4342-1cba-4553-8b37-2a9303cf4b8c", "comment": "Malware payload", "value": "f17879176872aa63463f1b7eb4560f0dc36252ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631390937, "uuid": "4e75406f-1ea2-4958-b5bc-4a1194ead404", "comment": "Malware payload", "value": "84ea385c6ea83251a9c29927745d267f127fb6073071ad451ac052fa4a3a2d972a33a16d52ecff6206a9d0955e20dc0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631390937, "uuid": "0402062b-290f-4469-a0ba-c691d95c6442", "value": "T1724523EC980981A3EE44D8B0DC721699EDBC991AC192379FB7CBFB130F4A2BD5432551", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631390937, "uuid": "2f413891-77e5-46dc-a242-ff1b255fd017", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631390937, "uuid": "b0a41e4a-a2c0-4fdd-ae43-bd998f731d6e", "value": "24576:nu8wEsDDEJRU+rRyaTSgAAsCf+tWyZJGk+QAt0PcYa2ZBjF1:u8wlvulZ1CnZJGnNt8cYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631390937, "uuid": "01aa9b93-b6e4-44c0-a18b-4374c81aeca7", "value": 1167872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631390937, "uuid": "a02a2d97-0d86-4574-99a7-fe19160dc678", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631390937, "uuid": "39c0c750-6fa1-41e9-b1d5-a84153785cf1", "value": "AeroCheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883c39c4-1314-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DCRat)", "timestamp": 1631373944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631373944, "uuid": "12a46ebf-cce6-4476-8ecf-7d2da969b4a9", "comment": "Malware payload (DCRat)", "value": "db1c269417ac6c91b7400b30a22d1fa2", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631373944, "uuid": "6456eea7-bebd-469b-844a-7c64d00744bf", "comment": "Malware payload (DCRat)", "value": "51b8434c68594113a4036358e477fe1ae1b4cc0b99d653b224250e24537d87e2", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631373944, "uuid": "621f62c8-f604-425c-8be3-b17dbb508740", "comment": "Malware payload (DCRat)", "value": "2baacb6886041819558eb2cf0e597e4f7d9837df", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631373944, "uuid": "bd68791d-4b9e-4106-901b-0cef908215c5", "comment": "Malware payload (DCRat)", "value": "6b356c35e27bb42dea678d074e6d2efd25af98feedee25347bd4256ac2407075b5d3deb78c35521bcd537aeb51c9b4b8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631373944, "uuid": "7afd745a-6179-40ac-8bc5-1273f02af6f7", "value": "T11D7559037E4EDD02D0291637C9EF947807E8BD402B66DA5A7E9BB35D64123A35D0E2CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631373944, "uuid": "5f148b92-a814-4fe6-bd6e-68dae5023fd3", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631373944, "uuid": "24a6a3b8-eafe-4de1-8184-a3cf22692fe5", "value": "24576:u2G/nvxW3W/tctRac2rvYYDNIRDUYTnJcTA3/lXzzcjb6Xa+4c:ubA3g/HL49f3/JXcYNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631373944, "uuid": "6b85580c-3e26-47ab-8383-0dc6301fd12a", "value": 1649309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631373944, "uuid": "d5c64a39-5961-4037-9d19-b684509d9f15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631373944, "uuid": "61e52281-d42a-486f-af29-5e22fef23c99", "value": "DB1C269417AC6C91B7400B30A22D1FA2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e318ecfa-12c7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1631341025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341025, "uuid": "e77ac496-70eb-40ce-b777-a31ea063725b", "comment": "Malware payload (BitRAT)", "value": "13dcc1ea3279d9adb646d12549f97952", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341025, "uuid": "b833c0de-37da-493c-b590-ac918e28a564", "comment": "Malware payload (BitRAT)", "value": "55910ff034378821d0dce0efbe403eca0664ded072b2e2cee6ab450cce972625", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341025, "uuid": "888775c3-bcff-4548-bd91-6e3ba812b486", "comment": "Malware payload (BitRAT)", "value": "eaab18ecbbe1c84cb364922f4f9153f6ff1ff9f5", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341025, "uuid": "85791a66-7224-4ab2-9d9f-e62cfa500bc7", "comment": "Malware payload (BitRAT)", "value": "6517d4446053d4e7a69c3443bc3ea47f6ccc36d156ec394baf4c88d235f9c8813c6ff0e7f4a8ac57592cc7503a10d262", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631341025, "uuid": "24de5262-a3f9-4b85-b26a-85eb2080185f", "value": "T107655B8A930344B3F0639379C8874DE5AD1BBD102B1BA542EEB03A7B5F772617939187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631341025, "uuid": "b746cf41-a6ac-43d3-b026-5c84fbb08394", "value": "24576:FORzbL0pn/Qi+fOTFZ0IDx83FMKqVYsqS8:AmXCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631341025, "uuid": "2e9b012e-22b7-4608-8d5e-383486e44fda", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631341025, "uuid": "b4d96ba9-7902-4dc6-87be-8e0ca6be5fe4", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631341025, "uuid": "16272d4e-edea-477c-a803-0e227131622e", "value": "DHL files.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e304c579-12cb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1631342743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631342743, "uuid": "666137c6-f004-4018-bf99-c37a66dec663", "comment": "Malware payload (RaccoonStealer)", "value": "60ed2c0efe729ddbda0393bbc8f6c5c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631342743, "uuid": "714c59d9-131b-43c5-8d86-29e425c236e9", "comment": "Malware payload (RaccoonStealer)", "value": "561a8533273e9f2b9c5fb33089538d4c70d6b7d6358750ba89dcf3c56417d95d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631342743, "uuid": "58948a04-7b77-4e52-afc0-23d3e16aa1a4", "comment": "Malware payload (RaccoonStealer)", "value": "d6883c2b60627ccd52f47db2fd845710a6c98a08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631342743, "uuid": "715add05-f2ce-481b-be38-d458c0886302", "comment": "Malware payload (RaccoonStealer)", "value": "c57020aef8ec1ec9c74c2aaddb0b524a62099f54ca072b964776e31cdb6e4949abb4804595460e5939c715a2e50179fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631342743, "uuid": "81b90081-4340-4441-91f0-9e0f02946469", "value": "T1A1C4E030B7B0C035E5BB26F498BA93BD692D7DB1973080CB52E526EB16382E49D30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631342743, "uuid": "a7d509e1-2add-4316-8a1f-2e8a48627dee", "value": "69566d56ce8187d49438dd02ea591694", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631342743, "uuid": "0542ee22-44bb-44c0-8ffc-ec537a2f5b1a", "value": "12288:eVwiSOzwGEs0YaGWH3Z9j1GQxcYZ67M9dEO2ErZv96:EwiSip4XZ9xnV+MF2yZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631342743, "uuid": "ca27846e-d3ec-47c7-b820-da936a5be59c", "value": 583168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631342743, "uuid": "b5ba10c1-8991-4ecc-be7d-f4be9b19c0fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631342743, "uuid": "72b6d29f-d953-4b34-86f8-f03f2e027d66", "value": "60ed2c0efe729ddbda0393bbc8f6c5c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "222e4b66-133c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631390953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631390953, "uuid": "a2a608f7-f02d-4998-9563-e8ace3909cca", "comment": "Malware payload", "value": "7d6775e24b910e93c3846efeaf91263f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631390953, "uuid": "08335fec-5a16-4dd7-8c08-dea956276e8b", "comment": "Malware payload", "value": "57f8f1739037c713eac962b1a690490e645f402a3f0dd3309d65bf5292f7c6c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631390953, "uuid": "12477955-dd68-4e3e-a287-cdfb73ef1b14", "comment": "Malware payload", "value": "87056638a08660cee518023c2854a30f1225f40d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631390953, "uuid": "cc2e5695-ee64-4759-ab27-ba0ba260e1d4", "comment": "Malware payload", "value": "52088740057e80df6a3669c854e771f937a3bf7fa40ec896f9575d9346e1bd26e7b88f0e75d010b3d8efd88e21b8fbe7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631390953, "uuid": "cdea172b-2194-4196-b089-b307ae65cc08", "value": "T1534633747D42B6EFD01B433C963E6F12AB2037456EEA4B45EED82363C2DA4B4AE51434", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631390953, "uuid": "1f8f5b81-6a16-42e9-a605-8bd9cd7a19c6", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631390953, "uuid": "266ccb87-7120-4195-afd6-168d23d499f1", "value": "98304:AwCNchJA3DsUYk9EAl/OU3x2N43ASjWpnC9RmIg4qL9VMQ0YjFzAj:vdhmTzX04B9R9G9VtZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631390953, "uuid": "5cb61c04-fbf0-43dd-a825-febab285d033", "value": 5393226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631390953, "uuid": "4b4bbd5d-36d9-4fe8-bb45-bd3ca649e508", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631390953, "uuid": "f2440a75-634b-4c05-bfc2-32e063703e7e", "value": "Fortnite hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78fb88cf-1323-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1631380361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631380361, "uuid": "b1e9ba8d-1720-47d4-a604-58faf1496cbe", "comment": "Malware payload (RedLineStealer)", "value": "5d73ce526397a5ba2806c3d6d560a385", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631380361, "uuid": "88ebc4c8-4b63-4dd2-9d75-a91f539c8af4", "comment": "Malware payload (RedLineStealer)", "value": "582b315efd63779bc58a34cb1a771a16a3491e7104b868a6c0d5340ab00becec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631380361, "uuid": "265a6a5c-b59a-4ef2-bfb2-5b84804eb3ac", "comment": "Malware payload (RedLineStealer)", "value": "a7dd6b8c3118d263be54ef9fe0a0f47fbbb527e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631380361, "uuid": "52b0e9c6-6f60-44c6-98b5-a677ff02e957", "comment": "Malware payload (RedLineStealer)", "value": "e84a89af1656646ac0fc63a2835dcc9af4a340eb4ee25587c44b9955c7921d2e9d2b110d7fb021e0afd95a5082726fdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631380361, "uuid": "3321513d-7170-4d53-ae3e-5e9ed48ce57c", "value": "T1B384AE30BAB1C031F5F752F895B993B8692E7EB16B3090CB62D116EA5A346E49C30753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631380361, "uuid": "96d37ff5-5d39-4e39-9dc3-57f4908d89de", "value": "7dedca7bc07f096eb3cce2bfad6fc32b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631380361, "uuid": "46728459-dafa-4a9f-a89c-28d7b216ed17", "value": "6144:BYSino+TR4Ivom+JiquARh10xBLqZEWCsIPqfHwri4SwPgn:Jko+TR4IV+kqFrGx12EWMqvwrEwIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631380361, "uuid": "137ccb6d-7781-4518-8cc8-68cb7c518089", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631380361, "uuid": "5fffde1d-d360-4081-8adf-ea1eba5a0f71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631380361, "uuid": "45aff621-da5d-4e27-9730-ace64fad8ba1", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.7994.7917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177ceecc-12cb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1631342402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631342402, "uuid": "b00f5b9b-e95e-4af3-b5e8-ff49cf39fdfe", "comment": "Malware payload (NanoCore)", "value": "aae9e03dc710a18538480966fd86b719", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631342402, "uuid": "8cfa3c8e-5046-42a0-ad6d-262462b2c9fa", "comment": "Malware payload (NanoCore)", "value": "588ee342c6665d17d6df38f0daa6b2617b277382cbc0c3d577b559bf6f7f7ecf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631342402, "uuid": "76320472-b9f0-47f8-bb69-4c917687163e", "comment": "Malware payload (NanoCore)", "value": "528df018ca5e4e37ad55a24e6012b7ad581ffbf4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631342402, "uuid": "2b48ec65-e619-4267-9efc-4ac96c995960", "comment": "Malware payload (NanoCore)", "value": "bcc994f90a237d24963e6488da55e8b9733df500cb7c37afe7ea95354d8dc29e4966eaf4832a7c6682dfbc56fb484a4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631342402, "uuid": "ac2c51b8-18a2-4bec-a423-19e43a71d2be", "value": "T18E25023DAD162633AFA9B27CD4D6194EE79414EB23718DE9D5E2B38C2007913B2D631C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631342402, "uuid": "13979ac2-aaf8-41e4-9e26-7203b82ff505", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631342402, "uuid": "0dc9dc86-de7a-4315-b34f-32d4e8c4bd43", "value": "12288:4zE7F84DtPASSVdYiO5GpS4u6C5oWpf0y3k0Vb/AElj8iDxLBYR1p2Z3+Xf6Meij:4dblhBZK98nMfZ9whRn3liYbele", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631342402, "uuid": "ece09107-7d87-4197-b54e-c1bc7fec6877", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631342402, "uuid": "cbad664a-98a5-4939-8931-07c4caabdb93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631342402, "uuid": "1bf91df5-939b-4d6e-aa72-7f739414a21b", "value": "aae9e03dc710a18538480966fd86b719", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63438a85-132f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631385479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385479, "uuid": "4df092b5-d70d-42b7-993a-c9af883f16fd", "comment": "Malware payload", "value": "19c1668bc024f5d190a5dec8da3aee70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385479, "uuid": "18c6419d-5678-421c-9a9e-397e22204efa", "comment": "Malware payload", "value": "59c8968c387cc10887a2cae1a5353d0cac816a80e64fa6f76f219469450ad17f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385479, "uuid": "1b3805a6-d3d7-460a-b71b-e94269f373ab", "comment": "Malware payload", "value": "60f2c4980418decf5df389dcdb1e069967909f3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385479, "uuid": "37ca5227-64aa-427e-8747-a5947c54ab6a", "comment": "Malware payload", "value": "2bd88a24363f9e1ad1f45fe18a90d65f1bb7125b2ca9c6d4666884df11b59212fe6fcd0b064bee8e4bca63d6f5c98138", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631385479, "uuid": "1f87e992-b51f-4908-ab0f-62e98ce3119d", "value": "T1433623A302753089E5A1CC3DD523FDE4F5FA17868B42E8BC55EBACD626618D4E603E43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631385479, "uuid": "edbb4895-6350-4304-b88b-cd756fcf2019", "value": "5b9290431b366a1252cf05522cb28180", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631385479, "uuid": "abcd8439-350d-4fd5-8b1c-1d8682c04ed2", "value": "98304:I/xbapfOiNqjfMc2DRcE0oTo22ObpcpPwwD8PNHUFDxxxRut5dmjBXMiZT397MwK:0x+pfOi2fXyCio22kwD40FDxfR0PmZMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631385479, "uuid": "42e483f7-d764-426e-a870-52bc9daad515", "value": 5299912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631385479, "uuid": "620001ef-56e8-441a-a4b9-5b77fc54d357", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631385479, "uuid": "432205fc-b05f-4cba-a217-3bd7824f1c59", "value": "19c1668bc024f5d190a5dec8da3aee70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "156b30df-12e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631352706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352706, "uuid": "61724256-b9f6-47f1-82f5-2ef2c3ddb621", "comment": "Malware payload (Mirai)", "value": "4bb013402df98d67d8b1a525d28cd470", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352706, "uuid": "631be8d9-d278-4206-9ab8-c16c4ec9fe2f", "comment": "Malware payload (Mirai)", "value": "59f62212f117999ddf347220015575bd3ebf84ad58c17b44411ca65915cfaca8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352706, "uuid": "44077182-0528-486a-8bb0-03185695f24e", "comment": "Malware payload (Mirai)", "value": "4a9b3c487d8f91e285f25a484a10205f19f3ad83", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352706, "uuid": "4ba89c68-5a0e-4058-be00-7e84e7c20ecf", "comment": "Malware payload (Mirai)", "value": "bfa3c2788fafc689b031da8ae4becc252f44531e2e7012c42ce6be02d8145c7a979531d4104610489b7fcfd8bc131685", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352706, "uuid": "062679a4-6040-4740-b23e-791ef7f24642", "value": "T1BDE3A51AB7619FB3D81ECE3706AA4601108DE55A02ED6F6FB6B4C51CE78B84F08E3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352706, "uuid": "8a2775aa-08cf-46f0-8427-cd8fb2a31823", "value": "3072:C2ttgUm6Oq+lozJ5hdCNzhsURxuZq+1uPNd5R:C2ttgxq++zJ5hdC8URxuZq+1uPNd5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631352706, "uuid": "6a63e63f-2d3c-45a2-b048-b1afec5b3c21", "value": 154480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631352706, "uuid": "b200d6ff-6a3e-4ef1-b635-c04aebf30417", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352706, "uuid": "851dec4a-056c-479c-a7cd-ef1406558d33", "value": "4bb013402df98d67d8b1a525d28cd470", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30d2ae06-12fe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1631364349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631364349, "uuid": "1c473bc3-16e0-437c-af69-e758872fdad4", "comment": "Malware payload (AsyncRAT)", "value": "5a0c14a1af41537e1cc6f0982291605f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631364349, "uuid": "02deb2b5-73f8-4a00-a17d-847d9082c484", "comment": "Malware payload (AsyncRAT)", "value": "5b94549310fa83f8e670f5941c37891555f4e2e9881d84845ee0b06b69699e12", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631364349, "uuid": "51e425c2-5696-4dcd-a883-79c4fd907b0d", "comment": "Malware payload (AsyncRAT)", "value": "1e3bdc0dca5cdf34fdfd9408dc00d45e77cecdc3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631364349, "uuid": "7f6d5495-4f32-455e-b532-488babbd6042", "comment": "Malware payload (AsyncRAT)", "value": "4bd1eae62b495e04c17d9ec81c33b817b47139d363642cc67756beb888d303adb1d78d3b42636fb4243a04540598a72d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631364349, "uuid": "937a1949-c551-4964-a9fc-6f35e783326a", "value": "T15001F108D5EEFA37C643BDA6D5D688C1E53453463760F50E7812E420E0790A4C16E6C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631364349, "uuid": "1a5915e5-dbb5-47eb-8beb-fdf024236c4e", "value": "24:3J7QMv71Hr38w2EUMg2IIxmZcJfNaoeMg3h3:Z7QkSREUMeZcJfNjeM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631364349, "uuid": "aea8e7b7-28f7-40e0-ae3b-cf6b56f123a9", "value": 782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631364349, "uuid": "831d78ed-daf3-4f6e-a371-ff34cc0f00a5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631364349, "uuid": "72160f63-6395-4a14-bdea-392a1a493113", "value": "image374.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2684ec-12fe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631364606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631364606, "uuid": "85e8730e-7e6e-470c-a22b-2e89e53f50a4", "comment": "Malware payload (Mirai)", "value": "fb1f521fb7532b3a3216157467825fa1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631364606, "uuid": "6aa31073-8a82-46b5-a443-37f2e5a6ef0c", "comment": "Malware payload (Mirai)", "value": "5c0934450275e2000b731c0792d508a673d881d37dc15a7ec5e57a4d9b11a716", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631364606, "uuid": "466c9e5b-bccd-4602-9059-ebc956a2bd98", "comment": "Malware payload (Mirai)", "value": "da32505be131af0743fc251c5091104794dda252", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631364606, "uuid": "9ac7ab89-4bdf-4333-a87d-70816b9b9bd5", "comment": "Malware payload (Mirai)", "value": "0623ca964ad4f56271ce69883d80815cd5ce5b4208063d1f0457988fe925d7289b6bdf224471886394f64576ea2b7cf2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631364606, "uuid": "8b3600a8-51b8-4c1c-973c-5948a6ecbd61", "value": "T130E34A42EA408E13C4D51B76FAEF41493322D765E3DB73078D185FB43F86A9E0E62A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631364606, "uuid": "cd232502-8ab5-4db2-bb7e-351dd6e19ede", "value": "3072:walgM69pe0QmlTvIUdt9mrsplDKZUQQBKXAVanXX+F8JyvSPhLZ85iBMR6yoC1QN:walgM69pe0QmlTvI8t9mrsplDKZUQQBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631364606, "uuid": "b22c32bf-04ef-45c4-b4e0-3edb9cbbef23", "value": 145189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631364606, "uuid": "d0b2befd-c684-4aa1-9504-4bca3198a9ad", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631364606, "uuid": "d3b3a7c0-895d-4d4a-b2e7-a84aacf98288", "value": "loligang.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08b6d8c-12e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631352993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352993, "uuid": "fdb84882-96cd-4c78-a916-b2b771acb256", "comment": "Malware payload (Mirai)", "value": "c2c7e5bf64faa68b513bf499b4ebed19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352993, "uuid": "9a798350-d92a-48a0-b858-a9a2297c9b7f", "comment": "Malware payload (Mirai)", "value": "5f467571b2c6ff128630d816b659ba993fbedd9b92991f2a6b8145e4969a2832", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352993, "uuid": "8308e107-ceb3-4228-a3b9-07efd3134442", "comment": "Malware payload (Mirai)", "value": "42ed96ab217d134c9d38fc93af3ab469c4ae7e6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352993, "uuid": "f503e752-4a84-411d-a03e-2edde74c0e07", "comment": "Malware payload (Mirai)", "value": "68ff3777cae17721483488bf924fd818edbd92ce94a1cf3310468da19e53abcb1d36e505d2ca6e622906ab738f78543c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352993, "uuid": "5e217d75-3293-4a43-8a7f-a2d694b63c18", "value": "T1CFC31905FD404B27C7D22BBAF79E438D773666586BD333115A296EB02FC1B982E39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352993, "uuid": "308d6478-f820-4331-a91b-6be37d6f3149", "value": "3072:4DJDZ+6lJQTnoo3jKiXb6DwXgR5hLNF9u+CyhAnjqojwQQRh6RYAvZR:4Gb6ygR5hLNF9u0ojwQQRh6RYAvZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631352993, "uuid": "6c4cca66-240f-4973-be92-dd5a7cd13b04", "value": 128317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631352993, "uuid": "6c5990d9-fe38-42bf-acd2-e57af49724c1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352993, "uuid": "8d1b1856-ccb3-439b-873c-23d559d84ffa", "value": "c2c7e5bf64faa68b513bf499b4ebed19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05879902-12dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631350103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631350103, "uuid": "b70f3dab-9e09-4b6f-af91-7bcb8e0a3463", "comment": "Malware payload", "value": "e60b189b5dfae48fa8cfa7e63acdd25a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631350103, "uuid": "4bf53d75-6603-4282-98cc-d50f068753b2", "comment": "Malware payload", "value": "605412b4ceaf25fc66306e96a347662161925ba372383ad39a28703d4ef65caa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631350103, "uuid": "5af1fb04-0681-4f1f-a495-e56eef359137", "comment": "Malware payload", "value": "20a76dd11da636744f29d19207273a25ac2850af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631350103, "uuid": "dd986f06-7c48-4636-858e-39efac4ccf89", "comment": "Malware payload", "value": "788365cf1e12dbf144c670596262ebc036ebb207894bb4a1d1d0d020ad7ee0067e5ce94a00d3ab4aafc4b76fba742742", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631350103, "uuid": "4cc3cadb-2c89-405d-b159-a9d714562c90", "value": "T1CCF3AF01BBD2C5BEEAF14C3400BAB51E92356A245B21DAD7C7DC3C8285D2EC8767D2E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631350103, "uuid": "18736762-d4b0-4160-9161-cbc42e275423", "value": "5877688b4859ffd051f6be3b8e0cd533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631350103, "uuid": "13ff115b-8362-4038-bf04-ccfab67d262c", "value": "3072:cq6+ouCpk2mpcWJ0r+QNTBfHM9SEiVQvflvBU3wp/qb7VBJI:cldk1cWQRNTBfM9SH2vfl0wBgB+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631350103, "uuid": "3e2ae6fc-85de-4701-ae8f-4304125b649a", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631350103, "uuid": "e4bf46f0-ceb3-4e88-aae3-395ba659921e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631350103, "uuid": "4f84648c-5a1f-4d5a-ae1f-c098e9c6dccf", "value": "NexusRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7feca215-132f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631385527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385527, "uuid": "feca885d-dcfa-43db-8513-63d3c2783643", "comment": "Malware payload (Mirai)", "value": "6dc1d6d4a5c5a162dad02443e6a62a48", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385527, "uuid": "595a545d-e90d-41e6-9728-0da5e10bfecd", "comment": "Malware payload (Mirai)", "value": "6910d9f7a81649e4afef7ec06cf0a497231256f87c42da4b1a5f79430cbd5830", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385527, "uuid": "2732e8b8-c6de-44f3-8297-34c7d510c7f6", "comment": "Malware payload (Mirai)", "value": "f70b6c6dc66a1c22aa8c69359cf3c88fce5d7588", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385527, "uuid": "55a76f71-38bd-4098-b13e-798392ef8ed3", "comment": "Malware payload (Mirai)", "value": "035dbb69b8586c05eaac361184286e4014508a644d0e55294e871e8770315574dfba4a0d63765790a436786d0236d0d9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631385527, "uuid": "2b02d8a6-851a-4144-b7a0-7e117122bd6c", "value": "T11F633AC4F543D9F5ED1505303077EF339A76F2BA2129FA87D3E99A32A942602D403A9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631385527, "uuid": "7b9ae5b4-1708-41c2-9dd2-c72fc0368320", "value": "1536:GM+H1+SIXqdOKwWlKZxo3JKdaPG/WQPv038Sd8BZDbyRFR:GJ1+SAqdOKwW0Zxo3JKUPGNvM4Dsn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631385527, "uuid": "4c32efd7-2325-4c38-9e40-159d65291c47", "value": 68400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631385527, "uuid": "7a1461d7-d88c-4305-883d-b022f79edfb5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631385527, "uuid": "b41a9749-ca19-4c4d-8d03-ab3b19816fbf", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e861ef8e-12f7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DCRat)", "timestamp": 1631361650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631361650, "uuid": "0c65c51b-6dd4-4e94-9945-a32ed43886cf", "comment": "Malware payload (DCRat)", "value": "cc2c9c27d1dbae5059d048ab23049684", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631361650, "uuid": "6e15ebfd-2b65-493b-821a-38ff1c651d81", "comment": "Malware payload (DCRat)", "value": "6923f777931474820c95c6efa6229ecfa4d03409435f1509d196cff7c4289043", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631361650, "uuid": "a6177a95-1180-4177-9e94-1b23e5469936", "comment": "Malware payload (DCRat)", "value": "99ce3d00da4e1b846e960b3c0e89ba6e919b5c5c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631361650, "uuid": "1bf4c2dc-b795-4308-9e95-6babf84c15cb", "comment": "Malware payload (DCRat)", "value": "aeebedff70709b41574c0c3e5bc8390d60e5493ed8b802d708d35d40687d4c62373fc79b64585b76d4ccaa111a85952f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631361650, "uuid": "4be49965-ba16-4ff0-9b31-548ebe8d6cc0", "value": "T1E5654A023E46DE12D0292637C9DF942487E8BD422B6EEF1B7A5B336C65533A35D0D1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631361650, "uuid": "987a96ae-a1a0-46cc-b98f-36e0dde22af8", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631361650, "uuid": "18f6682a-48a4-4acb-bb44-e2c77ac48326", "value": "24576:U2G/nvxW3Ww0t0amZkn/RmtgRkxkx6Gte9Bx3Q+4+:UbA300LZ4HRuBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631361650, "uuid": "3a917865-5a94-4d3f-acfc-7509067fc74b", "value": 1488641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631361650, "uuid": "c7a95800-851a-4660-a40b-53d0c892d39a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631361650, "uuid": "2f37ca11-01c9-461c-ac9f-78d5c51d7efb", "value": "CC2C9C27D1DBAE5059D048AB23049684.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3200a5-12ca-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1631342247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631342247, "uuid": "822d762d-1467-4cf9-b119-fc2c1c0d81e3", "comment": "Malware payload (Formbook)", "value": "c74cf36eea285e979ea81a2f54573cc4", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631342247, "uuid": "50ea14fd-546c-4472-9cb1-3109a666298e", "comment": "Malware payload (Formbook)", "value": "6956508909a41e6ed3260c43f9f881264fe6a8fdb2b05cff5baf7686c16a8753", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631342247, "uuid": "262a3fe5-9fbd-4030-9820-fd3660c44ccc", "comment": "Malware payload (Formbook)", "value": "97b0ff62d026c2fa052ce5683dc85caf53d9b54c", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631342247, "uuid": "44fa3109-b9f1-4990-8eaf-05e8e30ad69b", "comment": "Malware payload (Formbook)", "value": "eae04c005e73938b60f4fb8d4d6e274d38a38601f234b4d155d5d02238a6c3520badbd83d02ad958b97990c338ee5371", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631342247, "uuid": "9ba87dfe-0478-43c1-b60e-8fb6f2c01fd7", "value": "T181B423021ADB5D9CE0356F62CE6CEE1627349A9831F1C1BDA841B3871181637CADBE3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631342247, "uuid": "2ca4592a-de86-4844-b5a4-9d1b050dcb96", "value": "12288:befNFpDd1PCoqa3rnzD2BQ0pE4vZhHEDu+FKS:boNZCaHSB5N3iL8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631342247, "uuid": "ed178cb2-a140-4236-a498-50a47f1e8e1e", "value": 496424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631342247, "uuid": "41ada03b-cdd3-43a1-915b-fa8dabab272a", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631342247, "uuid": "0143bb95-20b8-49ec-86ec-fe6b9ae10792", "value": "20211009876263543_pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ade31f-12e4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1631353433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631353433, "uuid": "4acca48d-faeb-4697-ae9e-5b5b5cfd5a1e", "comment": "Malware payload (CryptBot)", "value": "c1241645ecbfd9df206f666e48698bab", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631353433, "uuid": "9342938a-8744-4070-b56e-afcbdf6145d1", "comment": "Malware payload (CryptBot)", "value": "6ebf8ce8d1c0147cbd6cff787cb552c3ddf2478123067fb5c699d82da5590811", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631353433, "uuid": "97a62c2a-ffd9-4b1d-bba5-55ea951790c2", "comment": "Malware payload (CryptBot)", "value": "783bc679cf64931eb17e7e4d6fe3ec4734efbd78", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631353433, "uuid": "796c19bd-a031-4f52-a42c-bd75d66c7caa", "comment": "Malware payload (CryptBot)", "value": "b4516941e677df04e5c38a078116180becb0ceb549c4d5d37a186377246ec10f18c39a71358d4595cef3f78852be795f", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631353433, "uuid": "89c2b934-d0a7-4b73-922d-058dd00bdcfd", "value": "T10D44F12135A0C872C49745319929CFA56BBBBD331974D48FBB942B7EAF203C1AB39345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631353433, "uuid": "2fba05d2-b72f-4376-b1f0-01c98e289038", "value": "8b2fc26a018e38936a05d5cf369122a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631353433, "uuid": "29feb664-1eb0-4977-95ca-99f8041fe7c8", "value": "3072:DLfk8yi0JzWhIB1l2ZtJUCGPp5I6nP9iwyV644w84EqFOuWAZCjAY5UojwcrWlVC:DLgJzWGl6J8IiPyV6PaNFF1Z7hcqXD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631353433, "uuid": "97d847bb-eed9-4075-81df-5837bc1ec98d", "value": 264704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631353433, "uuid": "d6db350f-4020-4799-9823-2d1ee2fd0a2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631353433, "uuid": "11ee3bc0-210f-425a-903f-b54ca3909f8e", "value": "c1241645ecbfd9df206f666e48698bab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac4530c-12cc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1631343025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631343025, "uuid": "cbff248f-696b-4286-b850-142a93030528", "comment": "Malware payload (RedLineStealer)", "value": "7663b802e20ee47b431ca593b76e000a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631343025, "uuid": "beb22f86-2806-4f50-858f-7869d687924d", "comment": "Malware payload (RedLineStealer)", "value": "6ebffc2f57819f35342d125f7dac3659899979329c731a2e5badc16648892b69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631343025, "uuid": "0717f5fb-4dfd-4df5-881a-a83a8c366920", "comment": "Malware payload (RedLineStealer)", "value": "cecfda4f6850310394239a94d5b709738e664523", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631343025, "uuid": "851043f9-fc74-4239-825b-ec7f9ec19179", "comment": "Malware payload (RedLineStealer)", "value": "2d2e2916f54824b7482afc917ea21d75e6482b5241f6bd271fd3b03e35742c6a57f9eb3a65ef927b6feb8887a6fba04d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631343025, "uuid": "f69af344-ac68-454d-a8dd-6719c9713245", "value": "T162C33A2553DC8A28FBFE1F757070111147F0D19B6512DB5B9DC2ACFA9E32B826A902E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631343025, "uuid": "9ab24e72-09d8-4d9d-8a93-7404cb09861c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631343025, "uuid": "82733bb6-ff26-4e92-8b18-e111bacbced4", "value": "1536:re1Ovb1I6nkRe3K9uZvMpHAjbuRGd2nhfyq/d3V4dbknE/G6qTaoigHK5A:aLyucvMpqv2n9yOd3MkEq3K5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631343025, "uuid": "f7d40753-8505-4c5e-a729-f57c77766da5", "value": 122240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631343025, "uuid": "e92879e1-0e93-4dfd-ac1b-0a4519217629", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631343025, "uuid": "607cc4d0-36a8-4d09-878f-ed354b4af2f9", "value": "7663b802e20ee47b431ca593b76e000a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "001c1009-130c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631370280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370280, "uuid": "edd115e4-5fa3-4eb9-a0d4-767b3afa8a58", "comment": "Malware payload (Mirai)", "value": "634cbbd3aeaa01a93169df2db4040665", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370280, "uuid": "04256231-02bd-4a57-84f2-284b3b9ab4c3", "comment": "Malware payload (Mirai)", "value": "6fa51b44d9af0466e152fc2ad177d71146ff200600ffea42b5b702123f99608b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370280, "uuid": "1ae55745-563c-42a1-b3ec-efeb5ac34668", "comment": "Malware payload (Mirai)", "value": "685cf088f5c5bf9bf4a65c60257a84bdbc93c2c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370280, "uuid": "7c2b8ab6-f695-4e86-9c0a-efe6dfa7a1f7", "comment": "Malware payload (Mirai)", "value": "e1e3d062b9ec6f299e86ff15d2812921fc749c2519246523e3456f73aa9a59ebd4e96b0e4d0da790a132a4b94b4ef84a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631370280, "uuid": "46eba9d0-c873-4bbd-a8c4-38d175a29518", "value": "T19FB35C03A9619FB3C042A97529BB6A200716A9970F9F2659713D57F0438F8DEB40FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631370280, "uuid": "b101a35e-f950-4a9b-9fbd-06bf73c2053a", "value": "3072:t6zPynxjNR8RQtRSvCZmjXgmvz0Vj5SfLsj:YjydNR+Qts+mjwmvz0Vj5SfLsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631370280, "uuid": "f841540f-ccc4-4dbe-b0c0-bb71d2fb6b75", "value": 114854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631370280, "uuid": "0e4f83e1-eb72-4b61-bc97-dcce16f064bf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631370280, "uuid": "b5539e7e-07cf-435c-8d17-19d075b84d6c", "value": "634cbbd3aeaa01a93169df2db4040665", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6eb8014-12d0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DCRat)", "timestamp": 1631344870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631344870, "uuid": "411a876e-89f8-4850-96ee-0e1a693dca39", "comment": "Malware payload (DCRat)", "value": "b6347d056dcb7fcb71d71393e55693bf", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631344870, "uuid": "8704af07-a2cc-4f03-a9ea-f566fe3c44b3", "comment": "Malware payload (DCRat)", "value": "6fd54cbf5a13356a0ecdd8b7ebda8cfee120e5a5ffc6efea36b096b273ac09b7", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631344870, "uuid": "fb8e7031-fef6-4ae8-b483-213b25ed602d", "comment": "Malware payload (DCRat)", "value": "1081385d1b96d66b2e2346b846a91abdb1b14b81", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631344870, "uuid": "3421d9fd-a903-45c8-9fbc-71fd5e3a8a59", "comment": "Malware payload (DCRat)", "value": "27cab842f8ae3c65c1ea5a7f862b9dff5f3a54a66398cc45c901e3807ad80adaade394a9000142e6afeae8b91604c6dc", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631344870, "uuid": "2563c061-80cf-4d41-9b7a-a35183f3df35", "value": "T1A73517923A5ADD02D039163BC9DF442807ACED427B66EB2A7E9F375C61133A70D1D1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631344870, "uuid": "4e16fc52-1a28-4ba7-bc81-ddbbe5f39f19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631344870, "uuid": "703bd9ea-db33-4983-8a5c-64965cb67222", "value": "12288:vigm63qVZ59AA+n9kPUpZ5SUOv/nKg+uLekDYh21eSHrsjHwWfvO9mdqn4:/BqVZfu2U5wvl+65YYOjQWnp+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631344870, "uuid": "32d5605d-fd9f-4cc0-9afe-5453b9bf79d1", "value": 1161728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631344870, "uuid": "4fc697b3-69a6-4c45-88e5-5c884cb169db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631344870, "uuid": "2bce6e2f-cbc4-4f09-bf2a-aadbca964677", "value": "1081385d1b96d66b2e2346b846a91abdb1b14b81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db916c1-130c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631370544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370544, "uuid": "e77256c5-462b-454b-ae6d-571e4516422b", "comment": "Malware payload (Mirai)", "value": "bc498f8bbb1c038cf62eff38910cc76e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370544, "uuid": "dd91abb5-d5ac-4c43-8982-6c8c5c3dd33b", "comment": "Malware payload (Mirai)", "value": "705155fe01884e75794ac27a218af80419ecdfd8417034151ddc00fe2095e69c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370544, "uuid": "ed3d7ec5-fa35-4dae-8f53-ee63d8ef6c81", "comment": "Malware payload (Mirai)", "value": "1168600a809fd188f7ec7111fbef36b40b1ac7f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370544, "uuid": "512543bd-b5f4-4146-b6e0-0d419d13a55a", "comment": "Malware payload (Mirai)", "value": "e46e64436ef46183648eb14b710572a5f8d020121bf885f92f5ef88fa34e8cef0059b719da09b00ecfb2a812408ec4e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631370544, "uuid": "d86ef00a-0703-4b79-ba5b-af7d0c7bcbae", "value": "T1AF044A05EA904757C1E3277AB68B434D333347A5A3DB33055938AFB43FC1B991E66862", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631370544, "uuid": "6f352040-5d81-4f31-82ad-60462bf33737", "value": "3072:gd+s3r6y4mqEHa0qV7QCmzAHDbluMXhc//ioM/9vjnqLYDmZwwgYQE48:sV32y4mNHa0qV77mzGluMRc//NM/9v7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631370544, "uuid": "67a4b677-37a3-4f51-8d28-aa9379dbcaef", "value": 187350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631370544, "uuid": "4ef50b44-8409-4686-aa20-b9f0df8d89b8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631370544, "uuid": "363a0e79-16cc-4462-8129-ea183c2e0d64", "value": "bc498f8bbb1c038cf62eff38910cc76e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5028073b-1328-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631382440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382440, "uuid": "393602b0-bbe8-4579-9912-b903d567dfe2", "comment": "Malware payload (Mirai)", "value": "6201e4e87fae02e19d70ad869d70b7b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382440, "uuid": "79f295a4-7116-45d8-8a74-8c6210c356e1", "comment": "Malware payload (Mirai)", "value": "70d49fadf3ff2f4763c37dee7961417996132389aa8b1dfdf938f9de84a8d108", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382440, "uuid": "925ce77b-5c0f-4d9e-8bcd-661cd0fcd29d", "comment": "Malware payload (Mirai)", "value": "cf8858097e1303724823e041604c97bf4d65d7fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382440, "uuid": "51388a2f-73b3-4d02-a423-57d779799b9a", "comment": "Malware payload (Mirai)", "value": "08e6d30b5d126f789c4a921feed7e30a806862bae2e258c529dba2e6d8b655a6380487f5902e48fef601296dc31742a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382440, "uuid": "28acc9da-d438-4552-bfa7-f1f8c4d59dc0", "value": "T17B532851B8C19A13C6D4237BB96E408E372563E8D1DF32179D212F507BCA91F0DA7E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382440, "uuid": "9c8b9877-87d9-4223-b11f-cd24670681e6", "value": "1536:fSUKG+t1D9tXoMYlDgq6IY6HLr19WhKtTqEAUqdUNz:fSUKGI1LMr1QharAUqdUNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631382440, "uuid": "e06f2199-b05a-4de0-9fbe-b4d7bc0cb70d", "value": 63672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631382440, "uuid": "2fe21164-eb8c-4ef0-b510-a8cc8deb066b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382440, "uuid": "c582063e-7414-47dc-b96d-11235051fac9", "value": "6201e4e87fae02e19d70ad869d70b7b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce1b3be-1343-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631394004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394004, "uuid": "3ee47d33-bd2c-4227-8e83-fb4ef73481ba", "comment": "Malware payload", "value": "072f25d6467387d3c21cf85af6ade8de", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394004, "uuid": "0ff4f33b-5b73-4478-9aae-7bd152cd2e91", "comment": "Malware payload", "value": "71190ed5574d672bcc386e55d944cce2edc3630fd2df33dfecab34c44ad4b3f1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394004, "uuid": "684970af-8fd7-420f-b323-4940b0b3e2ae", "comment": "Malware payload", "value": "071854ed5cecb42c2db1b6ce42d0236035c8c6b6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394004, "uuid": "d54270df-a140-4f3d-a483-4692406a270d", "comment": "Malware payload", "value": "bff4a50f4e3cdfc44d09d390dfe2599d114cef976ae735062912653ccb586adca4366fbde50e8af1dbd022802a067acc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394004, "uuid": "ad982157-625e-406e-9137-4958d5db99bc", "value": "T11913F1A205B2395CE0BE4E3CC2E726E20A44FC57F99D0A489778EA54D37C447A1CE5BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394004, "uuid": "0731fa69-6d48-4e42-a212-be5407de3fea", "value": "768:9DyW7i8lQxpC7TDDYC4CjmeMvdW3uUAMKME4K9TQX40meeWRMQTxb54w7QO:9v7YxpCj8CtjmeMvdQANM+0b4ih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631394004, "uuid": "6546772f-79ff-470f-b792-67a225706d68", "value": 44576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631394004, "uuid": "080dd05a-38db-4a1c-bbbf-5453eeecd5f9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394004, "uuid": "41284205-710f-44c8-89b9-3354b1ce4a3d", "value": "okamiii.m1psel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c36282d7-12e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631352998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352998, "uuid": "e2d609d7-1904-4301-845f-5cafe31dd75c", "comment": "Malware payload (Mirai)", "value": "f2d1d126fe6467983ed772bced902ad6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352998, "uuid": "be02f855-92a5-48e9-b599-1958ad020353", "comment": "Malware payload (Mirai)", "value": "719e6ae87faad49690762cbf4ab269b946a7594ba6a55695d8d970fb2b59a560", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352998, "uuid": "1e473188-e66a-4290-bcf9-fa8bea3e9d43", "comment": "Malware payload (Mirai)", "value": "400b8ee422947fb24f11326b807d2168824b900e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352998, "uuid": "a4198cb1-d8df-4d77-a0ed-be9c95a8fe14", "comment": "Malware payload (Mirai)", "value": "0686d82d72a041a459c3ce8229da7edbbd4c5b14b518a303127d791c69cb17384c7011cd735684f48ecefe4243d540de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352998, "uuid": "22068e9b-a4dc-4312-bdea-2405ee145527", "value": "T148044A05DA809B17C6E237BAF79B428E73239B5467D733058928ABF03FC27995E36015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352998, "uuid": "ced0b10a-82b9-4539-85a6-580db8261015", "value": "3072:sV/Yb/dnp+eQPGq+/nTCappbzHdQLpzcMbPB7H45hLSC3zVbYM/992qEmmw3Bq/C:++bCappbz9QLJbPBs5hLSC3z+M/90qEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631352998, "uuid": "f0ba58c7-4f78-4d8d-90f0-5d1184bb7ca7", "value": 180192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631352998, "uuid": "6ebe8fb4-d476-48d7-b330-77097f246301", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352998, "uuid": "89dc6132-2941-4480-b7b0-a3ec6a8a0acf", "value": "f2d1d126fe6467983ed772bced902ad6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38123e55-131b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631376816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631376816, "uuid": "d42ed1a4-2af5-431d-a184-981189efd6bd", "comment": "Malware payload", "value": "df46f7077499c629fda43a178a70d6a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631376816, "uuid": "d61cc281-eca9-43f3-bdbe-7bf4e75e5236", "comment": "Malware payload", "value": "754baa6b4007335878ec474d4347f7a8bb42a9955324e84365f8c98c0d376617", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631376816, "uuid": "2bad2b83-b71e-4031-bfab-8b66c5acfb9b", "comment": "Malware payload", "value": "2ca2357a93f2343d64203a5649fd9f8b00702895", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631376816, "uuid": "b4329b07-e582-4ac9-a923-2a7171fec521", "comment": "Malware payload", "value": "13a5bee4180f4510b7b00224792571ad645d18a9eb29243ab2edafc4fd5ea2062e857acff7b2d9183789d274eb9718ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631376816, "uuid": "86f1327b-2ccc-47fe-8b90-c3b4a94815b1", "value": "T1A0547CA2F940D432F1C2017297BA4BF76C38AE391B1850D7A3D17DA229781E1B5B875F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631376816, "uuid": "81e77123-fbc4-443e-ae5e-547d83cc6f50", "value": "1b97638c44e28dc7f804031b638182b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631376816, "uuid": "a66df34f-d1d5-46bd-b489-373c8fccae74", "value": "6144:TO9EMhhQ1rAc4wdi890rljSktzx4Fm7Lcl1nbQOa1:MEMhh6rAc4wdERj9tzT7Lc/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631376816, "uuid": "27719a78-fb5a-4ba2-bfda-59c33eed4cde", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631376816, "uuid": "6efd5494-793b-4d38-8658-5461f4f27655", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631376816, "uuid": "ef561114-e133-47ae-bf99-c3bbfe00875b", "value": "df46f7077499c629fda43a178a70d6a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0818ba7-1303-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1631366764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366764, "uuid": "2d167fac-fde4-4b63-ad82-da4506639820", "comment": "Malware payload (Gafgyt)", "value": "47d17849d8aa2ac874342ca8ad6c8cab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366764, "uuid": "68471039-0620-49fa-a72e-8c45be33e901", "comment": "Malware payload (Gafgyt)", "value": "7647d4c493ece45f7b628044cef57e5ce9b8ebb808674843291b7a1cbcf3a7de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366764, "uuid": "cc976e7c-a294-4328-8690-896f881156ea", "comment": "Malware payload (Gafgyt)", "value": "e219f53c17991319163c3e852ff4c81644017d69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366764, "uuid": "505d9751-d75a-414a-b99b-87570f188df8", "comment": "Malware payload (Gafgyt)", "value": "51af7183326b5b13f59b81175b8eadef5a8f5a8ed4738063cde2df05d7e6fca11a2b17a93ab5044e4fd3d4923b49589b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366764, "uuid": "1803d27f-9327-43a7-82de-ee7be8ea9987", "value": "T1C4B3952A7E22FFFEE168863107F35F7087D521A226919385F26CE6181E7128D1C9F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366764, "uuid": "1b301b30-c1a1-409e-b382-d60efdb06118", "value": "3072:R/4tNF9U4vvZKw6J73x8UmkiSFxfKxbXe:BUNFK+Z8T8UmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631366764, "uuid": "08beac4a-a469-4e1b-be0d-4adc878c64a1", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631366764, "uuid": "dbda95b4-607e-46fe-914d-3bf4273b307e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366764, "uuid": "7d15e12d-2f78-4a97-8d37-0e9087446c86", "value": "47d17849d8aa2ac874342ca8ad6c8cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237e5982-130b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631369910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369910, "uuid": "0396ce3d-b890-45ec-8c0f-8b504bf11150", "comment": "Malware payload (Mirai)", "value": "ec81aafc2c88801e65cd2c9926d683e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369910, "uuid": "b96e6b94-0fb6-4d66-a762-10a84e3101fd", "comment": "Malware payload (Mirai)", "value": "79faa2230aaf86406fb874bc6ee8783b32b0f573dba13804c4a3c272038f36b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369910, "uuid": "72f2238c-cc3a-4680-af61-93dcef0f9b8e", "comment": "Malware payload (Mirai)", "value": "af3b1adbc03c363b4fbaed0213ba131f6c4ad6a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369910, "uuid": "3f3ce240-50e1-46bd-9d92-6943223aee13", "comment": "Malware payload (Mirai)", "value": "22594712801947c2194b324037db2ed69e65f392ad346e21901686d94c24ab6c71cc2c3eaa28cd6fa1674be7d78ce574", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369910, "uuid": "05ae9d9c-9dcb-408c-99a3-4118fe3be0cd", "value": "T13FC33A53A61C8B83C88749F12DBB3BF18B6AA7B1129720C1A91AEBC05773D751123FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369910, "uuid": "eec4bde5-2c87-4094-8c9f-76b606e585c3", "value": "1536:/5ft0JEnsi9UzvZ0k8LQnmzBPr4F2svFT+MDmaz0VgsXufLkOj:/FKJzd0hQnmzVsp+MDmaz0VgoufLDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631369910, "uuid": "972de63e-eb6a-441f-a2e2-7598186e6444", "value": 119003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631369910, "uuid": "2ddbcd28-d7ae-45be-a74d-cc7ac94fad36", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369910, "uuid": "f8de153f-5ae8-4ccf-a4a5-5ad085b82f2d", "value": "ec81aafc2c88801e65cd2c9926d683e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32455bb-12f7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1631361641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631361641, "uuid": "9599f181-4fd9-4f87-91b9-34a1417297ef", "comment": "Malware payload (ArkeiStealer)", "value": "cdab0a271501c0039121d368fba3d946", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631361641, "uuid": "c00fdbf7-1aa6-40ec-9c89-64738d65770f", "comment": "Malware payload (ArkeiStealer)", "value": "7b8ffb495d71939d9dfb9b4f4b0bd9bd9d3fad675aa487e2b20129c33f877c50", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631361641, "uuid": "a21bc1ac-8cf1-4dde-b8aa-f1f4c3644725", "comment": "Malware payload (ArkeiStealer)", "value": "c6171e833d87a0c3780a3ef7432e914c81da3887", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631361641, "uuid": "186af49c-f3f9-4437-90d2-83e93d670b84", "comment": "Malware payload (ArkeiStealer)", "value": "dcaaa66c94bf01d4fd168413997ea0646bb31328b8835fbea8b5f630b83d41475ff0afc966e9ef50fdf889d262afdbf2", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631361641, "uuid": "7d3f81c1-3f5d-4838-a7b6-d0ed2ba53616", "value": "T102A5011173FC9729EAEE6734E0300A9517F6F84AA17EE78D184599AE1E97F418D003B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631361641, "uuid": "b79809f8-1393-4093-a18c-cf089db06946", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631361641, "uuid": "f892c72e-c252-4068-9523-e57db7032568", "value": "49152:sBgWUB2AkegT2Ec6vSXLUWF68BuHvxYbdS:sWWoEZvSXLUEgpOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631361641, "uuid": "a41b6f9b-c8cb-4f41-bb03-b6d8327ced15", "value": 2077696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631361641, "uuid": "db9872b4-f9c8-4c83-a66b-e3a247b8c302", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631361641, "uuid": "2bb96b6e-579c-4734-adc6-ec4aa2b3f462", "value": "cdab0a271501c0039121d368fba3d946.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21aa1946-12e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1631352727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352727, "uuid": "72e0debd-8eaf-4e25-beb0-d6723c85e42f", "comment": "Malware payload (Gafgyt)", "value": "b478ac0129d403a3f8767a421c78fc49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352727, "uuid": "9128b391-8ef7-4a09-8c12-90d9f7deb906", "comment": "Malware payload (Gafgyt)", "value": "7c76bdbf897fbb43740adc7e76d75377dbadcbca11c01ec528c35c826df88784", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352727, "uuid": "8ac2095d-b99e-4cb0-a4fb-d7457c709ad4", "comment": "Malware payload (Gafgyt)", "value": "ca0ee08c84ae5c291d0f4482530eed1a796f4aa1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352727, "uuid": "ecc300a3-9659-49ba-84ec-b17c3beee66d", "comment": "Malware payload (Gafgyt)", "value": "6483f6a7606416cbaea9bbf2ff9d7984d3ab3f6a82d14d6415cbdb90c210cb724486780f2e78e5a689d4482da79be4c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352727, "uuid": "7b67fdd1-fd4f-49ff-b38e-b5173367b7e2", "value": "T1B1D33A05D8509767C6D227BAF79E428D73236B68A7D733115A28AFB42FC1B9D1E3D020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352727, "uuid": "124d6fe2-168c-4953-819e-59fc6b33a5ee", "value": "3072:4VfyQ+d+pceQGfBbPTa+jthWOiwzte6XQ45hLEDyh3O46dZBjUmydQCYMhEFg:CbPTa+jthoEXL5hLE+3C3gmydQCYMhE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631352727, "uuid": "bda60c7a-6792-442c-a957-0be63054f9a7", "value": 142751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631352727, "uuid": "f760e4f3-2b2c-4f63-80be-11e8bf0a630b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352727, "uuid": "9a31d529-efa2-4ef4-83b1-3461c4e86926", "value": "b478ac0129d403a3f8767a421c78fc49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c789122b-12fc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1631363743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631363743, "uuid": "7c9de443-a7f2-4af4-846d-562e674524b1", "comment": "Malware payload (njrat)", "value": "ce82a80553aa90fc39dc9938a1a38785", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631363743, "uuid": "f92dbf16-be2d-4c84-bed4-0cf6a6c9c142", "comment": "Malware payload (njrat)", "value": "7d2384407431c2ba16975ccc548524ea2feb4fa216452bfda624513eab254734", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631363743, "uuid": "85226de9-a05a-4f51-b960-98ca015ea828", "comment": "Malware payload (njrat)", "value": "0975e73735c72516cdffd11e55a6c44bd003fd97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631363743, "uuid": "d6c872ba-24fd-48b1-938b-dd634d856e24", "comment": "Malware payload (njrat)", "value": "5e492b55f1a2562da8fc952cddbfda3569236526a9067949ffee59ebd75b9d4071ed82e387a3b2e239188fd720b99b25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631363743, "uuid": "e0cb10ba-6edf-4673-ba4f-fd26132d8656", "value": "T133A3935138D630788973B9A7D1EBAA394F77F43A0D0A4A7F30246353CB635136E67928", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631363743, "uuid": "cdeba417-5c89-4c7f-9bfb-2a9769f797d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631363743, "uuid": "0b2e374a-2be8-4b3a-ba40-399b6a52a2e5", "value": "1536:O/Ry61kGMlAsPPrsXBjRxubO1pw7e9A9rlBHu4dkqyZt7Re0yD9YlqqojnG5C8AN:OXgmdK4BMY85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631363743, "uuid": "a2977ffe-7214-41e3-aa37-54ba91238f94", "value": 101376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631363743, "uuid": "c64b92b7-7daa-464c-87a8-ca9c485d7886", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631363743, "uuid": "4a5141ce-175f-443e-82e7-c56ea24ff00b", "value": "CE82A80553AA90FC39DC9938A1A38785.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe62740-12cc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1631343033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631343033, "uuid": "19d74f53-6f5d-40f2-b631-c57c69d8bcc0", "comment": "Malware payload (RedLineStealer)", "value": "2252ddad7c8502bec6cfc48bd01f6945", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631343033, "uuid": "f7ed3de9-2fc8-48ff-b431-80e71d098bf6", "comment": "Malware payload (RedLineStealer)", "value": "7e0eb1f199985371a9fea2cec80bcc0ae2075f0daf0b63ac660b26f53f0411de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631343033, "uuid": "ef02048f-193b-488a-9b91-f8e3e9a6cb32", "comment": "Malware payload (RedLineStealer)", "value": "fbe4d45b7fa4564608b12319c4654cf5f09dc49b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631343033, "uuid": "57c4cbed-9dcc-4f7e-ad5e-fe0ed0e874b6", "comment": "Malware payload (RedLineStealer)", "value": "20ab9ae46e01b02d74ad17cab708aba316307079ba5f0711efb387de3b0cb33c97d5d48dd5c6e9df0666e79a28f111b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631343033, "uuid": "4d0537e9-e762-4580-8641-00cdf37daf13", "value": "T15AC34B6523DC8E39EBFE1E75B070111047F0D18B6502EB5B9DC1BCEB5E36B825A642E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631343033, "uuid": "26fd874e-de9c-4c16-969e-949e5375014c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631343033, "uuid": "13f42438-c51c-4bde-b967-58fc49ccfdf0", "value": "1536:He1CDb1h3FstASKV1nx3W/jbuRGdDnhuyq/dNVfdbknEbG6qTaoigGd5B:++lX1nx3W3vDnYyOdNLkEe2d5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631343033, "uuid": "14bf72ce-6f33-4ef8-b6f4-6e4c851b1f4c", "value": 122240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631343033, "uuid": "d8c95067-84ef-4da4-9498-75341ad39360", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631343033, "uuid": "6cea3b9a-75ae-408f-807b-d96d1e578419", "value": "2252ddad7c8502bec6cfc48bd01f6945", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa688bd-134e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631398921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398921, "uuid": "63a96689-2c7f-4f4a-a499-3e0ff3436e15", "comment": "Malware payload", "value": "84f36c008abb93333b4f97354a287b7d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398921, "uuid": "999318c2-6bc1-4d75-affc-9ef66f7dc212", "comment": "Malware payload", "value": "7f234f2e67e9c72d5781cbebeefe2152d5cbceee16f1d65a91758e03b6818e24", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398921, "uuid": "a1b322d2-1fa1-47cc-ad29-acd64b27e1a8", "comment": "Malware payload", "value": "c8f432dc228d588e0b4dfede12ee502dc206335e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398921, "uuid": "d4bbfa7f-fed8-4801-bfab-d26bcb0a002d", "comment": "Malware payload", "value": "8f479614967cabc409daba277d6011361a1d95c398084a8b8cdf1ff074368871d360c816fa834ff5e7105cef76b29b65", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631398921, "uuid": "0581f7af-ff28-4cac-a23f-d21c9927b1a7", "value": "T11C731992B741DB73D10310F212A6DF260432FFFB2895E95AE3A07DB599361C19622F6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631398921, "uuid": "ffeaa73e-4219-44a7-a35b-64b3a7deed62", "value": "1536:LRnhm7tf2aU/38GHADvtk1MF8Laxn6qRH9cmGjaP:LRnhsflU/3RH2k1082xn6gZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631398921, "uuid": "916faec9-3d13-490c-a6ee-0acda4cde6a4", "value": 74104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631398921, "uuid": "3baadc22-034c-4b94-8692-0fc943434146", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631398921, "uuid": "b6ff1f0f-36f9-4d19-8322-6073ccc48367", "value": "I586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b546805b-131f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1631378744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631378744, "uuid": "cbbb9583-014b-4b91-b100-9d2658cf8816", "comment": "Malware payload (njrat)", "value": "027ed8a97dd1dd28cc73c9edf4ec89ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631378744, "uuid": "18fc5c7e-0d3e-4eda-8ff6-b065fb6f5b47", "comment": "Malware payload (njrat)", "value": "81f7a0f726f4001c9e4e7d67ba9ab6c3f45139887dabe78f6e3d04dd2b0557e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631378744, "uuid": "c6a9228b-db66-40d9-b831-b76a40e97b36", "comment": "Malware payload (njrat)", "value": "131efcf3ee4e6f0629027066ab002355c2f20a00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631378744, "uuid": "5c34a8e4-f4a3-4134-b8e3-a290b9624160", "comment": "Malware payload (njrat)", "value": "9bf8bed006f1f3793369488172ba30e74283c44280b103e2db193f68e425bf4299e82930d95b1f2dd7b7e96c85486972", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631378744, "uuid": "c8e52d2e-7804-4f7e-8437-c14ab5f25512", "value": "T159D415E061EB61CDC6ED98F080D6EC419153BEDD2705FDB224FE3ACB225A2C9750069E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631378744, "uuid": "979e9a10-b4f7-4fd0-8e3a-39844992e65f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631378744, "uuid": "e3ec0abf-6a6c-42f5-8e6b-6667d9f61827", "value": "12288:LrYJxSsXRpDKRmnfK3qzCQiVR54BTMOS/1k+/Rz9/hc:Gx/SA2q+Db/y+/RTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631378744, "uuid": "f66819b4-a432-4e24-b372-8d312ccf3890", "value": 650752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631378744, "uuid": "60bfd35a-372d-43eb-ba0b-473b1af4d645", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631378744, "uuid": "abf6acc1-e111-4a0a-b925-e4f14a274fb1", "value": "Invoice #09747583900.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f43fccd3-1343-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631394312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394312, "uuid": "b365e413-946b-4fb5-98e0-f6d1af26725a", "comment": "Malware payload", "value": "b23ffce34b11bbcfa49b01607720654c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394312, "uuid": "29257299-eab4-4048-989d-563e74e90aad", "comment": "Malware payload", "value": "838d45fb11410a9b2cfcc817a7204c8c129c349e8e1dce38279153e6d3d47025", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394312, "uuid": "dfa94711-e5dc-4e1b-bd72-4d504c8d1ca9", "comment": "Malware payload", "value": "aac9e7b72210a71bac06294c9c19559058b78827", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394312, "uuid": "3f5d5a4a-7c42-405a-b9e7-43b8c11e4007", "comment": "Malware payload", "value": "5b799d6930e31410f2db32a21250a7b367e76498f82653ff4503bce0db802118aa56053ab8031733d9ed1dcc50abc4a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394312, "uuid": "dc0b3245-2e37-4360-a31d-11144a985ec5", "value": "T1ACF4F160BBE1C035E5F341F8887BA3B8A92D79725B3450FB52D1AAEE56342E49D30353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394312, "uuid": "06c76f1a-d89a-4974-8b02-25c79d97ee92", "value": "7e41612e1e386255ee88886121b77ed9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394312, "uuid": "45a285c9-f7ed-44d1-a1e3-b1963187b182", "value": "12288:S/DVTzEzoKxTUDCy+Q97GeJ+yyjB6urBwNvVjmW+vPE3wE+evLOeZyF8X:SrVTbnUWWjUuravVjT+vPE3wEbLlZyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631394312, "uuid": "1bc276c7-b771-405d-b64d-9d999a2be6e5", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631394312, "uuid": "65abead2-5efa-44a1-9c1c-5fe4680a72df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394312, "uuid": "597f8f0b-03d5-4750-853b-977cd882a68e", "value": "b23ffce34b11bbcfa49b01607720654c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c6b0abf-1343-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631394003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394003, "uuid": "40d8a974-5a55-4a64-a307-4e112ed79800", "comment": "Malware payload", "value": "9d1b3ba1187b3fccdbb7a7e93d6d201d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394003, "uuid": "a7221567-55a7-488f-9e32-8c9c54d3f1cf", "comment": "Malware payload", "value": "85779a04e443b2b4d9dd9ea298ccc8ef26db3f0806aa030416fe22a9dcd8e637", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394003, "uuid": "de1503d6-62ca-4786-9d37-5ad2a156b6b7", "comment": "Malware payload", "value": "2f3172f44cbd7de3adc60abd638986288c5bf9d7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394003, "uuid": "93325626-f185-444b-84d0-39f358a11d72", "comment": "Malware payload", "value": "7c07e545d56f486b95463f3bd03b1307145e68df2e130d74ec6c245e0bcb46738328fb7e55ff1cacb3e3c8b391eb0092", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394003, "uuid": "cf5e224e-b318-455a-baa9-8c69c05e0eb1", "value": "T15F13F1BE270E14F1D82640BAA3F693A16E300F66F6C7FC409899D6264F905767CDB6D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394003, "uuid": "68354848-687d-4b0a-8482-ab8a83786f1a", "value": "768:oXXP3RfrwASvd/gKAI4pOy00mvArslvtp8JHoJy5A30pGmcJgGlzDpxYsY05iwZQ:Kf3RDlO4KAIiljmvA4lvtoHoJy5ZpGdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631394003, "uuid": "49d19c65-5116-449e-8a47-04800d7310c5", "value": 44100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631394003, "uuid": "2fca0381-d6d3-4e6e-b3ac-1c7b6df40986", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394003, "uuid": "1af08365-b3d6-4db4-9e73-3aa4837494c5", "value": "okamiii.m1ps", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e733ab-1328-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631382607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382607, "uuid": "b0ed76f2-73a1-4803-a3ee-b38e26899706", "comment": "Malware payload (Mirai)", "value": "d45a8638fe224a5c6397ea65816f40ed", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382607, "uuid": "bf5bf1f5-af38-4aed-8855-ddb5f38925ba", "comment": "Malware payload (Mirai)", "value": "85c0eab8e5dad39e66ee7380fab3ad871cb53aa471b568d780107583b3165885", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382607, "uuid": "08f454a2-717d-4faa-b8ef-8d7ef30fd848", "comment": "Malware payload (Mirai)", "value": "44ec3f2bd2622a5c352098f966bd06523bb0685e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382607, "uuid": "d5356ceb-19ae-4d9f-a7e9-a5b32f042d0b", "comment": "Malware payload (Mirai)", "value": "75faf9442e6ddd9d574a7568ab26c72a25ff045e688a59b7e27d19db1f00be5344d88a005761fdca34ed09cb87b6ddf4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382607, "uuid": "755f514f-01b4-4ca8-9a28-c82cc214d8c6", "value": "T16933F865B8C25A2AC2E0237AB9AE958E332073E8D1DF7217CC605B547BCA51F0D63F51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382607, "uuid": "f19c7da9-e38a-40f0-84f2-43d0b75ca71f", "value": "1536:kgZL/oylETHr6v06QznqmhRNeWhKHzkR/J:kgZL/12jRNthIAR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631382607, "uuid": "2198779f-c11f-40bf-bfe8-5eb1b8177e7d", "value": 54884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631382607, "uuid": "d163ea0a-edb4-42c4-859c-092210787069", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382607, "uuid": "ffc0bfe0-f79c-4764-a599-ce5e68938df8", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81237688-132f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631385529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385529, "uuid": "69ba9500-3a4c-46cd-a00e-c7c50e571e24", "comment": "Malware payload (Mirai)", "value": "14f2b1543338bd6b7e4b316bea265bf9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385529, "uuid": "f527ce15-245b-4ff2-b4d8-9ca47b17c39b", "comment": "Malware payload (Mirai)", "value": "86c243aac794f87a90aefff8c40dfeec33e08b3f3c5c083733475013a921ad70", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385529, "uuid": "f259656a-261d-4fbd-8c46-53d04be3fce3", "comment": "Malware payload (Mirai)", "value": "35453d61de1e44af7ad3a35ec135b0055797ddd2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385529, "uuid": "28113596-4465-40c9-b053-8c28b1cb4bdd", "comment": "Malware payload (Mirai)", "value": "eaa77d8aaab1d5717b8906b9dab86ce7727625f58246ec350f30c34d2eb495baa1f8eab05e99607133ecf59f1f7bc01c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631385529, "uuid": "5216725a-87c3-4934-899f-a8ef271f67be", "value": "T19A732941B8D29A56C5E423BAF66E41CE372163E8D2DF7207CD215F1037CA82F0DA7A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631385529, "uuid": "a597f581-97c1-4c5c-ae1e-ed8c80efa94f", "value": "1536:hM7+X/OsgdW2GrlYSGe8IQ6te+W+0QLMJDaPQy3ASNatmiLTJlZ:hM7+XTgdjGrPo6MJDMhQjQiLTJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631385529, "uuid": "31c24b46-5d6c-4931-b4f9-b07d1bbdc074", "value": 78844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631385529, "uuid": "6c7b356c-cfbb-4bf5-ba8f-6be63eb16df5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631385529, "uuid": "af1706b0-7c74-4207-b263-65f18a516d86", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ebd8cd-1303-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1631366771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366771, "uuid": "a77b8a85-19a3-4364-baeb-103fbadee68f", "comment": "Malware payload (Gafgyt)", "value": "9d84b74c2b6919c182791e54462cc9d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366771, "uuid": "472a113c-6c2e-411e-b167-b631acdd9901", "comment": "Malware payload (Gafgyt)", "value": "88f2f0bcb9412b1df4ecaa96f34f2327c3db5f1da3b6e70f23e7443ff5f201f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366771, "uuid": "aecdc69d-1a5e-4b5d-b4c3-1e4441cba155", "comment": "Malware payload (Gafgyt)", "value": "f529161dcd1d2ce2469421fc7814c4bc9a040825", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366771, "uuid": "8063aa73-8a01-4589-a227-9aa7f8c42d62", "comment": "Malware payload (Gafgyt)", "value": "4faf34f327b6587400ad9cb22eb982a414594163ae4de706ccfc11b49c5620f3386fd10bc2f8d3d0c4d23f372915c6a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366771, "uuid": "a485f355-6b21-42d2-a056-d94ad2921e11", "value": "T1D3733A02E652CAB3C8930BB602AB9B664631FD2A1E2B9F55F31C7DF49F124C87117355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366771, "uuid": "163efc01-11b2-43bc-b081-e6356d4f0b45", "value": "1536:nm+c5osQWiKLoxKFn6pD+OTxzMeMmLI2VOCjXUfJRk:45omr0xKFn6J+O1MmU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631366771, "uuid": "554ae434-9378-4b31-84a3-8f88af3f8e38", "value": 74024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631366771, "uuid": "98fac2a2-9fa8-4198-8d23-49432378b226", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366771, "uuid": "b9c3b4e0-bade-4003-a098-13b2b1d4ee4d", "value": "9d84b74c2b6919c182791e54462cc9d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0482325-134e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631398922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398922, "uuid": "6c2c1cc9-cd4c-4a93-ab27-a667449611da", "comment": "Malware payload", "value": "ddb80b86cb0fe0068b19325a3f18ebe7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398922, "uuid": "03e025d9-6240-400f-8758-403cdad98f54", "comment": "Malware payload", "value": "8920fc65cd4d15eeed916396144449b5e0fb51957dca709b872bdb517e867e1c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398922, "uuid": "3a47f6a3-4351-403b-a861-0aba5022a2e3", "comment": "Malware payload", "value": "80d8d351a5d01f1e9de48c08473416494e60ff76", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398922, "uuid": "3300938e-7449-45a5-89e5-122a1d0366f7", "comment": "Malware payload", "value": "9929cdfb677bf5e8a0af0a2360f7144a875920a7e986bfb5a5078c9c5f2e2a47d1b07a3f6b55442cdfe064a1945b9b7c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631398922, "uuid": "6fcc3296-4958-4caf-b04c-9234a10010e7", "value": "T1A6C3533E7E22AFBFE678823107F66E70C75529D236A19240E16CF7184E7128D185FB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631398922, "uuid": "ac5975c9-5831-4610-8d4b-83e7eed7b3ad", "value": "1536:JXjrPNw4OT3+rfYSg7sio2rKahi+kuRcK6NhWHsr63jaJ4mxwx4hq5qbAzKe6lzE:5zjMj3jOxwx4eqbAzCeQ/xC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631398922, "uuid": "accb6162-c989-4a71-b62a-535a70e2040d", "value": 128864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631398922, "uuid": "65d9116d-f6a4-4cf2-a00f-a556a427f17a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631398922, "uuid": "43195f99-56ba-415d-a267-152b4aca9e76", "value": "MIPS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffedfbbc-1344-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631394761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394761, "uuid": "bd5187e4-8178-460e-a156-c83fb9eb8f08", "comment": "Malware payload", "value": "0aef2e930d75644971293b419521997a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394761, "uuid": "b5dce6c5-8b48-4652-9767-ba9b7a2a3640", "comment": "Malware payload", "value": "897f62b228d85313c9553a59c7591e8eb2d43c0abb4dec0c15784bfe00d8faf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394761, "uuid": "6967afd8-4cf2-4654-b40f-c084d7759e64", "comment": "Malware payload", "value": "a680e18ac2f9a0c795fd406942c4b4081940530c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394761, "uuid": "03febe78-f279-4b33-87a2-5542c402a198", "comment": "Malware payload", "value": "30b4e66ed5efc2ac68bef2486e85dfc3e3c655cff2da96e4e8f4883e02fd8e443e21e65f8227a8f60a9a89e877e9808b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394761, "uuid": "50bbf29b-d9db-4f84-914a-41de4326d626", "value": "T1BAD37032EC134822DF8F393DEC9F0BDB2A9C81942615F7465055665C5A3CEBAC8F9E12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394761, "uuid": "7a0a5320-a788-4568-beca-d99b81e46cc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394761, "uuid": "02ffa5de-ff16-457c-a10d-b612c848c990", "value": "1536:4O6SFQ2gQF6V0YkaQykBIqAMuK5FZs3YSh:r6P2/F6o1Ffuoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631394761, "uuid": "8e0e79a6-5a7b-4497-bfeb-9dcc6bc10630", "value": 136704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631394761, "uuid": "86d622d6-2d08-4976-bcfc-1742d06f913d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394761, "uuid": "07b73854-0fac-4f0b-b3d8-8162ff935f9b", "value": "SecuriteInfo.com.Win32.PWSX-genTrj.14465.12544", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7116f333-130a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631369610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369610, "uuid": "ff5566e2-4d47-46fa-aaa1-f043f9ba9a45", "comment": "Malware payload (Mirai)", "value": "78e15c9386c45cc3acc067ca513e9d86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369610, "uuid": "08da74fc-f917-4c4d-a943-3be3fd149522", "comment": "Malware payload (Mirai)", "value": "8a9722726800bcca3b02ae807580d9e24fab76fab7f870037e6a2536e3d3edf1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369610, "uuid": "90955309-dca4-4d41-b6a0-a0eb1ddc781a", "comment": "Malware payload (Mirai)", "value": "bbc8da23c3727387dc7a554fc46435b79461a148", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369610, "uuid": "e4124a32-3d51-4edd-8c2f-3be1984896be", "comment": "Malware payload (Mirai)", "value": "1a8cf71bbcead479df20fc7e6e9285c8170664653ecb0d43350d7816e45ed4e4cdfc977a54d6d8d8918031ee461c6302", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369610, "uuid": "91163145-ee66-406b-85bc-3224ab22e1c8", "value": "T17FD32A01F841476BC3D327BAA34E438D7B3657A557DB33116A38ADF02BC1B992E395A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369610, "uuid": "73c8d520-31b4-4fc2-9ca2-499e9662df41", "value": "3072:rg3Yn+CInCAVaTrLUTCm/vDGgmqDQQj2R8X9yj:rPsnCmMrLUTpmqDQQj2R8X9yj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631369610, "uuid": "eddd9d07-8eaf-4a11-ae9a-d406a61a5ef8", "value": 132631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631369610, "uuid": "1ab2fa70-7fda-4c31-80a9-9cadea76976e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369610, "uuid": "6e7d648d-dce9-4c56-9b1c-2e4e0d6cd105", "value": "78e15c9386c45cc3acc067ca513e9d86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c5ebb0d-1309-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631369039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369039, "uuid": "87e87bb3-ba21-4ce6-90d4-a3f2aa531288", "comment": "Malware payload (Mirai)", "value": "8f189e04edc27949ce50360281039fde", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369039, "uuid": "2493b0ae-2ef4-40e4-9a03-8ce43a613720", "comment": "Malware payload (Mirai)", "value": "8abd98e70f8f07c391d8d54587fe088aada94a5544bde1c4313671e1222c8110", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369039, "uuid": "adcac838-b9ea-4a82-81ca-6e5b9c86b9a1", "comment": "Malware payload (Mirai)", "value": "e1e4ea480acdf4cd56adacb0067ecc9d3b4811bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369039, "uuid": "5d47b680-65b0-4dcc-8bfa-62999431cbe1", "comment": "Malware payload (Mirai)", "value": "411ce29754866884525a30d505f60908d14062002093cd29b5fca0d47bf53c38eedeb09ca70437c54616923cc110427f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369039, "uuid": "50a54380-bf5f-4a03-93f1-1367d0d7a198", "value": "T18FC33B23B761C5BAC08356B026DF96F1D863F5BE0763312F73946D642B14CC61E9AB82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369039, "uuid": "14bd076a-7329-4109-a87c-3a18f96f0330", "value": "3072:jQMFJmIe1Q9zupVg7nN5M8lAZHyE1mnQVZAxAZQHj:f59zaG7n0Bf1mnQVZAxAZQHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631369039, "uuid": "cde7227d-2e23-40a5-8965-207949d0362c", "value": 118915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631369039, "uuid": "d1cd01e2-54cc-4bc7-b4dd-6547a5ef69b5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369039, "uuid": "ff0a7de7-50d3-4671-b483-5cc4a0e1011c", "value": "[x86]", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0ea672-1318-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1631375694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631375694, "uuid": "c2483084-6a64-45b3-9429-0d79f133a791", "comment": "Malware payload (Formbook)", "value": "bfdd0051da9ab1d475b8624f861881d3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631375694, "uuid": "9fbbc325-3857-4ca4-a99a-15c3e824ac49", "comment": "Malware payload (Formbook)", "value": "8b516901a17ec32794de8c3577cba8cdcc9e85577a5d2e8a244cd202b5b01cc7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631375694, "uuid": "dd1c852e-194c-4688-a207-6c7f40df87bf", "comment": "Malware payload (Formbook)", "value": "3ab15ef44de0c235ab06d1811eadd4bd43fcd08c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631375694, "uuid": "b10be1f7-138a-4b4f-90df-2e8d0cfa7c24", "comment": "Malware payload (Formbook)", "value": "10c408811a447c9ab4f46b10e71cd2b80fe2f1d4bc64b4f3a2de130c06b75e403764fdea4c2253e729b7eaf097daf6bc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631375694, "uuid": "cc629e88-28e8-4c30-aac6-c11cfa80443a", "value": "T12884234D319C6C88E0797D41EABB8C838531B1DE5AB89957FAF1CEF6B409E11D838360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631375694, "uuid": "dea14ce4-69b1-47cb-a05e-c97cab613943", "value": "6144:aOTh+83BBwzUfJmko2ufIXKtgCPy/7f46xKGvEKdanHm6ZPGkleXBR2DrXKa1AeB:hh++waJW2uEKDPyDf46sKdUv9GkleXzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631375694, "uuid": "2a918ed0-41f3-43a3-b487-1008f2ee4d4e", "value": 375022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631375694, "uuid": "bea5c45f-dcd4-4585-84aa-961b3b933556", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631375694, "uuid": "c9663c57-c75d-4459-9e32-57a4f80809f7", "value": "Yeni Satin Alma Siparisi ektedir.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db48c70-132f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631385523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385523, "uuid": "8e86fded-7deb-4fa4-9e39-320b305ec044", "comment": "Malware payload (Mirai)", "value": "bb0322fdc6ebb75f7e3877d8ec50173f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385523, "uuid": "98a5127a-07a2-4566-b042-57f31652159b", "comment": "Malware payload (Mirai)", "value": "8c64137cbba2291cbc352ce78112609b02743c685a919ed167c0b5d9266e770e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385523, "uuid": "f987d387-3124-49a1-a86c-eac0e2646ee0", "comment": "Malware payload (Mirai)", "value": "a8469d70cce4c1abe953c0196b53bcb6a8b13def", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385523, "uuid": "d3622f54-478b-4d1e-b46e-18f19a14b7d2", "comment": "Malware payload (Mirai)", "value": "68a2c160a4e96326d08d2e106ef352c840f4df2aa00937a425b096fd03c7cfb51430391af53695257b577b4b2bbc7fca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631385523, "uuid": "1fb1dbfa-d96b-4c7e-9809-34535d0bc5fc", "value": "T168830945F8818A55C5D813BABA2E118E331267E8E3DFB2239D111F2077CA92F0E77D56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631385523, "uuid": "c5ce49ba-1429-46c0-86cd-ac1b0729b6b0", "value": "1536:qtnbLcWye7uL4uC/Q1JTs8CrFOyMlaB+GLoiX7Z9+FtnBMmiEIm+zsw:scDyuCelwOUeeTIIm+zs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631385523, "uuid": "e8a0a42f-8042-449a-93b2-4a0cfb2fe99d", "value": 87344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631385523, "uuid": "7d2c4992-a3b3-4038-9c57-0f00ad723809", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631385523, "uuid": "db340d7c-a28f-49f1-8bdd-6e919a1d8281", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239d4265-1313-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DCRat)", "timestamp": 1631373346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631373346, "uuid": "eb1f8259-ab89-48e6-b552-7d018a83cd08", "comment": "Malware payload (DCRat)", "value": "14ed33454f45e78f6d0301bda0a2550c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631373346, "uuid": "793220ee-bbe3-44bf-a33e-992d3aacda0d", "comment": "Malware payload (DCRat)", "value": "8d7228ae5c573a10f0e86fc84ca9c5d6e1894428af1b582fdb54f6caf446bf3c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631373346, "uuid": "06cba715-7326-41b3-8d61-2aa7bf954144", "comment": "Malware payload (DCRat)", "value": "370ca36fde131b18ce7ca807894069352bccd90a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631373346, "uuid": "5724ad33-cd74-4f47-8cb6-f2c12b5e3f2a", "comment": "Malware payload (DCRat)", "value": "6e8ee53bdfd895fe3a4bc2dff467cbd6582de38f33929ae34f63ff6c0d8064df48d48eb80b23983f58755d9b858bf5a7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631373346, "uuid": "bb365d81-f11f-40d2-85fd-b979290b932a", "value": "T193554A023E86DD62C0A91A37C9EF843C87A9ED417B66D71A7E5F3B5D24123A70D0D1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631373346, "uuid": "50e30ad3-9231-4363-ace9-9da46c212f0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631373346, "uuid": "749726f6-04de-4c33-affe-ef8786e2b414", "value": "24576:kIFnRhzW8cnjvUX35DP4crxOSt8Hd6HZOPEp+4:7An41X8HWjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631373346, "uuid": "441134a4-75cf-4cf4-8f42-81fdd9a0ceea", "value": 1345024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631373346, "uuid": "9622d4b4-8038-4b8d-968b-cc73e95271f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631373346, "uuid": "610f55df-5a77-47df-9b01-93b74e300a01", "value": "14ed33454f45e78f6d0301bda0a2550c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe2e5a3c-129a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1631321744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631321744, "uuid": "a9042ee3-b3be-473d-a0cd-48bd21673d48", "comment": "Malware payload (CoinMiner)", "value": "66fb954571c27484485b9d47c79362c3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631321744, "uuid": "92d110c5-a1cf-45ab-b79f-9769b2b3c59c", "comment": "Malware payload (CoinMiner)", "value": "8e28689c6f52134021a94b8b543c955156168028fb6445ca608592df042077ea", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631321744, "uuid": "9ef5085d-522d-422a-b131-d897ef8d463c", "comment": "Malware payload (CoinMiner)", "value": "1d0cc909afc9d15cd23d108841a16a5a95601d27", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631321744, "uuid": "d437965e-6484-45c7-9549-45f96cd3ca74", "comment": "Malware payload (CoinMiner)", "value": "d1392ccd7e29366798bb6224960d3cb653f699cf446e661de8ddf138fbf17f3c67bee16b13d649cd91092d64501be25c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631321744, "uuid": "10a98ce0-c9d3-46f1-b927-d20fb03b35b2", "value": "T17413F108B997556AF0BD47BA06129E0A7124FDC244A577CCFA94424F4C2BF748ED3A3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631321744, "uuid": "bccf43d7-6d6d-4fa0-bb9a-5ade10b9c5d3", "value": "768:CT5BvOJ97ZT+xJfCvvv2v1j8Ul1Wp7Ev59KuG/1nFxzoOJ1:IOdq2vvIZJWREv+uG/V/E4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631321744, "uuid": "cc2bba8d-0a5e-4c8d-8843-c90444b57f38", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631321744, "uuid": "122d7863-5b7c-4525-b9c3-b557b254c7e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631321744, "uuid": "25e923cd-008f-4b2a-9ff9-21242bdd51ce", "value": "66fb954571c27484485b9d47c79362c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d95f75-1310-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1631372137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631372137, "uuid": "aa66cca3-8236-4434-92b3-7c5c04828582", "comment": "Malware payload (njrat)", "value": "d8f6cadd686aef1423100dae9231c47d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631372137, "uuid": "5711c871-5cdd-4a40-991b-f9ee36ad2ee8", "comment": "Malware payload (njrat)", "value": "8e38c9ed504d812b26fa8f6c5217127fdfa945da4ac74ebedbade7287fafd062", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631372137, "uuid": "81b3d75d-af2d-498c-bbc1-f74616ed01d9", "comment": "Malware payload (njrat)", "value": "af46bfe9e441788fff35ca3613a805c23780a9fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631372137, "uuid": "1ac42c1d-c3d6-40f4-b570-80b8dfad9231", "comment": "Malware payload (njrat)", "value": "fd88ae956e7fd9712dc20ae4799895adb1010b273236dae8fcf37bafc84da80fa8ea9c2eb93ac7f37377c06266e754c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631372137, "uuid": "8d34157a-ebfd-434a-bd8e-f54eca063ee0", "value": "T1C985E05A7A93DE45D2A8CB3DE4EF1A100B71AD09FE36D3232E4576AD1B33726294410F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631372137, "uuid": "8ca9b8db-90ff-4c35-85e6-0a2b7bf9ad5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631372137, "uuid": "138650c0-1632-486d-8531-d3c8956ee40e", "value": "49152:Z6yxxxxxxxxxxxxxxxxxxxxxxxxx1xxx7UxxxxxxxxxluRSw:Z6mfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631372137, "uuid": "71e0de8e-3fc0-4557-b123-a4cb441a8873", "value": 1842176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631372137, "uuid": "9cc34508-b86e-4afa-9e89-7191e1111526", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631372137, "uuid": "057c1367-e92a-4525-abd6-b0181ab822e1", "value": "D8F6CADD686AEF1423100DAE9231C47D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d774ae-1337-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631388815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631388815, "uuid": "7bc7372e-a17d-40bc-bc0e-2871e450e383", "comment": "Malware payload (Mirai)", "value": "a4834be0ed903ec87a39e6cc5b582017", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631388815, "uuid": "f5fac475-b099-40d2-959f-5df4fc7b1e27", "comment": "Malware payload (Mirai)", "value": "8ef319e1b57f46c7c9653cd6a1ffa2968df0190a99dacf78facf3ef3252a8bc1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631388815, "uuid": "4e80795d-2bf8-43d7-b1f4-298d3b6b1f3e", "comment": "Malware payload (Mirai)", "value": "46ed3bce67e96ba3266982de6aa21136a1ebbce5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631388815, "uuid": "46f012bd-3a4c-423c-a900-495d3aea5025", "comment": "Malware payload (Mirai)", "value": "de9408469684e712106aae508e5c1f1bc8159ef4d305ca2aea930d73bc2255ea73c098b8208153c79aa29b85f7fbfd63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631388815, "uuid": "924e4935-7fa6-430f-a336-8776d5f51a59", "value": "T1AB736B25B83A2F17C0E0A07A22F78B51B6E127CE2694C65EBE730E4EFF2115059439B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631388815, "uuid": "359f9831-79b8-4350-9076-86341f289692", "value": "1536:ZEEvf/WI/GSMU25DXA8luOXwjRh2csOrtZf4NF/:aEZXMUEGEFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631388815, "uuid": "83c3cb87-74ed-4e8e-93e7-a546e3b7d04b", "value": 76992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631388815, "uuid": "836ca50a-0674-499c-bf45-4e8d36c60103", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631388815, "uuid": "4ab9816e-4ba4-4277-b405-c84d28f70142", "value": "a4834be0ed903ec87a39e6cc5b582017", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbaba71e-1309-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1631369360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369360, "uuid": "70f4ccfe-8908-47d8-88c1-2af423244442", "comment": "Malware payload (RedLineStealer)", "value": "40812e1cb32c3aac85fa09d43a93cae2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369360, "uuid": "11d1670d-0a7e-44b4-acd1-17b968fd2e5b", "comment": "Malware payload (RedLineStealer)", "value": "8f60d1c43808d45f5390c24d4ed8a29f39bc55589c93b4beba8200ddf92707f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369360, "uuid": "a72a1203-9123-4022-bc85-40f032cedcd4", "comment": "Malware payload (RedLineStealer)", "value": "b13b4a69e76dadc3997b6f5fc7668c24866bc47a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369360, "uuid": "02462f6d-a20c-4bbe-b699-972192f63359", "comment": "Malware payload (RedLineStealer)", "value": "72b0df9e07c5fb76a8932d611ef190c6f68f83d62af53e4adb715392a37a1fadedc2c35a1f4cbc46a3da3ef5bd3a32ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369360, "uuid": "c120fb4e-b587-4bbb-b0d5-419cec5eab83", "value": "T109E5BDA962E2C55EE44810B0CD7DD9689C90BD6415A85C7E20AA7D7F7E363D3CC0FA0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369360, "uuid": "97279003-97ff-4fbe-81a3-4acb1924832b", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369360, "uuid": "4061f262-fed0-49d3-9f65-ac2ad445a188", "value": "98304:Oys9hUh96MOK4f1+lCUUwZDXrQYTWis0adjA:c9hUhf4f1OCzwZL0EWiCds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631369360, "uuid": "4b9dfb57-67d3-479b-80ef-03dee7b5fafc", "value": 3252440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631369360, "uuid": "bd7f32d9-fef9-4e4f-8aa4-2fe6dd42a16c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369360, "uuid": "c03e42d2-1cf1-45a7-9578-765c9e738d1a", "value": "40812e1cb32c3aac85fa09d43a93cae2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47329afb-12f9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1631362239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362239, "uuid": "42686454-b926-4445-b23e-4023fd9f4b62", "comment": "Malware payload (AsyncRAT)", "value": "92cf6448ebbbce0d9444fe5df8dd5354", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362239, "uuid": "f4fea787-70f5-4a4e-9ec6-3174902503da", "comment": "Malware payload (AsyncRAT)", "value": "91d0878e527fa7e62ad4b655b4619b7f72946ea07593fb58ebea3ce9f40e1fdc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362239, "uuid": "d6b16615-d77d-4dfc-9d29-14f1ec689e9b", "comment": "Malware payload (AsyncRAT)", "value": "b9c03a09c99b0f66ecb8006bac79a525923432b4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362239, "uuid": "f2713260-6ab6-4d14-a19c-4ff3de200912", "comment": "Malware payload (AsyncRAT)", "value": "5d32f4d0111a92b2f7a1a34304f12ddd868e78786957b32f4844ed7735e43ef88c639212ac24f865f906223c16c81250", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362239, "uuid": "c159b75e-f511-4dbc-a95b-031cf8c3b651", "value": "T1D8E3E14273D0DDA7DA98267048775B732BF5EB5912A6262757487F0EFCA21210B2FB03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362239, "uuid": "61f35a54-e10a-47db-9878-ed470bd96725", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362239, "uuid": "7b1cb851-04ea-4c7c-949f-f99638a2d0ee", "value": "3072:5f1BDZ0kVB67Duw9AMcReqgKJ+BCI/2jL9g6Yu6qE2UuSE77MdZJ72ehcV+09d6/:59X0GLgKk5616qsuSnd372ehcJ6p1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631362239, "uuid": "8100ae38-7cba-48a7-b053-b10cff1a650e", "value": 145465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631362239, "uuid": "8a4265e2-e2a1-4b66-a352-82a935af2f28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362239, "uuid": "1687cbb2-cc45-404b-92dc-6a2d9624e515", "value": "f595ce28545e9b490219e4efaaf017fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce128c2-132c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1631384206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384206, "uuid": "b4273b1f-fb83-4ef2-88d2-a007ba8f67e7", "comment": "Malware payload (RemcosRAT)", "value": "3340c7776156e5395e3f161c683166e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384206, "uuid": "8f4e4e13-0c72-4e82-9a8d-b75e7244d982", "comment": "Malware payload (RemcosRAT)", "value": "921d542ca5162b83db1cb405b200618e22b6274b1e069a9ee66eaa4ced8a6caa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384206, "uuid": "7d672058-34e0-4144-98e7-9a56cc8685de", "comment": "Malware payload (RemcosRAT)", "value": "ee86d5493bb78a20a40826963c3726f3bca72023", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384206, "uuid": "43c12ee1-3b3d-4228-bd72-1fee6f0e7f7c", "comment": "Malware payload (RemcosRAT)", "value": "0db1288689924edbd9ad75cdebf7fedfd8e8b33ae2a44706a97d4c7a2dfde8c5d1144aed5bb6158e0987d228fda4944e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631384206, "uuid": "7562947b-730e-4a71-98f4-6b773d8f0193", "value": "T119155AD5AE5118F5D0362B784CEA3B813C3A7DD13E5ECE844EAA7C1B0B3A355346612B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631384206, "uuid": "77de8425-b40a-4c3a-820c-8219c3e74b90", "value": "a6d91731528782b69b7e09d9c7278463", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631384206, "uuid": "3adcd782-e9d4-4077-9cdb-65747e410a33", "value": "24576:M5Kjv76jPunXEigzMa0qZXOYb8JFjffNzGs3YUOf10G:M5KUPk5v2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631384206, "uuid": "c06009a2-625a-490b-bf69-42f0e98a5a96", "value": 939448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631384206, "uuid": "d177aed8-ef16-481e-8b62-774d862ea2af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631384206, "uuid": "e62b7607-c8a5-46fd-88fc-70d40975af4c", "value": "Doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e22fb8d0-12ee-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631357774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631357774, "uuid": "799ce939-fa86-4a0e-b7fa-891fa601a014", "comment": "Malware payload", "value": "72ab9e734e84c7ddf8af3f61f81935ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631357774, "uuid": "2c500867-a6f6-4296-b044-4a585cecf47c", "comment": "Malware payload", "value": "923df662a81671ad069a748ca3c3294ff599692cf8accedaa8092a1146401bf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631357774, "uuid": "cc8a28a2-3a14-4456-852a-05080529d3b9", "comment": "Malware payload", "value": "2f88a438a8e844e184e4b8e7be2c4c6f56ac2e50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631357774, "uuid": "dc273457-40ae-49ee-b42a-73f1e2f4d047", "comment": "Malware payload", "value": "d74bf1e144c5bc98059cd7ee48efde5917711e9817fbd6c7bac1505b68e673e8e4a786a32c6b6bb76374f5aab25de108", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631357774, "uuid": "efdd9b20-cd5e-4f9f-8ce0-f166f2c6c03e", "value": "T15B546D5BB3B520FBE1768239C4631605E772B83607219B9F17A4465A3F233E19D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631357774, "uuid": "1c0dff4f-c3a7-46e8-9a86-739ef0d9789b", "value": "9b85e691ec322613b000bfcfe4d0337e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631357774, "uuid": "8fde2396-69c5-40e3-b972-0402280e74a3", "value": "6144:i7lddMkQZSN10Mw3ZubAO3DEb5/o8GhO:ixP3N13IXO3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631357774, "uuid": "6cad552c-e33b-493e-80ef-fbda338ea942", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631357774, "uuid": "f4c28d01-2a41-483a-b312-f688c052426c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631357774, "uuid": "e12edfb4-2955-4b61-bcc1-5cc6e4aa185a", "value": "72ab9e734e84c7ddf8af3f61f81935ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51acb16-12c6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1631340492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631340492, "uuid": "f5a95416-d92f-4cb0-9cdb-9b0de844709d", "comment": "Malware payload (AgentTesla)", "value": "584fe1559eb74cd8fffed47e1653a28f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631340492, "uuid": "82464a0c-4471-437f-bfa2-a9796e28ca7d", "comment": "Malware payload (AgentTesla)", "value": "92b9b93c63fc6cb83df5377e0e90c6e25bcf9b9fef75229bfd7bff6e04ff330b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631340492, "uuid": "361f78f8-f614-4c2a-9857-ca9a87b3bbe0", "comment": "Malware payload (AgentTesla)", "value": "9ddffee14ec3d9e5e0aeeb4330091af880749791", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631340492, "uuid": "b1146938-b7ca-44bf-af74-928ec91cc530", "comment": "Malware payload (AgentTesla)", "value": "2c7654276035065b5e03387440fbaa2b5dc889f42e5e58961fe0f5fb9ca7dfc511b98e37c96972cad5d78c746658eba0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631340492, "uuid": "122efef6-0451-4ef7-ad5d-56cacc918635", "value": "T1D6B423A7ED22BCAEC542E3674B532B58DD5C4272B4C620A48971DA77A30DE1BD3FE140", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631340492, "uuid": "5444b9a9-8154-40fc-bb4e-d547417a03d9", "value": "12288:cW2gmX2jFE2dvEHLoZDtiEARRoGPxem1Rb/B:cWtNFE21gLoNtiEU2UxeGTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631340492, "uuid": "990ffdfb-1684-479b-a77a-d5b1c0210934", "value": 522403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631340492, "uuid": "87cef7f2-8a9d-4298-aa47-b699f2a1a824", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631340492, "uuid": "4a4cf94a-db01-4c91-b211-39029fd56459", "value": "Bank swift copy.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5836e293-134b-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631397486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631397486, "uuid": "b5fa56bb-08d9-4086-8724-b0ee58203233", "comment": "Malware payload", "value": "cf7e20125f8eb0d05485557b9cce8b8a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631397486, "uuid": "4042327d-45bf-456b-8eaf-42b4146b363a", "comment": "Malware payload", "value": "94fcddfd8b67596285bf21b3b3f31f7ca9cd52af25929e33ffe9697115b4a21f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631397486, "uuid": "8c784e7e-8786-44a3-a724-5ae760279254", "comment": "Malware payload", "value": "d18a7511ae4f9522bf933ef8c1e411954f9761df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631397486, "uuid": "0b0785a2-6da6-43c6-bb3d-1e6963a05bf6", "comment": "Malware payload", "value": "8b651f27b0e4d21885b493b4f41aa40ecc1b2cce23d67c8775b5f1b7cabff8e1fefd0ea4d467050c768696961f3710fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631397486, "uuid": "21a70af0-9abb-45ad-8a6e-3136a8a44fd5", "value": "T1E403F105E29E1FCAEABF56C408CA11C1F3DD499F1B71DA40E381FD450E1EAEAC5424D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631397486, "uuid": "c013be68-3eae-4c83-abf6-50288d886a0b", "value": "768:UTPgYWK5S/cwdNc81Dc9NB3MMJCRr1z4uVcqgw02TWXXdP:UTPgYWNkwdNJI9NRCRr1z4u+qgw0cWXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631397486, "uuid": "f3a1a141-665e-40f3-b59e-f1886d99cf52", "value": 40504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631397486, "uuid": "1d6c3e0e-d133-4bcf-b0a0-c80439ed70ca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631397486, "uuid": "7c7233f4-f2b1-421c-b815-1cd5bb7a735d", "value": "cf7e20125f8eb0d05485557b9cce8b8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9039d3-1331-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631386246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631386246, "uuid": "fcc3711b-3122-4276-b35c-7f0ac3d962c6", "comment": "Malware payload", "value": "c94495cf042b2415ca1aa23282094982", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631386246, "uuid": "b3995f8b-76eb-48e5-a936-34ded878952c", "comment": "Malware payload", "value": "9532095cf936beca817c76c65d6cfe9a3153e5b8e6337b767207c8b37b39cfa6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631386246, "uuid": "ce536b81-fdaf-4c30-ae20-8980786ce394", "comment": "Malware payload", "value": "2e4c2f400887430de2752200d1d986e3529d5530", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631386246, "uuid": "74b63d1f-65d9-4e2b-83b1-e550a4efd9e7", "comment": "Malware payload", "value": "ce7c861845a6a76ee39c607ff471a35c9bb4b35aa4130ca255ec80ed6623da90e78d22c08c288e51390064ec09c47fd3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631386246, "uuid": "c39abea9-407b-463c-b36e-022c9dccef3f", "value": "T1A2D3A432EC134822CB8F353DEC9F0BCB2A5C81542655F746A055666C5A3CEBEC9F9E12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631386246, "uuid": "b768c0f4-06f8-42ea-b42e-61feb3cf6123", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631386246, "uuid": "0716d909-2648-46b9-a47e-823db5fd6c8f", "value": "768:Nne9iDY+SXsQ7PJYM3SbZKbj+HuR82D0IxEGrIXmLQKvAzW3BZUN+u6vmyMX2qDU:JejF7xh38Kbj+2D0ev6WoNVX1t99fe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631386246, "uuid": "ae090b1b-d2bf-4724-baa3-bfc4bf082be9", "value": 137216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631386246, "uuid": "63ae4b05-1a5b-4cef-aea0-462683a59d91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631386246, "uuid": "eb0e4cb7-0805-49ba-a6b9-388e4f1585f7", "value": "c94495cf042b2415ca1aa23282094982", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1101e104-12d5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1631346686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346686, "uuid": "80f60449-0b77-4b0b-9421-97d44a53430b", "comment": "Malware payload (Vjw0rm)", "value": "9d724d067e3238d3352de71e94367a8e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346686, "uuid": "ec90e12b-e150-4a4a-836f-7f96ab95d463", "comment": "Malware payload (Vjw0rm)", "value": "95a97e608bdcb900439a3ba07ffb942bba4dea464d6141204f0628bca6102460", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346686, "uuid": "b4070a56-4ccd-4152-b70a-93312e71785a", "comment": "Malware payload (Vjw0rm)", "value": "9045f490135900647cb469dc3505021c3ed5f020", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346686, "uuid": "3660a0ab-00be-4452-a4f6-becda8d330a7", "comment": "Malware payload (Vjw0rm)", "value": "722cd899bbc805b13e995a2b92f0548a09e49fc26083162fdb701cd51294237aa545a86f0b901b69f87394d1cf826bb6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346686, "uuid": "c88fc5b0-0654-416c-ae94-c45ad303cad9", "value": "T16CD2078C7C92F4C9DA21E1707A6F6DC817B4630BE45897CE7C1CB3404F666A8C799A6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346686, "uuid": "e8370e0c-19d5-4a9d-90f2-ecfc254498fd", "value": "768:FFddIIdiwUTKyeNsigjzOArjgWgph3oEGa6bj:FxURysiSzOArjgWgpxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631346686, "uuid": "1eac9cbb-56b5-4174-8831-fed07f1df228", "value": 29486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631346686, "uuid": "bf3b332c-0cd7-4092-8ece-412d2ba5b207", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346686, "uuid": "f33aac8d-490d-4894-86da-a3bda633133d", "value": "BTCOPY.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9034ab2-12fe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631364604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631364604, "uuid": "6cf35af6-1b67-4758-a738-70eeccc5b475", "comment": "Malware payload (Mirai)", "value": "1f827aad5016b10d3fe9b47902f26d93", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631364604, "uuid": "e3152180-45a6-48f5-9ab7-6c845d1ab981", "comment": "Malware payload (Mirai)", "value": "95e9c45353d7e492551929999dc7eaa9df34ddca50ebbf38c844b9e4ceecbd80", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631364604, "uuid": "3db6dcf7-70db-4657-b467-e934d82e936e", "comment": "Malware payload (Mirai)", "value": "95d3de3738bd57815a6555704114cfde81497970", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631364604, "uuid": "a84972bd-3572-4d9a-b424-7eef6d7e7691", "comment": "Malware payload (Mirai)", "value": "dacac5ab0bb6fbae91f662f6a0d3a0dec9d6932d2491d65401675b8331ee907def48e9ede73112c8fb2697ab70c974c7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631364604, "uuid": "43dc3c90-5d66-4fe9-b923-6f9c7a744bda", "value": "T17B5329C8E593F8F5DC140978306ABB66AEB3F13F7135E99BC3D82927A841702D10669D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631364604, "uuid": "513cea4d-784d-489a-b51f-04e5a2b93f21", "value": "1536:IcR9170vwHbQXZ5+qXDEuXi9bLSW7p/d6reFt6HuQ4ZV:f917iwHbQXZ5+qXA59HSWF/Qreb6OZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631364604, "uuid": "741ff6fa-fab7-4a6a-bdb2-eacaea873d22", "value": 66136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631364604, "uuid": "fac08a53-65e2-43a9-81ee-446b5b958746", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631364604, "uuid": "b2a00476-c892-4513-819e-25c6cc0fffc3", "value": "loligang.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5f2b7e-12c6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1631340501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631340501, "uuid": "fa829ddd-dbfa-44e8-b6bf-f2ec6f6eaf55", "comment": "Malware payload (AgentTesla)", "value": "57aff61be2d8b9bda54c125511296fe6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631340501, "uuid": "25f0dc85-233f-406d-af15-b25da5608baf", "comment": "Malware payload (AgentTesla)", "value": "993c1ad6ceb2001e2a98f1982a20ceaefe769478d099a2ec887fa7274db609b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631340501, "uuid": "c406fa5d-d533-4f78-92e4-1980413caeae", "comment": "Malware payload (AgentTesla)", "value": "7a194b1bb0ca2f381c1a70219a072553d56af58e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631340501, "uuid": "36d935f4-5d1d-425f-9ff2-e2d8f7de8108", "comment": "Malware payload (AgentTesla)", "value": "ce02a9b8db5914a92828b51549f45a159eaa1c5f09f5028334c58cd6e98194d3455a6848c10f7ca98bb8aa06ac10fab3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631340501, "uuid": "ab315628-7240-408b-b696-c5d0b6681349", "value": "T12CF418243AEF501DF273FFB95EE474C7AA6FB6733606A45E109103860A23A41DE9153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631340501, "uuid": "0072dd3b-c4fb-44d3-baa1-877081a1d874", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631340501, "uuid": "e6c96f1c-1305-4623-a22d-4f7ad244ddde", "value": "12288:IA8RSZyO3+VUPObK1Cnf2VtYLrlz1+e+zQbLwyLTlXsjXzKqY:IXIZVHwlAQfwyLpXkGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631340501, "uuid": "723f40e7-35ea-4d73-8d85-8ef2c5341f40", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631340501, "uuid": "bdc6fdbe-b93c-406b-b342-457fece4c77b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631340501, "uuid": "cf6fb6f3-3402-4cb8-ab1a-6d769e9360e8", "value": "Bank swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8892efd9-12e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DCRat)", "timestamp": 1631352040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352040, "uuid": "d474f123-92f4-4bdf-a630-f5f39ff8439b", "comment": "Malware payload (DCRat)", "value": "b9a42f557b8e8d48bd5b061f8e714af9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352040, "uuid": "7f6f1fb4-5958-4a8a-806d-c1b55fd9ab34", "comment": "Malware payload (DCRat)", "value": "99b234ed5fcab5f1e2ebbc0a26fd5e94a3efa69fadb275065592ea7cba636e16", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352040, "uuid": "08404501-ca17-4d5c-8497-d83976542262", "comment": "Malware payload (DCRat)", "value": "f591e3bb267304fb5261465552f80910306c9ec7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352040, "uuid": "1c6821f1-058b-4749-874a-0d99c6919b08", "comment": "Malware payload (DCRat)", "value": "b450c3d68a835e02cf383e4ecb7144234a52ff6e0105888c288054fd4263e9c77f5d2be5b883408c61e25c6382a9db95", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352040, "uuid": "dd40c624-e88c-48ce-8028-269b4bca3077", "value": "T143459E0733A6C0E8DFA790F2C6255223D772781517389BDB24E0692DDFA3EA15B3A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352040, "uuid": "4f0fa7a3-6f30-4db4-8961-7dce61b46be3", "value": "2004a5f6f543f8c26e144c1ceb66f943", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352040, "uuid": "7d599afc-caa9-4906-87c1-1d712550f444", "value": "24576:ZD7Xr5my0DPP23Iy5YAmRW6B8If0s83I4eqowSwa1X9tqY7JxiqSCj:ZD7Xroy0DPP23Iy5YAmw6B8If0F3IwoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631352040, "uuid": "a0ce8921-d04d-4d0d-8575-1170790e39ca", "value": 1229728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631352040, "uuid": "aa149871-d561-4156-8b4c-8dd3bc5cf6b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352040, "uuid": "ec65fb23-e877-4423-8e9b-544c45f83cff", "value": "b9a42f557b8e8d48bd5b061f8e714af9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8fbe974-12e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631352981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352981, "uuid": "9c4a9be2-93f9-4b16-bc07-876c7948c38b", "comment": "Malware payload (Mirai)", "value": "995f2506d18ecd57141ddc9da2f27ec9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352981, "uuid": "a5363d15-8a17-400c-a3f0-a9e39806af0a", "comment": "Malware payload (Mirai)", "value": "99d6c16701d26334bd4df817c8c285b7419305f7d70cf72fe509628637535019", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352981, "uuid": "fe0bfc4d-d871-4ce7-af96-62983f54b725", "comment": "Malware payload (Mirai)", "value": "91ef18576e91bab58127152c6ad11a83a9e0cced", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352981, "uuid": "b0a51cac-a41c-4c95-a943-dc56a09bc07b", "comment": "Malware payload (Mirai)", "value": "48849f29661b193d69fdd01e480686269f11acf0e6fbee3e6cb33756f1a7f2953cb3e0f8ee97fb43559d5b26d6af8d0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352981, "uuid": "d2a2687c-89f0-4c71-b62e-6150518c7828", "value": "T167A35B82D642C2F3C4430AF1029F965A0532FB3A8E3B9EAAF75D7CF49B129D53115B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352981, "uuid": "5e2a8582-cc7f-4b7f-926f-61ff23a3cd87", "value": "3072:aPaqjPQP39VjGWX98732V7kGyNV05heTe7FXnf0OzTyoQQub:ahQP39VjGWXW9NV05h+0FXnf0OzTyoQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631352981, "uuid": "b59ce30e-8033-4924-96fe-c998fc4a471e", "value": 99709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631352981, "uuid": "03f40e46-4ff0-4691-976b-09944f47267f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352981, "uuid": "5e69714a-17f6-4630-add1-af24dab82846", "value": "995f2506d18ecd57141ddc9da2f27ec9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832ea260-1305-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1631367493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631367493, "uuid": "717ba1f1-4590-4fe6-aeaf-0ac60a491fc2", "comment": "Malware payload (Gafgyt)", "value": "9459d888fb151f491e92811786e32e3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631367493, "uuid": "0a640442-510a-436e-bc76-88b7f24050c5", "comment": "Malware payload (Gafgyt)", "value": "9ab929ac75e5c3627fd537aeb34d137b246129e5fad1158d845e4021ce6bb3e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631367493, "uuid": "43938cce-ce64-4c34-bf1f-84a81b607c99", "comment": "Malware payload (Gafgyt)", "value": "3240daf7e0941ae3874409a3881d14a1ee2759a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631367493, "uuid": "d7a53bfb-07b9-4ba1-95aa-97115223a516", "comment": "Malware payload (Gafgyt)", "value": "901decf87db6455c75172d67c4751697c11b6ce03f97a8c987e98bee83c2e79b3bb972fd0fdef28b2e4b7053bdf55dc1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631367493, "uuid": "65a069c7-5d31-4ffb-a9af-a11d0c9c48dd", "value": "T118934C17A242C67BC08752F42BDF9A619423B4BD0B32720B73E47DA53F629D92D5DB02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631367493, "uuid": "88c2656b-1ea0-4556-9e54-50bad0ecdb4d", "value": "1536:ju1g728ge8Kxyhf/iv6EIuMd766oumm2Tp6m3LPo8Vus+mZ7rVOXiPw9ZFta:q1gGe8Kxyhf/iv6IMd7di5T4qzocu1ml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631367493, "uuid": "94b919fa-c265-403e-8d8a-d61d4de4b74b", "value": 96859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631367493, "uuid": "a41175a3-78e5-4e9a-88f1-6cd0ad2e28d0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631367493, "uuid": "0c5c262d-d022-4aa4-8582-2b3ef8ea3d8c", "value": "orbitclient.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd047da5-12e7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1631354705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631354705, "uuid": "4ba5e403-eb5e-4fc3-b54c-f21393ae0eca", "comment": "Malware payload (RedLineStealer)", "value": "c2b9e47363da604d50931d211e799825", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631354705, "uuid": "ab0cad74-b869-4f2a-80b4-d419989530ac", "comment": "Malware payload (RedLineStealer)", "value": "9ac14181ba1a45b0f7034177b5887cd2992dcd9222eb7682b553bb587e04513b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631354705, "uuid": "8aea3a6d-c18e-4b5b-a359-8227b59c3e36", "comment": "Malware payload (RedLineStealer)", "value": "34cc96b1107a9d94fe629432e9893be36bf836fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631354705, "uuid": "47488e11-8a77-4ed4-926c-10d4ff8a7e91", "comment": "Malware payload (RedLineStealer)", "value": "fe7f4fdf3c7ca5c880108d555da897bada5ad7b96285a1ff2a3e7792670e009356dfed27166f6f427dc4a6e1aa65b3a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631354705, "uuid": "8407bdec-641e-4404-8520-e8894e4dc2a8", "value": "T130F1A72163D88377C7B60B3258F293438639E6169C67DFAD6845031B9A723840BA1F6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631354705, "uuid": "d9f6d93d-71e1-42cc-903f-6ebfac5adc5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631354705, "uuid": "dcf8de3d-6410-48bf-b0d3-cb7ac7649666", "value": "96:LEAxNfkFLlpRX3brhzRj7hizsPUMcQlgS0FX6H3yCJ8l/PpSpVWPcYCAzNt:LTG57ZDiz4UMBSBFi8l/xQ47CC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631354705, "uuid": "335f7bfc-4592-4e6d-9c94-c7387f3f6fbe", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631354705, "uuid": "05324f1a-b5f6-470c-8d49-e11f251984c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631354705, "uuid": "aca9f5ca-d2e6-4c4a-b63e-0846398873d1", "value": "C2B9E47363DA604D50931D211E799825.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc973e1e-12c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1631341444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341444, "uuid": "317a281c-a732-4986-8108-b38bf6178293", "comment": "Malware payload (AgentTesla)", "value": "af842c62519823f23b986038d9b982e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341444, "uuid": "63f70857-7c65-4ffc-865b-162baf4be6f8", "comment": "Malware payload (AgentTesla)", "value": "9b8b235ca82057f582308c718582d2e7d7cfe833223e0eb3edc9f4bb66c3e937", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341444, "uuid": "bf2c11c2-96b1-448e-ac08-3d8b242394b7", "comment": "Malware payload (AgentTesla)", "value": "4b955306588e065924f6dfe7d785d8585eee3533", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341444, "uuid": "dcd77c0e-6534-406e-9c89-bbe9650f5d6a", "comment": "Malware payload (AgentTesla)", "value": "998e0cacab3e271f59c67dfacb8688cea6723cf4bcb71229d8161c8080609ea597e46832e79d0132a4a094656182d203", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631341444, "uuid": "f4e83226-51e6-4d67-b128-e8371c0c1857", "value": "T163B423AED311F537A0B9F7026359C9422C7970C8F9D426FC84A68D2189EE6CD6CE2747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631341444, "uuid": "95105f6e-29c8-4797-988f-cec7a114e3ca", "value": "12288:lZkJ1LoIDFC2Jek2mZYW+7p2Sl3XBzWSjsAtbC4le5H/pLMba+NT:bMQJZW+7pr7PsxhLgJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631341444, "uuid": "0ec24a0a-0982-48ae-87c5-db63bd463412", "value": 542275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631341444, "uuid": "dde51dad-8ff4-40f6-a758-bcefaab2dff1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631341444, "uuid": "365a3557-ef7b-4a7e-ad9d-7094a8bcd2d8", "value": "RFQ-PCI565_RevA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7c5bcd-12ec-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1631356642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631356642, "uuid": "b6cdc85c-2b50-45c3-b38f-d6dceb5811c1", "comment": "Malware payload (RedLineStealer)", "value": "e7f1d6295c544b22d81541c7b379f035", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631356642, "uuid": "21965575-eb75-47be-b0aa-dc8eeb226788", "comment": "Malware payload (RedLineStealer)", "value": "9ce97b2a248555831866151f6c4d9c682dc792f6df3e3e8f8142bdc717f34876", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631356642, "uuid": "be78e8b5-ef4d-4490-997d-47be28b06594", "comment": "Malware payload (RedLineStealer)", "value": "16971717727904a72a5e28aaa2880f742d0da251", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631356642, "uuid": "5ed60c17-344e-42da-9283-b49ec099cc9a", "comment": "Malware payload (RedLineStealer)", "value": "7b7eef3bb5fc23cabb503b0eddaf65b81d7b65b8bfa3885f9599f0e5a1366c90a21f93644f282d5ca0ea338d99808293", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631356642, "uuid": "b8872caf-8f22-47c5-a33a-fd948d4169b8", "value": "T1DAB512D831D8BD8FF3875970E24309167108EE53D73B8260385EF7D2AEB60B9960695E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631356642, "uuid": "018a4200-decd-40de-8a64-7aa604a0a7a7", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631356642, "uuid": "b561986e-debc-4ed9-9d15-ca29323362e6", "value": "49152:65qB8JgC/rarwYAkZXXV827q4dm3EdSPxy7TNhdxCzVlQM5JEkPHbx2ewUStI:uqKWor0fXlV7xdm3EEPqZh763F5lfV2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631356642, "uuid": "94cf6451-6333-4df4-b640-48ad2ba3aaa2", "value": 2447360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631356642, "uuid": "3e05a5b2-8977-4e1e-b516-fc550939b24b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631356642, "uuid": "2f5e590f-e6db-4099-85a6-7f713b6fac52", "value": "RedFlame.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f63a08-12e4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1631353427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631353427, "uuid": "80d3a837-40e1-4ab9-b51f-eb5bfc51c05a", "comment": "Malware payload (AveMariaRAT)", "value": "9dd3314e46c696e99b607b6d36a94e41", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631353427, "uuid": "e5ed4e32-064f-4794-9760-fd6834dd242e", "comment": "Malware payload (AveMariaRAT)", "value": "9d1f73dc28e7c2ae89a87fb4178a025f06466530de42f2de2015538f06866f60", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631353427, "uuid": "476be7d0-7ca0-47f9-9b96-cdd3133f52f0", "comment": "Malware payload (AveMariaRAT)", "value": "625b4f7bc54d2c1ebc95adb9ced8e0e055f597df", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631353427, "uuid": "fab76e48-c957-41ae-ada7-b4467be7c0ef", "comment": "Malware payload (AveMariaRAT)", "value": "e40bbae47fdee9106d1c08e03e433dba95fa40328f92ce9698725e06ea9e41ae66b3b9f2675c31aed2d4a215aff1e279", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631353427, "uuid": "c6488fdb-8fcf-418d-9503-413a350e03e0", "value": "T1C7059D0077FC8F29E5EF2B39E0745A0497F9F817A6BAD79E1804E5AA1C9374089113B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631353427, "uuid": "b86874d8-4840-40da-9dd3-7b477d113db0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631353427, "uuid": "74c0771d-7d88-4031-8002-4db97d835d97", "value": "24576:vLhLpXk+b6umJBDAJeqtgpwhLJ/T0HurldF:vLhLfqBDAfgp+TN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631353427, "uuid": "dcf13595-1f8e-4d35-ba76-8b878224885d", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631353427, "uuid": "12763b16-c1b2-4047-8ed3-63e145eeeda6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631353427, "uuid": "ca5f650f-67d9-43f3-a603-86428f84233d", "value": "9dd3314e46c696e99b607b6d36a94e41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a69a1cc7-12b9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631334911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631334911, "uuid": "fa8c1419-61bd-4b2a-92c7-f7d0ca7de1ed", "comment": "Malware payload", "value": "0aece6d0822f2091e597dfab9a30e187", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631334911, "uuid": "e8fc07c2-6b26-4e0b-8f72-aec4b2f3a78d", "comment": "Malware payload", "value": "9d7735a55f4e9d87ab2aa9f8d1bc099c45fe3502dab110a76f09023e8d9262be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631334911, "uuid": "53f1d4f1-f09e-4e9c-ac4d-03d811612ca5", "comment": "Malware payload", "value": "d7128a29cdfda2b77687154d94eb99754c35af9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631334911, "uuid": "97ef47c7-d805-430d-a7c0-336656be5c31", "comment": "Malware payload", "value": "a7eb6e8bd102562e0d4040b43185195b5c49cbf4b3209f0b516d04c20eea2e4854047aeb5b55190b94b01307f480b95a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631334911, "uuid": "e6b77abb-2c18-4940-9d81-d078c67072d0", "value": "T1FD03E1495F11EF52DB0009B32D5CA56CC9BBB79A0B3B34A198E5AD4FC36609B5C9F340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631334911, "uuid": "8d311e79-caa0-4438-a2c7-9e986532d51d", "value": "768:pwkyTc9pHiGJ7bLxlpuYPW55oXnOsUkAtkgP1NjSfLL5UZmM:pxpJNlEYvXndUt/afLuZmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631334911, "uuid": "7aecdaf9-2d58-48f4-a0a0-4515ad406fe0", "value": 40320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631334911, "uuid": "43819ed4-1356-45d3-944b-440785ebf3a1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631334911, "uuid": "903b2353-4e54-4057-a601-70b25a18fb2f", "value": "SecuriteInfo.com.Linux.Siggen.4057.9199.10450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a27d16-12cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1631344243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631344243, "uuid": "641a0f6b-554e-4684-b6ad-1ec1f6736cdd", "comment": "Malware payload (CoinMiner)", "value": "b22a09df16d6b60a9a35a132aacfa7bb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631344243, "uuid": "ba8f7bc4-d6a9-4a39-a66b-75ef2d8512a0", "comment": "Malware payload (CoinMiner)", "value": "9e5261496e29772d832ce9eb4c8d0fea051a1b586c0a008529dfabb5ee5dc43a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631344243, "uuid": "7b4cb17e-afcd-4b3c-a7bc-29407b438084", "comment": "Malware payload (CoinMiner)", "value": "0c15d3f00436b8f37c8c81d5ace28a45fcd1e9b3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631344243, "uuid": "ec353541-0897-4060-afc6-4cfadd746d85", "comment": "Malware payload (CoinMiner)", "value": "729f10c7cc192dbf9495ac932db964f5207d5366956ee2fc28426b95cdd771f0acdfa790dfc314cdc72d8baebbcf00c6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631344243, "uuid": "88883e15-d50a-4ade-a147-6bbe291d4172", "value": "T189348D20B6A0C035F4B712F559B683B9A93DBDB1AB2441CB62D43BEE56346E4DC30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631344243, "uuid": "99b1e09b-22c3-44b0-a9d2-290ee1005bc6", "value": "a2b61ec335a437915fc26e9e5178da86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631344243, "uuid": "dcb91d81-1347-4335-8e05-85b98dd258fd", "value": "3072:IA6x/E7FVhYvVL27g7z8NDNYaVgoFbZF7IxScqptzXtmoicC4z0q4vis7ueoKqlw:IAX7FVuVLHX8NDOaZBtAvjU0qb0oI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631344243, "uuid": "c624e23c-8520-4bd0-b786-5345b4cda453", "value": 252416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631344243, "uuid": "ba6e5667-099e-48a1-862f-aa0f4a975c42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631344243, "uuid": "011e6f37-b408-42ff-b582-4ea548ec52a7", "value": "B22A09DF16D6B60A9A35A132AACFA7BB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef760108-12c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1631341476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341476, "uuid": "79087e13-ab40-4f4b-a0a5-ec8edcfade3e", "comment": "Malware payload (AgentTesla)", "value": "cbc8bb31a5467df03f1e444a4eb3e289", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341476, "uuid": "d2a7c2a6-9295-4f6a-885e-9a3fcb220327", "comment": "Malware payload (AgentTesla)", "value": "9f21069987d66d080ae5a97a3881bf868466036aa67f951a7e6c341463e6cacb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341476, "uuid": "36411117-bd93-49f4-a176-edff01c8276f", "comment": "Malware payload (AgentTesla)", "value": "f1fe782abccf2209a0a08013266c99a829ed9204", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631341476, "uuid": "a8b869b2-9916-46b5-907e-4fce2e34c695", "comment": "Malware payload (AgentTesla)", "value": "261bd9f3eb3667a572477345ecb01286c4d7a64d55ff94e38df302a23282a2d45f1be2344cf7268217ee72fac3da1b7f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631341476, "uuid": "20ce0d5c-9cc5-45c4-b17f-d30c6718b31d", "value": "T178A423E291560EB38D020A034E66BDB47C4DDADEFBB4559C12021C9A8F9EF1117DEB39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631341476, "uuid": "0ef7da84-251f-4249-9e40-be1a13334983", "value": "6144:pJmnF4Z7PUqSlWv2MeZsId4/JVJppHVrPUisHEcNBXiufs+jYa7V1Us3Vpy/dZfU:pciduQeZs59ppHVbCB/fhj91JboD01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631341476, "uuid": "cf4e43b2-6bb5-4356-b75e-9283d5562639", "value": 468759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631341476, "uuid": "189b3b40-a299-4768-95b0-a239d693516f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631341476, "uuid": "8c835f95-1544-4da6-97c2-f8dbfbff6c39", "value": "New_Order_PO#960780_MT_Quote-MT-RFQ.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a28b37-1310-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1631372162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631372162, "uuid": "8fade8de-529f-4d6b-aa14-6095b8ef8a37", "comment": "Malware payload (Gafgyt)", "value": "418b644cf92e799a0c9c7add3bc288a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631372162, "uuid": "b6a4cac8-96cf-4894-afe9-40bb8472ffb8", "comment": "Malware payload (Gafgyt)", "value": "a08fc44762c6a596c89a93c6ae610045d83916a94307f74a8b6e14da5f2bac14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631372162, "uuid": "716ed457-18b7-4fc0-bc14-4feaee5da886", "comment": "Malware payload (Gafgyt)", "value": "182f503403868ede065f9327def371de88653482", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631372162, "uuid": "08d447b1-b07f-4019-b982-6e1ff85748ad", "comment": "Malware payload (Gafgyt)", "value": "a5d3b294de91f7852f7647000057992ef0f3cf4e4d32bcc4527ed6328865b5d0d18ea1ddea7fc588718a244a4ae511d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631372162, "uuid": "44a6c610-4633-4968-a518-4c31c8d82175", "value": "T14A933B17A652C57BC08762F41BDB9A11AC13BCBD0B63A30673D4BCE82B159D72DA9F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631372162, "uuid": "034af75a-5a63-4e8d-b7e7-dcd0be075f3d", "value": "1536:W7WREyqkQc923v2uNi7pNF+BoD3qphanvn00JFmoI5um2Xj5YZA0e:4RkQT3v9EbYBo7qphanvn00bmr5um2Xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631372162, "uuid": "0f79e081-3322-4165-8624-590ff0de4f3b", "value": 92932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631372162, "uuid": "16a2ac93-cdb5-4514-bcce-e488e66891d0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631372162, "uuid": "b814ae5d-18f0-48b5-87f5-448809b8b374", "value": "skid.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a800dfef-132d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1631384735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384735, "uuid": "5831b12e-6b06-4ecb-ba5a-66654e601548", "comment": "Malware payload (AsyncRAT)", "value": "f0f9080e9dd773455f8a42b6d9e0be1a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384735, "uuid": "30268587-b2bf-4d29-b562-906a19501088", "comment": "Malware payload (AsyncRAT)", "value": "a22380e8b6975cd77823e8bee4e057dad5367a6a7cbabeaa6bdb548b1a71f62b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384735, "uuid": "9aaf81b4-4ff2-42ee-8e41-5b8392905b92", "comment": "Malware payload (AsyncRAT)", "value": "df6378ad5fbf55bf33e6a3f811f275555479c3a0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384735, "uuid": "d2799d45-5f71-49e9-9948-bf71bccf8dc0", "comment": "Malware payload (AsyncRAT)", "value": "53e03df20d8a1451d743a7487489a37d84b0b190cc63603af837793d47aacad0fc5ae544e760e421899d0e1ac5da8370", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631384735, "uuid": "92abc42d-9427-48c3-9baa-f6a65b4b4c0d", "value": "T1A701D06540DAD61E83A775193D6384703C1586C1D2A44E93E528D13BC3FC5AC709AD67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631384735, "uuid": "6fcc937a-5468-455e-b2ef-cfe3c7fc9192", "value": "24:KsdPAVkIPu7H0gBapBpXsxFCGpxmZcZHnuK2oeMg1fz7:NlIM0maDpED4ZcZHpPeMez7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631384735, "uuid": "29b2be6a-9a64-4539-ac4d-bb1748e3a8e0", "value": 826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631384735, "uuid": "8596fd44-0e51-46bf-b5dd-59e587051a3e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631384735, "uuid": "23ac650b-95f7-472b-ad31-0dbfa703c2b7", "value": "order#4475555.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "949d05de-12a6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1631326720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631326720, "uuid": "8e82578c-d0a5-49be-b9da-101967ad1fdf", "comment": "Malware payload (Formbook)", "value": "ec3d03fa7c6dbc9cce0ac2accaad5f6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631326720, "uuid": "d1519407-fca2-41ce-8c3f-99bf6d55ccae", "comment": "Malware payload (Formbook)", "value": "a48556dec85137383140592217488315ba7fc9f81f74e7c5b4b783a05a83b73f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631326720, "uuid": "2eb03944-5557-4e78-a877-1cdad187d371", "comment": "Malware payload (Formbook)", "value": "f5d24761f9ac590dea845b8df24beaf06f05aca1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631326720, "uuid": "9ebcd73e-2069-4969-b6ee-8b881a4c63ad", "comment": "Malware payload (Formbook)", "value": "aadf70ec04d80fbf785098fddd050d49d9ba0a707a86a1d8f8e74c54f3a90ed71ad22ab3cd18f358ec886c9ded0d63a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631326720, "uuid": "d6087cab-6341-421f-9b1d-088e05f28f6b", "value": "T1B5B4AE243DFB5029F173EFB54AE4B4869B6FB6632A87E45D1481038A4A23F40FD9153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631326720, "uuid": "b3056f13-05ff-4d5a-b832-72b96ed71d6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631326720, "uuid": "4b980e62-ea56-4577-827b-63d2d01ad701", "value": "12288:THtx898RtnUk4DbF53e0IUFLMEEoVxbhHCT7v4I0AgTcpJv4Arv1:EoEEoVmTD4IDgTcpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631326720, "uuid": "cf1bc9d0-6b8e-4789-ad4d-43941e6e3f01", "value": 501248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631326720, "uuid": "698f0e50-3120-49d5-8aef-c082dc53af32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631326720, "uuid": "cde7f688-860b-423a-82c6-05a02ff66dd1", "value": "SecuriteInfo.com.BackDoor.SpyBotNET.25.15665.29449", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f363a11-12fa-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1631362655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362655, "uuid": "f4cd2ad3-33ee-4d34-8bc6-e72daeb415b3", "comment": "Malware payload (Gafgyt)", "value": "2b625bcac00ba0fb510c4eae13353555", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362655, "uuid": "7d70e305-ba6d-4ed8-9e18-6e52b6dbf527", "comment": "Malware payload (Gafgyt)", "value": "a4b970d9a5310369b6f66da5b888ef01efcd524ba0d13fc2277d815de7f36593", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362655, "uuid": "7413e6e0-509f-4827-8ee5-d88c6b8ee7e0", "comment": "Malware payload (Gafgyt)", "value": "f89752bf54a5fcb0bcbb9784c59a3fc9196e83f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362655, "uuid": "49489f90-d986-43bb-97d8-187c79952710", "comment": "Malware payload (Gafgyt)", "value": "c4fcf02b579109ce127c16430b241c47ec9ad1607698e1b1fd7a7e3d1e1b6b47f84c3d8662f6521daeffae431e5c6b28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362655, "uuid": "a76570a0-0ff7-46f7-98a1-31b9162effee", "value": "T12CC33B06F5514B53C1C3177AB79F521977232BB897CB33229A24BFB42BC179A0E3A950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362655, "uuid": "9bcc3b22-9ad9-4f02-8b48-fbae1ba3178e", "value": "3072:Yd5adFfNQamBJl1Or5hudKRvF2/bBbmOQUJ1UXpTn:E5adFf4Or5hudK9FabBbmOQUJ1apTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631362655, "uuid": "de2145a5-82ae-44a2-a195-11591221acaa", "value": 118812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631362655, "uuid": "9b4f3e00-14a7-42bf-8570-97a0af1efec5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362655, "uuid": "3b6dda9c-b61d-4aa0-93be-e799a57bc2f7", "value": "2b625bcac00ba0fb510c4eae13353555", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb173585-12fe-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631364607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631364607, "uuid": "3a09bcc2-5324-41cd-91a1-281110a9319b", "comment": "Malware payload (Mirai)", "value": "efbac1e7095e3c7bab2a3ca578acb21c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631364607, "uuid": "e2bcd6a3-b3f2-4aa9-92de-73d1166e5f04", "comment": "Malware payload (Mirai)", "value": "a52442c7d0d2f9d8da113b774172ce33102ce82e0a5589890690cf623a41db1e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631364607, "uuid": "98347149-6c2d-4d0a-9736-5a2cd982fc50", "comment": "Malware payload (Mirai)", "value": "f8eac01dba487a9a23cfef38a1a533be07d094ec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631364607, "uuid": "c38d4ba4-d911-44d6-9c58-20a7659d6603", "comment": "Malware payload (Mirai)", "value": "649977b3cfbe8c27260a946597aec597e4d0f72ae849cdd9e4894775e08f7342e2edac97b75ad0044b25464268a8188a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631364607, "uuid": "cb5857f1-4946-48fe-a299-6a33f5e9eb5f", "value": "T1D86318817C80AA26C7D0177BFA9F108E3314ABD8E1DB73478C141F95769A81F0D6BB5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631364607, "uuid": "ab803ed8-276f-406f-860a-51a4008097b9", "value": "1536:GbtexU5L9XouIRhb96pUQzXtwavaJ3V8OHxouJeZWDFI8qM:GbtexU0r8QCKw2FbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631364607, "uuid": "7944f11a-3434-4b06-a238-9c182b703bf2", "value": 71864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631364607, "uuid": "a461b9dd-0bb2-487c-917f-257f7055ac27", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631364607, "uuid": "92090e79-fbe8-45d4-bbc9-43690233e7fb", "value": "loligang.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1581c0-1303-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1631366460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366460, "uuid": "335f7b61-a21d-4f86-a181-1997fdcca646", "comment": "Malware payload (Gafgyt)", "value": "1b6d4eb2f34c29558e8c18700febfcf6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366460, "uuid": "b88a9da8-ec55-4fc0-bdb5-404a72db6fd2", "comment": "Malware payload (Gafgyt)", "value": "a9eededd8c599d75f21662f5d77a265355b3dd8879432cb729c3916c6cdcfc35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366460, "uuid": "55317f88-67bf-4d6e-921f-bd6e2ffff2ee", "comment": "Malware payload (Gafgyt)", "value": "a826fdf6710310626e5847f7ab795924c6c7f5f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366460, "uuid": "3c1c6526-7de6-4512-931d-649ce31e09e1", "comment": "Malware payload (Gafgyt)", "value": "a11d37218e84ef60e805779778ac99aab05792a8b25c0429606288c6db9d4b016da1b95232f631b037db4e9a8fea982e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366460, "uuid": "39cb41eb-ca95-43d3-8f38-2a6661532d0a", "value": "T160B3C517AB618FB7C85FCE3306AA850120CDA55612E97B6FB2B4D92CE74B84F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366460, "uuid": "87abb5fa-93de-4672-bfda-05d3f26ca678", "value": "1536:ZLeTikthhSMOCMQS+ZjN4pjuIxreg2OXN2eDo/TUmkiSFxfC7xbXe:ZhHC3S+dUreWNTDiTUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631366460, "uuid": "79ce8ffd-e68c-4e24-b7f1-c50ae70ce790", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631366460, "uuid": "01f73902-5960-42c5-acc8-f760b51830d1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366460, "uuid": "d75a4050-e8d0-400e-89ae-89f8c8951172", "value": "1b6d4eb2f34c29558e8c18700febfcf6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d829f09-12c7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1631340774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631340774, "uuid": "8df4d2a6-94ff-4edc-abfa-13128fa99221", "comment": "Malware payload (Glupteba)", "value": "22edbe8bdc15c6925c4beda033020a2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631340774, "uuid": "d67de3bd-c793-496d-bc34-5a5685f88276", "comment": "Malware payload (Glupteba)", "value": "aa15c9a23c122e4df9220823e55ccc39dcb7ac6b0fd07633f5b850e787b1a61f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631340774, "uuid": "214c942b-adbd-4a70-bc19-2a1f4fa1a66d", "comment": "Malware payload (Glupteba)", "value": "e7bb041eaa902bdb8232e6c92e7d8718c3fdb66a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631340774, "uuid": "374e7aea-58a7-42fc-85bc-b0809cb18e55", "comment": "Malware payload (Glupteba)", "value": "ad64ab95074d0146850a67e1154e018537f4308d61de1f7178873a578f493955c751d05d6faa80473f65f2c6f647f9d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631340774, "uuid": "b019489f-605d-4261-abf6-c58a8df1978b", "value": "T14B263320B550D03AE1E76DF04C7C97B89DA8BCB69B7294C753C165E61AB9AF49C32303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631340774, "uuid": "6ea6dd72-f4f4-4a6d-8a3e-a33843e48429", "value": "69566d56ce8187d49438dd02ea591694", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631340774, "uuid": "7d1ef9ad-e571-4593-bd8f-36a3a17b7614", "value": "49152:oGf0or+BB7llIgclEx8R51vg6FUbpLrFyHz4+wtZu6fphrynPoDD2cawAX/nVJLJ:j5izh1uR51vg6FIpFqELrqXX/nvPHpdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631340774, "uuid": "5bdec05a-da9c-418b-85a1-9cdb3d4ac3d1", "value": 4693544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631340774, "uuid": "4e3883b6-cc0a-48f1-9fd2-65cfa0c09e3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631340774, "uuid": "b44ea7fc-a8db-433b-90d5-6798240eee26", "value": "22edbe8bdc15c6925c4beda033020a2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ccc288-134b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631397509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631397509, "uuid": "e39bd046-6e0f-4a78-9b23-772b0916a55e", "comment": "Malware payload (Mirai)", "value": "81e5f05c8bcb28c9a4919ddf8e225c20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631397509, "uuid": "e908fc53-faec-4103-b7f5-928ccd919b58", "comment": "Malware payload (Mirai)", "value": "abc5720a5dfadc5213f226d1723bfa3c50fb3d9361b0b9d1dc8c516311ba99be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631397509, "uuid": "b75b087b-ecfb-495c-aa62-4591557e8575", "comment": "Malware payload (Mirai)", "value": "f1a90738d493d29899b9a0f2d2d41b4149bf9563", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631397509, "uuid": "29c480cf-3a9d-4d2c-91a4-fecdbbd1e667", "comment": "Malware payload (Mirai)", "value": "7df509502da355b2158c9c161e621013867cd29d48897aac02ffb2aad11c186b23ee10f2284d594efb5fdc4fad6bcecc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631397509, "uuid": "214a3bce-3552-4327-9f1f-292d170a33c9", "value": "T131B34B0B99515F73C142A97525AB59300713E9970F6F2B8A7139ABF4038F9CEB40EFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631397509, "uuid": "5f758693-4e54-447a-bb77-cf5b6243947e", "value": "3072:p+kfjplucoIWMR55hvDBb4M1DS9g2V2Q2q1N/:p+8jplXFR55hrB4M1DS9g2V2Q2q1N/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631397509, "uuid": "c30d0661-f039-4663-b430-40df0416e0c3", "value": 107836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631397509, "uuid": "da3cd313-6e8d-4cbc-b505-5e34264ec95b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631397509, "uuid": "34983624-45b5-49ad-ba1d-ba3e01b7e489", "value": "81e5f05c8bcb28c9a4919ddf8e225c20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3537874a-133d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631391414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631391414, "uuid": "41ce7a05-59a6-4419-aedc-533f3b45fb31", "comment": "Malware payload", "value": "0a288e298e307d6efbe3f194024251ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631391414, "uuid": "f582922e-e003-442e-bd1b-f04e94a74825", "comment": "Malware payload", "value": "ad8767331fa27d72ef724d50aaa1c982430b8602de5dc0c09daaea1c59e42bd2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631391414, "uuid": "e5aa3f4c-cc2c-446d-9d05-53a9c765ddf3", "comment": "Malware payload", "value": "c7acea488a1a9bf1fd619472ef25aeb5743699ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631391414, "uuid": "e67853b9-bd1a-4ed6-92a4-ce9a7c880ef6", "comment": "Malware payload", "value": "5e4ec39f965af8770d0a4239b7c466cfddeb1c933969144368e7bbd80c6303eae02f53e54440eb0cd721eafa938ed6d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631391414, "uuid": "10a0a456-3940-4dfc-91fd-5f1c451a9e11", "value": "T12E64AF306B90C035F5B722B44975D378A53A7FB15B3092CB62D53AEE5A346E4AC30B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631391414, "uuid": "bfe5852a-07fa-4cbc-95c3-55f1ef3cd14e", "value": "bfbc360c6a2a20fc6e98b50e62a61f43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631391414, "uuid": "3c2c9aa0-b299-443d-aa42-0f40694afb39", "value": "6144:ZwJ0qGNk1+Y73qoN4wuKb522glIsFSuXtcbccrQxqK7e+:W0qGy1+Y73qoN4w1ACqK3rQxqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631391414, "uuid": "86a9521c-7acf-4faa-99be-9fcc69d12921", "value": 333312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631391414, "uuid": "62c69816-9480-426c-aab1-e536690e48ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631391414, "uuid": "40ee0f4c-2a30-4199-bae0-f062fa0bb923", "value": "0a288e298e307d6efbe3f194024251ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40374734-1345-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631394869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394869, "uuid": "01461a85-4253-46fb-9314-611809c78c52", "comment": "Malware payload", "value": "53ade737fe31d314f8dea5ea5068b31d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394869, "uuid": "3bcfd8ce-41cb-4151-94ae-abec505b507a", "comment": "Malware payload", "value": "ae3f08ee06ddd2f9080d22a345aa9a5862b64f9a90001244b035ceac8b54dc24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394869, "uuid": "ec6e29c8-68bc-435d-a8ad-03f9267015cc", "comment": "Malware payload", "value": "a92b7ccda86582fa2a424ae3a44b1b3903416462", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394869, "uuid": "21525226-d641-4334-9389-448e09cc36e6", "comment": "Malware payload", "value": "091e6d3d2bb6f11f1e070005c18e9b19af11a7a4939e5115a4435e9654e6ef9a61e1da163fbbaa06bb185547661d3ca2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394869, "uuid": "efd20db8-dc08-4f71-bb49-56b7476f8968", "value": "T14513508C765072DFC85BC876DEA82C64EA607477931BC243E45316AD9A0DA8BCF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394869, "uuid": "cfb933ef-593b-44d3-9da0-0c344873dd5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394869, "uuid": "b5b414bc-4f89-412b-8a90-2f9cd5d95ac1", "value": "768:QVYOo2BHW+AJJIsXMx32DCTA9QPbxFQl+DCUGU/7i4J7:s2hJTXMolSbxo4uEnJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631394869, "uuid": "2316c056-f016-4d28-81a1-4cdee718b405", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631394869, "uuid": "61682a80-3cbf-4d2a-b3ce-4cba09156026", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394869, "uuid": "8b71f9ea-ec1e-45d0-bdb7-2e80515d1c60", "value": "53ade737fe31d314f8dea5ea5068b31d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "071e1f51-130c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631370292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370292, "uuid": "2e31e817-2347-4543-8362-977c7507dc8b", "comment": "Malware payload (Mirai)", "value": "7658c0fb87c8565454b7ed75718ca54c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370292, "uuid": "18c2ba1d-d51f-43fd-bda6-8ba536d3ac71", "comment": "Malware payload (Mirai)", "value": "b19daf4fdb11e7cd444c701747eb9599cac709535beab6555d19a1c63b7ab452", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370292, "uuid": "a8f3586f-8c7a-4da1-928e-2392e05c7b0e", "comment": "Malware payload (Mirai)", "value": "7d04bfbc8535bb4a0aca431678e2978c05d28e4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370292, "uuid": "1312664e-d313-45dc-bf9b-e0f92f984acc", "comment": "Malware payload (Mirai)", "value": "ef3f7e188370ce54bbc050e041e66e2341e9209326b2fe02035c955ee062bf1c803d1260dd8067e9f3c5998730ef14ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631370292, "uuid": "a7a4fb22-5e22-4c4a-8941-864acd78c52c", "value": "T1ACA33B56AB41C0B2C1430A771297EFA60433F7FB179E690AF7682EF09E1548531A6F9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631370292, "uuid": "3b09c9e3-f8dd-49a6-b737-e6339476a584", "value": "3072:i7VryUwUsUjU25zxWX7TZleUHCW1qqm6TFxPHnYi:i05rEvNxWPnRHC8m6TFxPnYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631370292, "uuid": "98990ebb-4a22-4d73-8d82-cf90d81ccde7", "value": 105573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631370292, "uuid": "1c804b72-ac6e-4991-9440-0f852338368e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631370292, "uuid": "91663203-4015-45eb-a8bf-1dfc8d243de9", "value": "7658c0fb87c8565454b7ed75718ca54c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59bd7ca1-12e2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1631352391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352391, "uuid": "3acd827d-f69b-4332-a507-e474d4627608", "comment": "Malware payload (Gafgyt)", "value": "d81314a2305f297270a195a9c4250d5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352391, "uuid": "10f44714-1d07-4e34-b829-19454f9ed972", "comment": "Malware payload (Gafgyt)", "value": "b26024defc387cf0371b2fb62201e70ebaa63afe9a94e6b669e21bbf363b6b1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352391, "uuid": "f2ef3dbf-71ea-4e48-b6c0-bbb124bb85fa", "comment": "Malware payload (Gafgyt)", "value": "90fff0f4e54adab80a2c5062b65dec013820921b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352391, "uuid": "0b12c6f1-322c-4ed3-bb63-44cd21677c09", "comment": "Malware payload (Gafgyt)", "value": "2f6702ba8d00b4f96ab10da645b368953299bbde134e912fcd8981659fc83b387060e593bccd9f71b1a711129aafbb4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352391, "uuid": "453f2b13-38aa-45a3-accd-dfa10363e76f", "value": "T1C5C30805FC404B27C7E22BBAF79E438D773666586BD733116A295EF02BC5B882D39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352391, "uuid": "00eacaec-3638-4dcd-87e3-17f7e7d7a0de", "value": "3072:sJDZ+6lJQTnoo3nKVz3ecxPWS5hLSFuX0wX4eoC9DQlD6ObAF5R:k3eo+S5hLSFuDJoC9DQlD6ObAF5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631352391, "uuid": "ff742d56-27e9-4054-b06d-6129f2e96e62", "value": 120771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631352391, "uuid": "656de8d3-5b07-41c8-af84-8fe5be77cbfa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352391, "uuid": "f593eff6-86c6-4430-a910-ce1d09fb825a", "value": "d81314a2305f297270a195a9c4250d5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a768c631-130c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631370561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370561, "uuid": "740a7bb9-bffd-431b-b490-d569847d0cb4", "comment": "Malware payload (Mirai)", "value": "9990f309e76d5e3f62edc2e12cead039", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370561, "uuid": "bf016010-6582-4e97-8230-d5ccf811a555", "comment": "Malware payload (Mirai)", "value": "b43a030c6622cad2c383751a21dbb56c2251b6d84a7812403c425b0b08303a5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370561, "uuid": "6dddac22-0df2-4f88-b8f9-dd9a1017577b", "comment": "Malware payload (Mirai)", "value": "8a0198b3105c98c34356b92943eb6e07e4e808a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631370561, "uuid": "c825f8a9-3cd5-433a-bb6f-2bd8e5a7753b", "comment": "Malware payload (Mirai)", "value": "46072ef2215ad061d468f20198bbb2b7d866210fb637ca13202a120f68a0975be9f2c2b9f0be6793f58ecdc8668681c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631370561, "uuid": "6d04f10f-29d6-4e2e-b52c-e778d1816bf1", "value": "T1FAA33A56A780C5B3E14309B2129BEF550433F6BF1A9A691AF36D2CB0DF14485B262FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631370561, "uuid": "c68f76ae-13d2-42d9-be81-1c636bc4f3f3", "value": "3072:SIj7V+A8UwUBU4UPnYkLlaTRDGELONeJzmeY0Zh6YfoBd:l758hE9gjLlEY/NeJzmeY0Zh6YfoBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631370561, "uuid": "7bdd92f4-7c1b-4e54-b6df-e975f64103d6", "value": 102800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631370561, "uuid": "e1c5bcaf-845c-4bf3-aa05-49f5a9fb503a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631370561, "uuid": "dc31af7b-0baf-4669-94e5-168d94c1a91e", "value": "9990f309e76d5e3f62edc2e12cead039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445130a6-1345-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631394876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394876, "uuid": "e32bb257-63cc-4de8-b46e-4e11cae37860", "comment": "Malware payload", "value": "740458f559ade558d61ac778a7f4c2f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394876, "uuid": "d92f49e4-b7db-42d2-942c-8bed47491b3e", "comment": "Malware payload", "value": "b44855a5ecc156e0843c44d958c7f64a73798d56cb4f46096e8c82e7a0d224a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394876, "uuid": "321bc212-06da-4b2c-ac2c-4bfb4b3de8df", "comment": "Malware payload", "value": "a4f00fb4e7a3f88f56f00ed4c140dffa02efbe5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394876, "uuid": "ea02190e-f635-4385-88db-fcf759886f4c", "comment": "Malware payload", "value": "b9fed1c64ff2a29a866e3c3b47172ef079e906b784b2e0de0b91eb5509bd2bdae914117193804779617a6a3f5f3f8363", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394876, "uuid": "52fec7e0-8d86-49e4-91d7-158b6f8900e2", "value": "T115D4ED28657FC019C4E7EEB52DDCA4BAD9AA94E3640D72331074A33B8B11B84DE0F579", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394876, "uuid": "df1dcf1b-bc80-4008-985f-84d21a554947", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394876, "uuid": "25935882-3a12-48ce-a572-cf8ad39225fc", "value": "12288:agXIAklT97NiyaDxjhy/dTV2zlXs0Gktyzrf8sot3hiuRh2h/:G3Ajhex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631394876, "uuid": "7de3faf9-0886-490d-89ac-feb2dbe44fdc", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631394876, "uuid": "98e54758-021c-4088-b3f1-1131b916d6e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394876, "uuid": "87ef8d54-1f8f-4ae1-8237-b5bdb0ac1d46", "value": "740458f559ade558d61ac778a7f4c2f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c45b7020-130f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631371898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631371898, "uuid": "1833f013-4ece-46dc-a09e-10181c80c91b", "comment": "Malware payload", "value": "bebe468af7800246ddd3bee2bf91016a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "TeamTNT", "colour": "#6D445E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631371898, "uuid": "a9c3df1a-4921-4603-8c78-f07448d66351", "comment": "Malware payload", "value": "b60131ece447d73f46d4d733e532e844e0a38c264f334dd624ed369f6a0b7214", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "TeamTNT", "colour": "#6D445E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631371898, "uuid": "f6fc8d9e-c31e-4be2-9795-8de92f5e946a", "comment": "Malware payload", "value": "94503f06e00a9b7df4c6c5d10f6b23f66f20152c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "TeamTNT", "colour": "#6D445E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631371898, "uuid": "d2a8e92f-e303-44b6-89d2-4f4ab853f421", "comment": "Malware payload", "value": "3f42d671edf84f57e74486255210a31e7277781b196df1a61c1b2e06296bc3eacbcd2be4be9606effc01f4b6ce82ba19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "TeamTNT", "colour": "#6D445E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631371898, "uuid": "190df183-59cb-4916-b825-45e029f7037b", "value": "T19F042B69664D3C12E38BF37FEB8DD272A21B79E0C76694D67C51130DC4929D8CAF0A12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631371898, "uuid": "7f83d927-18a5-4e01-a8cb-63080576ffb5", "value": "3072:5dUZSsa2dxQWbfKRLLiTC5EB01BBUkWBph3IZX9:zUZSV2dPfKRzEW5URBph3Ih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631371898, "uuid": "ad776827-835e-4f64-b599-5236775da920", "value": 185824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631371898, "uuid": "4c4a2601-dffd-4b58-bb22-8fc45961cd11", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631371898, "uuid": "3ed6eaf8-61ba-4635-8fff-9b264b59d4db", "value": "aarch64.xmrigDaemon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e9e4af-1303-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1631366456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366456, "uuid": "659dfec3-22e9-4683-94e0-9d11ef291bbc", "comment": "Malware payload (Gafgyt)", "value": "e95c0bdc9ea3ee3b4d70fc2a4f145e6e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366456, "uuid": "60b11062-9f50-4eca-b23f-979bc8cb3951", "comment": "Malware payload (Gafgyt)", "value": "b9b1978baddce553511b9ed3afc1f0c1f186ed4fdcc7022194b2382c005bdf75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366456, "uuid": "26dc7b8e-a0be-4c68-a015-b239e482afac", "comment": "Malware payload (Gafgyt)", "value": "d35c6ca5a1b6c1f6f3e6fff120ff77d87eb17b14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366456, "uuid": "d002a49f-af2d-4907-a76a-bdd9dc36e284", "comment": "Malware payload (Gafgyt)", "value": "b27de8cece734310c8fb0852459b7ae277ebedc214656388ccc9a99647b015cc5861c619c52c4d2a27bcf87ca6798016", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366456, "uuid": "4c72db24-5f8b-4567-95de-e78018b9006f", "value": "T1F7B32801D5508B67C2D2277AB79F825D33332BA8979B33125A24BFB42BC27DD1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366456, "uuid": "e491d976-4a58-4118-b9a5-5a38c089d800", "value": "3072:b6an17WtsWhdgYJP0D6mbPbmTQOWsXAOn:Wan17WPJP0D6ibmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631366456, "uuid": "09cce2c4-73bb-4a56-81ef-ca20309e8ee8", "value": 111512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631366456, "uuid": "bfb0a30d-2b03-4986-bf67-aec4a4450742", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366456, "uuid": "7da8d9c4-8f0b-4655-8d71-a1ecd5253587", "value": "e95c0bdc9ea3ee3b4d70fc2a4f145e6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a8bdc3-12f9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1631362402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362402, "uuid": "1a234942-1611-48a2-a09f-6538090f4e9d", "comment": "Malware payload (Gafgyt)", "value": "ffa07947d419a5b43345a34a485be4b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362402, "uuid": "98664830-2dfa-4201-934a-337791373581", "comment": "Malware payload (Gafgyt)", "value": "bbd0f0b8c5440c362fb7cf52086a9f9e01b1eed018b5d5b9d7eb75f1eedb2b28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362402, "uuid": "b77c83aa-ce13-4a3d-9092-3981124034a5", "comment": "Malware payload (Gafgyt)", "value": "2c0bb3fccafd6dfdd7835dc1d20042da01f369cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631362402, "uuid": "3f88f527-f447-4876-a0ba-8d315c7e32be", "comment": "Malware payload (Gafgyt)", "value": "b2b6d8443d0109b0cfde200f2fa2acbef801a574ac92a25cd2ca27ecc127d504c8b61d086303950f401ff4d91302c5e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362402, "uuid": "1e264f0e-5692-41be-8b6a-4ab542c26c15", "value": "T139E34C49F6404B57C0D32776B6CF420533239BA4A3DB33169924AFF43FC27AA4E62945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362402, "uuid": "e945760c-0e4a-4b61-aca3-8208ca342608", "value": "3072:CdFtQanOv6KwGpWHD2z55hLJGSmnSM/9N0cocImcwTsL/QMyn:y3QanOvVwHD215hLJGSmSM/9epZmcwTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631362402, "uuid": "ea0c346b-dde1-469b-a481-d17f2301546b", "value": 156176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631362402, "uuid": "50410a49-e23c-4efc-bbf8-334d66a1bbea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631362402, "uuid": "66abb043-c716-43c0-9d1d-1c81556ebd27", "value": "ffa07947d419a5b43345a34a485be4b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b287a72c-1328-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631382605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382605, "uuid": "d1d8f765-fdbc-4b46-9841-b4ec3d3fd8e9", "comment": "Malware payload (Mirai)", "value": "bda2432831e156962eac8849cbc1cfec", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382605, "uuid": "d8d9f584-4647-4218-aa67-abd4d014de6b", "comment": "Malware payload (Mirai)", "value": "be9ff934bfc6640b34a00283ef69e461ee5ad779a5f980142c3e61fdcd6521d8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382605, "uuid": "f316b02c-ed0d-45a9-8ac3-2b4320abc1ef", "comment": "Malware payload (Mirai)", "value": "465d885f37e3d6b047cc0006f5a6167b31e96b32", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382605, "uuid": "345222da-3cf2-4e10-9319-edddf076c394", "comment": "Malware payload (Mirai)", "value": "d6f65aef2a896c8f608d7b43bd8cec9f7768158b64b01e7603836fb8c9ae452cc2db2375bbea3816ac1d9088028a2c08", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382605, "uuid": "5560f42c-e479-4a66-b018-c59546755bc8", "value": "T13FD34B56FB418A03C4D6177ABAAF42493332979493DB330699285FB43FC676F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382605, "uuid": "540521a1-ffd7-4721-aa0b-159a864464a0", "value": "3072:EXEWTo2JibJHJ3+JX0IWdKw8ZvrmIfBr3iYukM/9V++c:AEWTo2JqJHJ3E7rw8ZvrXfliYtM/9V+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631382605, "uuid": "7967a230-19d0-4e72-88f3-5a0056a8343c", "value": 135911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631382605, "uuid": "e026e6c2-fcb4-4aa5-8660-bc4f32e70f08", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382605, "uuid": "c3169844-62dc-4496-82c6-2bdc4a12bed3", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b784e75-132f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631385519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385519, "uuid": "84333c88-0574-47b5-9945-d3241dec1225", "comment": "Malware payload (Mirai)", "value": "cc756873a9d29de80f4e7dd2dfd2b84f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385519, "uuid": "9befc4da-8e24-4d36-822e-dcc1e4820eec", "comment": "Malware payload (Mirai)", "value": "bf04d5d873fb4c19624bf715a15ab255a321383e3e6a5ea5a9dae991b93abfe5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385519, "uuid": "f2b2ca61-e4cd-4b17-b640-b11acb5a4427", "comment": "Malware payload (Mirai)", "value": "e0d419a6cc55c32fe06526e686e61613cd8eafd4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631385519, "uuid": "1335c4f4-2426-4e3e-80db-32142f11921e", "comment": "Malware payload (Mirai)", "value": "741680dbd3701a3ec2c44aa3c219cecc570e62bec4225a54d0646d5d9d2804e6099e14af5e9fbe703220bb38c207d421", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631385519, "uuid": "cff43d2e-0f2b-43f8-969c-a71b7529d4a7", "value": "T1D063E691BCD29A2AC6E4237AB6AE558E332073E8D2CB7117CC115B153BC651F0EA3F51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631385519, "uuid": "d8cdc07b-cec0-45fc-bc61-f08eaeaebfcb", "value": "1536:4hZnKTLZtX7v/thABLvg9oiL5OVFMYaBEoEASyKtvs:4hZnKfZtXHIuDlM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631385519, "uuid": "e615cd91-c563-4e9b-9292-53109810f4be", "value": 69284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631385519, "uuid": "97d286bc-8bc8-4cdf-8f1b-746243e45b29", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631385519, "uuid": "41b91bec-6b2f-498f-abd0-9a4c07202e91", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c9fb843-1328-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631382434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382434, "uuid": "b9fe09bc-4722-4074-a00d-f4fb0df42b80", "comment": "Malware payload (Mirai)", "value": "9148ee2835d32565a0bf84f1793c0756", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382434, "uuid": "6bb4cf7b-9dba-4e67-9095-ce5e97e4ca12", "comment": "Malware payload (Mirai)", "value": "c0e96f161325c7183a03181c807641a670156f9b57dc7ff9fb723887afc575b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382434, "uuid": "b3f84775-7947-4428-ab47-022f002fe25b", "comment": "Malware payload (Mirai)", "value": "6d8afc7b72c51a3af485b2b3a2217afb2d45717e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382434, "uuid": "a185643e-5368-458d-bf77-ceee35a7757b", "comment": "Malware payload (Mirai)", "value": "9d41cd53325536b7766735d88f0aa12b2cf2b4cc899f337517298e44d547c77286ea4c13e3c0fa55538e9a9c8d0b1c9f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382434, "uuid": "6c08cb2f-79fd-474e-a169-656dbd384fc3", "value": "T1E0431A9AF8019E3CF84FD6BA50164D09FA2033D152831F276ABBFDE36C721655D22E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382434, "uuid": "64a922a2-8deb-4593-b113-361e662600fb", "value": "768:Wec6DAWBmFSK15/MxBwEZsxV20MXulz8thPnCabqntbUg9Cb:WCgFSK15/Mxla20Fd8thaabqRUge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631382434, "uuid": "c34bcd81-9e98-4b12-b674-11dff40bf5bb", "value": 60592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631382434, "uuid": "503f21df-bd8b-4307-ad27-90a7b2623a59", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382434, "uuid": "fd6dd1ff-1a54-4891-b286-692fae0d4966", "value": "9148ee2835d32565a0bf84f1793c0756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d112eb3-12d4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1631346384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346384, "uuid": "4b55549a-e34f-4c8a-930e-de2869af523c", "comment": "Malware payload (a310Logger)", "value": "f1f7b6d3bc2c2d4c5b673d6fdcbdf04f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346384, "uuid": "9d8a53f5-f0ef-4d73-a85d-3ac675c9add7", "comment": "Malware payload (a310Logger)", "value": "c0ead704ef1d5b9a6d60c2c3ad3b68a95a0e4dbef4f0a6fa2a477cde84d461c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346384, "uuid": "5b34f62e-15bc-4d6a-b39a-36a743db9fda", "comment": "Malware payload (a310Logger)", "value": "a9e65f9dadaa5849daa521a5ddb86a6edff66f3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346384, "uuid": "e6966585-f4c8-42b6-9c78-538db0c963ee", "comment": "Malware payload (a310Logger)", "value": "7c4199ef25d242fc7a7fcfa534ec2faac4003248e4eb76de0e0a5c35bee8852974218ab11e6395f4d14d11242786a7e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346384, "uuid": "a04d99f4-da7e-42c8-ab2b-f4aed900e571", "value": "T165559D0173D88E9AF4DE2F30D0B12E1653B9AC12617E9F4A5D31B5EB2C763C1641A7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346384, "uuid": "aa2a95fa-a404-4037-91b7-756943b181b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346384, "uuid": "4480bed1-96b2-4c0a-9ce3-0ff1007fd191", "value": "24576:Bb2LpXk+b6umJBDAJeqtgq0RF8mvhH0HDEZo9aGCii0wY:ELfqBDAfgfR+ml0HDEZCaGCiie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631346384, "uuid": "50aaf087-641f-403b-b080-75303117e68b", "value": 1355776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631346384, "uuid": "2f189400-d486-40ee-b5cd-0885337d05cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346384, "uuid": "89a9744e-3089-4831-b9ca-26a2fa41df65", "value": "f1f7b6d3bc2c2d4c5b673d6fdcbdf04f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e8193f-12e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1631352712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352712, "uuid": "8a23c6b2-fafc-4cd6-b694-6f569153d124", "comment": "Malware payload (Gafgyt)", "value": "e6e2fbea3e40adb90c17f6afdaebaa3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352712, "uuid": "c09bd4aa-f913-4186-b193-1a8e7045602e", "comment": "Malware payload (Gafgyt)", "value": "c18237f6ca6df7d910219f11bbb13d1e2a1341ff6875ca2cdbb5133646ee569a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352712, "uuid": "13d3de09-f052-408e-bfc2-8138fb0a7df0", "comment": "Malware payload (Gafgyt)", "value": "42bc32af1ac611debec5c1f6d3fac486ab7dacb9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352712, "uuid": "591a3f05-c593-411e-b037-3a4eab19f098", "comment": "Malware payload (Gafgyt)", "value": "5666c626ed46c55d590ea8035d2bf592b52e0865d0a06a9d422b0b007f9dc43864a9a848fdc250e400f8f6689a938dc4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352712, "uuid": "7025465e-5582-4887-b977-cadbf04ce67c", "value": "T182C32B273B231E23C0C9547102E31331FAB9DB6938B953D7E9D06DAC2F26A943456BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352712, "uuid": "b3adb6fe-899d-46ea-b839-4a5516aed369", "value": "3072:/YNa/GLBNPoQlphakpiQ9/nYEP/UnSQf/R:6a/yloOphakp39/nYEP/UnSQf/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631352712, "uuid": "327a1d9e-0637-45f7-92d6-a99871530860", "value": 126929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631352712, "uuid": "1353f28c-251f-4cd6-9b23-4a941d5e26e7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352712, "uuid": "fa8acadc-5828-414a-8aa6-a6117079de78", "value": "e6e2fbea3e40adb90c17f6afdaebaa3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a37702-12b9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631334909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631334909, "uuid": "3f967c97-93f7-4b40-b1f3-525906327821", "comment": "Malware payload", "value": "db57d12e2fb21e696872549d14369156", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631334909, "uuid": "58173d0f-40e9-4399-921b-445217816c09", "comment": "Malware payload", "value": "c3272e321d6220e865a631cab6feffc841befc4c7d6b291cddcff2a720b63003", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631334909, "uuid": "d2883148-cbcb-4b78-82ad-bb4e440594e6", "comment": "Malware payload", "value": "dcc6643ea060c0e307a0f9c47348812269e385c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631334909, "uuid": "30ed94c0-9216-47ac-9857-7651cab9ec95", "comment": "Malware payload", "value": "2fa9c0ab647655acd56d871fe65ea65f6499ca7941af626f5c5d72e4d7abe72b85b1f59e83f26f058e5c8e6c4d4dd9c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631334909, "uuid": "980abd6d-6df1-4f40-bb4e-7024157d7f70", "value": "T13D3301059F24EE56DF0108B3198DDBADDC7ABA9507ABB071A8A0A94F87E51D65C4F300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631334909, "uuid": "991e96d5-d9c3-45a0-b852-fcdd4b6f403e", "value": "1536:pxpJNlEYvXndUt/afLuZmVelu9eoCtcC9:phNlHuBafLeBtf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631334909, "uuid": "77b5f02f-f50e-451a-a6cc-33bc5776fe97", "value": 54132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631334909, "uuid": "ac74b93b-2b68-4758-9da1-379ce3924d92", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631334909, "uuid": "e083a685-82e1-45d0-a4f9-9d05d78cf7bd", "value": "SecuriteInfo.com.Linux.Siggen.4057.12579.5661", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c669978-1343-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631394003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394003, "uuid": "afcf98db-61c9-48e7-a3bf-c7543fa92aad", "comment": "Malware payload (Mirai)", "value": "bcecc34d15b3b4ae55309b8c5cb96d41", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394003, "uuid": "afa17a55-205b-42e0-916d-06070c9109f1", "comment": "Malware payload (Mirai)", "value": "c4b3635ccf7709402e4f56199cdcd4c19be2882b89106e4dafa3ee18608981c2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394003, "uuid": "4ca25212-35ee-4102-8f0a-dff8f85b794e", "comment": "Malware payload (Mirai)", "value": "a2fe3ceef0ebabc9a8a204e9d5e841f44508ad57", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631394003, "uuid": "6ef8dc94-77f2-4237-b934-59c56a4084d6", "comment": "Malware payload (Mirai)", "value": "bef446b20360e60051c9c7f36bcecef18367c06aef8dfd1854a2fe7d20b6fc597140e107ec3cab48ee04ea4f4340d3aa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394003, "uuid": "cc7053ca-9072-4a64-9425-c7e5c5514495", "value": "T16413E283E0DA99F6C479D1F25FDA80CEF93D7C01413BEB7B3D76A41994814191E2AE01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394003, "uuid": "490e0713-96e5-4e31-bb0f-cd9f26d4e1f9", "value": "768:mnB4BvsVCN+ESU38qhpVfe4EZy2c7IYmrmggb/HAX2v9sPf/gktfgRm:ywsVGSYh+4iy2ctBHbHFunPgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631394003, "uuid": "60381115-5a6b-4e5f-8a62-2378ebd08ca8", "value": 43808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631394003, "uuid": "01d281fd-825f-4180-9f55-d26210e7adac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631394003, "uuid": "56ce5b87-7dbf-4afc-916f-e192124364cb", "value": "okamiii.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad9fc1cc-134e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631398918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398918, "uuid": "72f4712a-844f-447e-85d1-16bc8c9a83e7", "comment": "Malware payload", "value": "dfee67d5eaed51a4e96bb66ace36a9be", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398918, "uuid": "c4372e54-a1e3-4d00-87d2-40ecce92c337", "comment": "Malware payload", "value": "c729984b6d46d24b312d404d115fe6525e951d551a3aa97aeffe5c2fe7f73828", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398918, "uuid": "90ffa6a6-ba50-40b2-8901-2c2c8b83252e", "comment": "Malware payload", "value": "99b063d4b63371b7c57ba805f58e7a5b526e628e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398918, "uuid": "9a75d4b0-b17a-4625-986f-29271c4fc77e", "comment": "Malware payload", "value": "66c7cc562a261088b82de1b1f9aec2fb7c0f432094d9778b5de2cd272a3b255f575bbd8f34d2a0cdc553992bdbd68f94", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631398918, "uuid": "25f067a8-99ca-4537-acf6-cdb447069ca1", "value": "T17D83083BB292CABAC04791B017EA9A61ED21FDFD1A31705B33A0BD611B7E8D11D49F11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631398918, "uuid": "dc572bfd-210a-48ab-95fe-7666d981f425", "value": "1536:snirU0q7+29PRIhbFD40f+0QKxqFKqb7/XkiJ3fSh3B/ky:Yiri+2EhBJfcgeKqb7cw3fSRBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631398918, "uuid": "be74dfe5-7da9-4f06-9362-ce098a90f434", "value": 84256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631398918, "uuid": "50637f6a-d77a-41cb-9657-fbac36655411", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631398918, "uuid": "b3a97f66-3ceb-4f98-9b10-07e644e1c5d7", "value": "X86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caebdecd-12d7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1631347857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631347857, "uuid": "4e3f410a-e7c1-4f6b-97e9-a5af804b2613", "comment": "Malware payload (RaccoonStealer)", "value": "a2330ba45df8bc98fc43386911fa3e3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631347857, "uuid": "a93a1dbc-ed32-4fd6-b2b8-5901d90ceb46", "comment": "Malware payload (RaccoonStealer)", "value": "c7ca056b4243185dc09bb3d0af624cf7db75928ea2314410007e1cf191c784e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631347857, "uuid": "18d73534-be8b-4b4b-96c9-32c19342e13a", "comment": "Malware payload (RaccoonStealer)", "value": "9c3187a2813eb24a97fa18ec53c1ffd8037db061", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631347857, "uuid": "71bc11a1-ee7b-4404-938a-a1c77c761a4e", "comment": "Malware payload (RaccoonStealer)", "value": "8117cd0899ea154fedcfe5b1edfc9f12073bef862b51f47a9c95fc4c554ba803fb2b9ddb0f32b6eb6eacdb3e68ad65b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631347857, "uuid": "2827c222-288e-4473-b276-a3ea5ce51fac", "value": "T1E9F5332035D958F2D941B279EB483BB690BCC7AD8E7041D7BB94855C1F3E4A1B23B89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631347857, "uuid": "61b8696b-1793-4826-9b9d-02fe181108ce", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631347857, "uuid": "c6af350b-f344-4273-9107-7e7b49fa5ea9", "value": "98304:xhCvLUBsgdVsdE027gVFLHfkPJJcb/Au7bMxMIs:xqLUCgeE0aPJGb/Au/wzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631347857, "uuid": "da6af0ba-48ea-4e41-aee2-5ae9e5c2cbf7", "value": 3500688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631347857, "uuid": "10c7bbc6-749d-4245-b3a9-35aa3a858c00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631347857, "uuid": "0d304d35-c637-4e68-90a4-ec6339b18418", "value": "a2330ba45df8bc98fc43386911fa3e3d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf664613-130f-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631371916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631371916, "uuid": "3cfa90f6-b27c-4c4a-948f-0725983d5019", "comment": "Malware payload", "value": "a9adffbdcec3ad04096fdcd7c11b2ed6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "TeamTNT", "colour": "#6D445E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631371916, "uuid": "aea133eb-9381-4c3b-8a41-04cbc9d42b7e", "comment": "Malware payload", "value": "c8061a1bef593b81410498219fd9d82503a69efc5a62eba75d72005134dcb3ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "TeamTNT", "colour": "#6D445E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631371916, "uuid": "42298d1e-698f-4715-8f7d-79d2ae356a5b", "comment": "Malware payload", "value": "332186b6ca2838e218410a0f9a68f7c724db88bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "TeamTNT", "colour": "#6D445E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631371916, "uuid": "2bf75f32-2e74-456e-a00a-b30070e0a952", "comment": "Malware payload", "value": "d5c3ab25baaeaf946aaf4e0ff0b2698f0fe407abab08db258b3355c4146a0233bb767bbb9810f6249589876dca00ae0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "TeamTNT", "colour": "#6D445E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631371916, "uuid": "847be15e-c7b5-4ccb-8424-6cf894daa0f8", "value": "T159143B48EB4784F1F36290B6074AEB739233710A4117E6B2EB8F5B723CBB2592D5521D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631371916, "uuid": "e696e2ce-9f82-45c8-9a6d-59e3097f1a6e", "value": "3072:kp0lG7jaCO7c3De3EpcjQyWECAQIo5Y1zeAtQkHZfvSm9qHKmx+7ldWjfjm:R47jaCO7c3De3yc0yWENQIo5Y1jtQwnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631371916, "uuid": "f7b51aba-348f-4f6d-a30d-b858ecda7f6e", "value": 193588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631371916, "uuid": "3ef775f0-c19d-4067-9397-92e225fccf9b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631371916, "uuid": "37eb869d-da28-42f3-8406-1899493fc4ec", "value": "i386.xmrigDaemon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12336c52-1303-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1631366445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366445, "uuid": "44025953-c458-4733-9839-13f828d1f70c", "comment": "Malware payload (Gafgyt)", "value": "ddbfadc1cd077313a98356ec4cbc57a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366445, "uuid": "fa1e0409-4c14-4795-a2c5-149e986d46d4", "comment": "Malware payload (Gafgyt)", "value": "ca9b4b534d6c6bb0fb845df216bfc03db9e0f65250ff8f94a2c5cabab66db86d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366445, "uuid": "8b576e2d-ccd3-4aa1-9bc9-7f3495ffd59d", "comment": "Malware payload (Gafgyt)", "value": "b485d0e183b8e3846742e46b7b65b5d90a914401", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366445, "uuid": "53ababe8-4e0d-41ee-b040-cd1bf651b57a", "comment": "Malware payload (Gafgyt)", "value": "5c1b69d10725c6555acd194592b447a719b01db687f85197aab98d844c63ee42d81e3482a4d37890be66abcaccd5a31d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366445, "uuid": "e527b573-6612-4376-a64a-8fdb977ea227", "value": "T188734A47AD628FB7C146AAB525A759300723B8215F0F1B89713DAAF8470F8CDB80F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366445, "uuid": "2dbc5c50-c673-4ae2-9181-fe65571f6089", "value": "1536:kAmbedEfIKy1BABWWNxiEVN/CN3yzTN7mj9VqYLe8f26e:v+eefvyoWWF/O3Mhmj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631366445, "uuid": "5645408a-a0fd-45ad-a058-2e9a14d5a8d3", "value": 77753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631366445, "uuid": "209f6930-2d6d-414f-af3a-8467a9a6b59a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366445, "uuid": "8c9ebe43-0e01-42bd-9b41-caa3f8105921", "value": "ddbfadc1cd077313a98356ec4cbc57a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c679096-12d4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1631346356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346356, "uuid": "b6f33a92-53a6-42f1-bc6a-e175a874211d", "comment": "Malware payload (a310Logger)", "value": "c156f5367443c436b6a54f16a725d261", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346356, "uuid": "b44d1c06-0770-4525-9d50-481929ce3187", "comment": "Malware payload (a310Logger)", "value": "cba897dc82a468040a082fd6135edecb8dcdcd0f0fe1375adeaeff3262cc6504", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346356, "uuid": "17cb2bcf-e701-44b8-9d51-f60b6ae212a2", "comment": "Malware payload (a310Logger)", "value": "774549155b8bf2a455db51444ed3cb277081ca6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346356, "uuid": "c676928c-9bc1-4388-9d65-f8743639da8a", "comment": "Malware payload (a310Logger)", "value": "e627e27c001af63002f6557a987d4567931b69db82dd560a095f8587f903df09eaa4e2214bb9b449f97cb7cd7ca436de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346356, "uuid": "da09ce67-b435-4585-a14b-ba776fa544ef", "value": "T170E49D37AAAA4D25F50A0DB04091B330D2A10E8639CF8CD2DD8C765DD13BBE671E956F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346356, "uuid": "8b5f8fad-0df8-4c47-bea5-bdda6b9be4e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346356, "uuid": "dc3fa2fb-fea0-455f-9329-d609854916d1", "value": "12288:EiJe4CK2mMmVlyJFlIjh5eSrrFowfviTwkAKc:EDK2mRi3IjjeZwfvi0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631346356, "uuid": "4bd293bb-1411-46e4-bc50-2f6f7ad9a33f", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631346356, "uuid": "a2100a4d-f2d5-4f9f-a512-c484e459efdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346356, "uuid": "3c9b9c67-6725-4b26-a5a9-af4a2ec5fc1a", "value": "c156f5367443c436b6a54f16a725d261", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143921ab-1305-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631367307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631367307, "uuid": "ad15e7f3-ea9f-41cf-9aa5-890a8255c3f4", "comment": "Malware payload", "value": "59b759497a138c44698bdbfeaa855e46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631367307, "uuid": "24049522-bec5-41d3-898a-56e7e9b44abd", "comment": "Malware payload", "value": "cc03cd3db24427db4274995198377ae945966c27bd5b74bc52e4547481b93553", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631367307, "uuid": "da648351-c763-41a4-85ef-ed5f0019c824", "comment": "Malware payload", "value": "e9f6810fba4b0afac3131f2bdbf218195dab2a4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631367307, "uuid": "2cb53e3c-1c2c-49fa-9fa5-3f640152f2bb", "comment": "Malware payload", "value": "e19aae9da097feef40725fe6af5d6cebd091a7f5f15cb9f26755874387de6b1d129792ddacc70271c4735c44f8fdd6a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631367307, "uuid": "fe2b5038-2695-4308-943a-8574b84ee477", "value": "T1A6057D22F2D18437D1731A3D8C6BA3A9582ABF512E38794B3BE41E4C4F796813D252D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631367307, "uuid": "5d648f66-9eb2-4403-ab9e-6d8ddc80d019", "value": "50f2914c55696a01c19cbfb70bca752f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631367307, "uuid": "b4e8f501-091d-4298-8ce1-515eef0f4b45", "value": "12288:sXrSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9DJtXtj:sXWsJ39LyjbJkQFMhmC+6GD9XXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631367307, "uuid": "e3b58fb7-73f1-4c61-b363-e9d2b92998a8", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631367307, "uuid": "744aeffc-acea-4847-ab35-980eff543f23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631367307, "uuid": "c687445c-c802-40c9-a2d0-240c42bf991e", "value": "59b759497a138c44698bdbfeaa855e46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6d7541-131a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1631376532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631376532, "uuid": "2e94aa75-e858-4d4e-a016-5d1885a9db34", "comment": "Malware payload (RedLineStealer)", "value": "83155943213909a57077969ed56fd03b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631376532, "uuid": "65f2692f-58e8-4032-ae61-5596774181dc", "comment": "Malware payload (RedLineStealer)", "value": "cf069e759af3f20240bc049a2138cfa3b4cb5fc1c8ad3d75a60cfaa73660b521", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631376532, "uuid": "adae310d-5030-4917-8d5f-783476e944ec", "comment": "Malware payload (RedLineStealer)", "value": "92ee83d2f0892618a9e75c7063f8eedec0b37bd1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631376532, "uuid": "caca5e72-dd4e-49b3-ab79-d12cc5a0a536", "comment": "Malware payload (RedLineStealer)", "value": "40561f3fefd2e5d664a8622316935a0b4357cd60427d711ca0a2ae8f4dc8fda4919e9e80edf8c3e912d5fdd075b3566f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631376532, "uuid": "66be8e48-c081-4f0d-b867-8e99d192b6a7", "value": "T18AE5BF6A6161C59EE50410B0DA45FCECAD937D7884A4056E309A742FBA3F39388DFCDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631376532, "uuid": "d1397feb-0ac4-4401-bc89-b42d35ed2cb2", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631376532, "uuid": "91a8ca26-d276-4a06-8272-7e52c50b714d", "value": "49152:qU4v9DhUh96MOKaLfl6/wAfiJPsMDNeaPgRZazHFtWJUV4fHSftsyZWezWzKHWtO:qbhUh96MOK4fl6/ppMDNeaFPWJUGfHSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631376532, "uuid": "d1ebf3e1-b8eb-4665-b8cc-9e4fb3d1920a", "value": 3118792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631376532, "uuid": "1544f595-7802-4761-ade9-779bce436529", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631376532, "uuid": "6d81683d-b808-4ec0-915a-d47d7f563b90", "value": "83155943213909a57077969ed56fd03b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a986b0c-12ce-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1631343669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631343669, "uuid": "7c93084c-fa3f-4a60-837f-e9bab3c3c382", "comment": "Malware payload (njrat)", "value": "61522f3e0ff5ffcd3b70af0969ce67ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631343669, "uuid": "615ca33e-c175-4e12-90d4-0099856ec70a", "comment": "Malware payload (njrat)", "value": "cf75d51ec31d817017d71dbe8def69d443e4ecca131e70ca6252ebc455e065a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631343669, "uuid": "9eaa0f66-1658-4120-a598-a3cac6061cb3", "comment": "Malware payload (njrat)", "value": "055acee75181881b27e6c489b85efc530ed2a145", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631343669, "uuid": "db2f6dcb-b39e-434e-b06f-17bd68b6ff92", "comment": "Malware payload (njrat)", "value": "62fc1512450190c451fe88062b97a0b1548b449b0e0328dd4c2a0c23b25d18e972b43c2ce9f50a4dc027c846ec9793cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631343669, "uuid": "ca0475e9-8ea4-4e32-81c6-1984e0e6298d", "value": "T1A694D001F7D284B2E5722935593DE734A93CBD301E24CA6FA7D40D6FBA74091A621FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631343669, "uuid": "f1fe0aba-30fe-4950-ba6e-08ad0626aaa4", "value": "027ea80e8125c6dda271246922d4c3b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631343669, "uuid": "0ec3960c-f32e-4df6-88a8-c0ad8f805dcf", "value": "6144:GsCwu+mWhJifvtNP/7YXSLB80PhU36hR3pAtGedY6Sp1wRs/dJKxuw07ir6A:7xmIJQvPkitTkWR3pIY6+N1dwOiWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631343669, "uuid": "efde2868-8da1-4cd6-a89a-218997d280b4", "value": 408502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631343669, "uuid": "5841dda7-4c95-4b62-aac3-d45adb80b04d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631343669, "uuid": "b7e9d057-26b4-47a5-a56b-e2f0813ff448", "value": "CF75D51EC31D817017D71DBE8DEF69D443E4ECCA131E7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca51ebb-1304-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1631367026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631367026, "uuid": "9a277a6f-03a3-4454-a279-e409a69183fa", "comment": "Malware payload (RedLineStealer)", "value": "0cf59a811521e09539cb4195a4cb77b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631367026, "uuid": "bca94006-e4e4-4c58-8e2e-29b19e309731", "comment": "Malware payload (RedLineStealer)", "value": "cf871e535adfa63b63b8eedce80f87996cffbd415826a6559c6fcf0585f2c885", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631367026, "uuid": "fca451b7-07b4-4c91-a330-3ae5ae7b7e89", "comment": "Malware payload (RedLineStealer)", "value": "88bf56e6b102ac53e56a234ad88f4d9269d3ac33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631367026, "uuid": "d77b3247-db87-4520-9360-db7dd13581f1", "comment": "Malware payload (RedLineStealer)", "value": "668814ab8490181f3db5eb573c73d4ff4a642af6058afdf9d1e7c3f38d31fdb048c4833dd34a1905816dba70ce9bd296", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631367026, "uuid": "94a4560a-20d7-4ac0-91ce-7e90998b1720", "value": "T1D684AE30BAF1C035F5B752F449BA97B8A92E7EB12B2090CB52D616EE06346E5DC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631367026, "uuid": "9c961890-00cc-4870-8e46-646b71aa764d", "value": "7dedca7bc07f096eb3cce2bfad6fc32b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631367026, "uuid": "1eab17c2-f1af-4f38-8808-cb8887a889da", "value": "6144:iISiNQcyyZ65omLH+1xP5qEq5zGSmuKW/22ABbc0ol9Bjj:KeQcyyZ6zLe19rq5zNmjU22go0+jj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631367026, "uuid": "184a6aea-a8c3-445e-9b86-ede6110ea7a9", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631367026, "uuid": "0dcf37b8-ddac-4bba-97a2-ae8504a538e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631367026, "uuid": "b5c78e68-e10a-4fea-983f-e08c00498662", "value": "0cf59a811521e09539cb4195a4cb77b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e78a5cfa-1328-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631382694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382694, "uuid": "6382d16b-39a8-433c-a7e0-ad4d0d1efe3b", "comment": "Malware payload (Mirai)", "value": "b1e8e8b52655d4653dc95e204d09407e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382694, "uuid": "2d938ff8-9148-43b6-94f3-80049093f5e1", "comment": "Malware payload (Mirai)", "value": "cf9f2a5b535a7ed52836737eed7462a8e4c20d685fe94b6e6dc86a5941deb6c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382694, "uuid": "3cba8494-868a-4203-b64a-9223230ab226", "comment": "Malware payload (Mirai)", "value": "38db076536d11657a48d0af7ee51efe009fee97c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382694, "uuid": "7a3690a5-9ba1-4fbd-a0c4-726a229b466a", "comment": "Malware payload (Mirai)", "value": "0c79e2ee1119da47d6b70c25aab980fcc97cb03a261314fc12dfa576d0ef8d1ae89ef988aa31cd526249f8b3a51e25df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382694, "uuid": "a74d3029-db63-4686-ba5e-660be0e04879", "value": "T1D483B81E6E259FBCFB98823547F78E215A5837D627E1C545E19CEA002E7024E381FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382694, "uuid": "e8c73f84-8fe3-4499-8d3d-1bacae6e2073", "value": "1536:+PUKkq/rj3DJTDKgu98reeZmm4Pk7dfbyXBiUmCGPve8F/:CUoH3ljvZmm4PEdmXBiUmh3eK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631382694, "uuid": "5d16542d-5dba-4cce-a4a7-24145d1ba81d", "value": 81068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631382694, "uuid": "83bdabc5-4d91-4a49-9355-aba43b1f890b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382694, "uuid": "8e9473e9-f526-4ab6-a9dc-101144759e6f", "value": "b1e8e8b52655d4653dc95e204d09407e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd9798e5-12d5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DCRat)", "timestamp": 1631346975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346975, "uuid": "2b396d83-3a81-4442-961d-a22922cd1716", "comment": "Malware payload (DCRat)", "value": "b215360a51cbb88cec691239f2f36328", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346975, "uuid": "e86ac088-80a1-41be-8ec8-70102ebc63f2", "comment": "Malware payload (DCRat)", "value": "d326540d3d600f7e6f9412b9b99b7b4b0123b45f7d64d7f4890edf62edc9b226", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346975, "uuid": "1f1b2372-ce68-4765-b6cd-96236438be6a", "comment": "Malware payload (DCRat)", "value": "e0231dd7f0941ecc4032b42f54bda186afc28a8c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346975, "uuid": "788817d1-3fdc-4961-b729-bc4ae8f83050", "comment": "Malware payload (DCRat)", "value": "3e2f2660a8016eee8ba3cf31a82f8d5663415e04c74c27331bda852f7694cce04d7b4e9165edfa21769b2b0655e3144b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346975, "uuid": "989b05fc-dfcf-4bf6-8b43-6e44363db8d5", "value": "T132650702FA84E909D03D06B7C5BF87150FA8E9932B62C7DB7B5A375864363E25D0D1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346975, "uuid": "24c6d38d-cfa9-4238-87d3-65cb87630dd0", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346975, "uuid": "67083904-aece-47f6-ac1a-bf18e4911ab8", "value": "24576:P2G/nvxW3W9Cz0PKCB3mI5zSKQth9TRShQR2oDDpoD1H+4T:PbA3kCw9BnKc1opoIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631346975, "uuid": "a26af599-d819-4edd-8819-e9e1bb9f2c4c", "value": 1470112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631346975, "uuid": "6b0cbaa8-35a4-4d86-ab35-8b6696fd39d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346975, "uuid": "345a7159-8157-48c6-bb70-643d2593e38d", "value": "B215360A51CBB88CEC691239F2F36328.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "145b67b1-1321-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1631379333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631379333, "uuid": "89bcdc24-61b8-44b3-8f10-646fd9661605", "comment": "Malware payload (RedLineStealer)", "value": "e5bc53275a8c96b22a5067b38dc4dcba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631379333, "uuid": "ebfe6bdc-3c52-4cae-89db-29ccf7a106b5", "comment": "Malware payload (RedLineStealer)", "value": "d83299e80a336d68834cf2f5b36825db41d1e604e5d7e2375113221186a171cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631379333, "uuid": "86b2648d-794c-477b-a82c-50e02b089797", "comment": "Malware payload (RedLineStealer)", "value": "abebbbfa6a35aeafb828060866c195dcf4823b0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631379333, "uuid": "ab138111-9b74-4244-9e4e-f7f7aefe4b10", "comment": "Malware payload (RedLineStealer)", "value": "5c58625b1e1f08d416f9d0396d2550319c41cc882720be83dc77450d32a5f8102b0a51b2e8dfbcbc578c156b29be224a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631379333, "uuid": "4bd8623f-9a76-4c15-a7cc-92150b02879a", "value": "T173E5CF5E7216C35DE0987176CD22DC789C51BC6228B524AE22DE792F3EA53438C0FDAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631379333, "uuid": "d27512d9-0032-4eeb-a3dc-e1d909e06a6b", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631379333, "uuid": "7b887aea-d2ce-404f-910c-a2c2e83f85ef", "value": "98304:6JqhUh76MOK4faCnoBEUhDmtzPQPPKg9TY:WqhUh54fagEhhDmtsPJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631379333, "uuid": "69940d05-6cb0-48d5-b881-8c0d31d21a1c", "value": 3247280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631379333, "uuid": "1fd3ad9a-c350-452e-a4e3-9cf2f7e0dbf5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631379333, "uuid": "68de1171-caec-4c1c-a9c2-7eb9c4050206", "value": "e5bc53275a8c96b22a5067b38dc4dcba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27698e53-130b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631369916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369916, "uuid": "883307e5-d954-4490-bcd7-6adbd63950c8", "comment": "Malware payload (Mirai)", "value": "6cb7e23d86d7212a382b4cf9d3e3a8a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369916, "uuid": "e4d5c6de-0529-432f-b1a8-8833dca6e6b6", "comment": "Malware payload (Mirai)", "value": "db336e4a0763e07dc5ae335fd5c190b4e16f9103f876f961bd65baaea06c8070", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369916, "uuid": "a3b94c01-273e-49e0-8b15-26d8f99d6c0a", "comment": "Malware payload (Mirai)", "value": "4887c15dbcf7a2ddd9e95882bd71764c2344a4a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369916, "uuid": "f7dae06f-4e13-4355-8e06-b3dc5d04b36b", "comment": "Malware payload (Mirai)", "value": "72e664bf94e13cc193bc1afe65e33719f5a8c510fc5d7afa2320585cd4f0abeb6c41758647832f9cb0a18e061be88df8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369916, "uuid": "39b20220-5692-4023-ae47-35a616f0929c", "value": "T158D3082BBB230A23C0C5547101D32332F9B5C3E934FA53D7AAD16DAC6F199883566BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369916, "uuid": "6d014f22-f9d3-4b38-9074-b56be5b713f4", "value": "1536:D5ZHsMZR6dVwYdT+9NM5eRYCtSojtrVNysmazEVqsG0fTDkdj:7jM+9N8wnNysmazEVqx0ffCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631369916, "uuid": "968d9740-56c8-47cc-b48e-8728e1bcd371", "value": 133224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631369916, "uuid": "02c8d01d-d323-46d1-9261-d3f53604efc7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369916, "uuid": "06c52f76-02fe-4530-90da-b37d31f5613d", "value": "6cb7e23d86d7212a382b4cf9d3e3a8a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159c53bf-1303-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1631366451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366451, "uuid": "1be00738-cc2c-4afb-96a5-00da79518807", "comment": "Malware payload (Gafgyt)", "value": "3de87394ca08d922bc4859132a771f58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366451, "uuid": "4fb6acde-5750-44fe-840e-afa83fede084", "comment": "Malware payload (Gafgyt)", "value": "db784e9216114a006109717c5dd538bade5cc7645304d39bccd2b1348e181f1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366451, "uuid": "71fad314-ae4b-4c36-b423-91e173cfaf63", "comment": "Malware payload (Gafgyt)", "value": "a0e5352e56179dedf23d2200af9d093747735a9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366451, "uuid": "57334682-eaa6-43c7-9e4f-c33324913f95", "comment": "Malware payload (Gafgyt)", "value": "6aa09b6766796dd860fb170a0b92fdab1fef2b2c4b87d2b185ee4cee1486fefea4f30e353930a18228bfd070f60d85a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366451, "uuid": "4ffc17fa-ead6-48df-a528-4d21e82ec72a", "value": "T1F1831943B72D0B43C49B6AF12DF72BF08769F96117A76180A11EBFC44772AB02522F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366451, "uuid": "0a61ab40-1a42-4985-9377-2de973c8f7c7", "value": "1536:BQOc40ozMPjej5qckA39ikRFaRnrWBfOEmQ9VqXjtWf2Xe:Bl+3y4ckA3BwrWZOEmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631366451, "uuid": "a7fd2f42-2640-4cac-94d6-4b2f84f59d52", "value": 84796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631366451, "uuid": "2b26f567-87e1-490d-b0f2-484f904eeee2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366451, "uuid": "58d13ce5-4d5e-4623-9cbe-507a6e78bd8b", "value": "3de87394ca08d922bc4859132a771f58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5edef6-1303-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1631366759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366759, "uuid": "57076ddd-54c8-44f9-a54c-cec268e4f847", "comment": "Malware payload (Gafgyt)", "value": "34244fda248ac2772699064020c1d4cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366759, "uuid": "d296c7c0-4209-46d8-a89a-a889cc9c0df1", "comment": "Malware payload (Gafgyt)", "value": "dbb864961a997af60e4e7455bd272fe7aaf6bc7a545888b7c7d7f2967d385911", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366759, "uuid": "60de0513-4af5-4147-afd6-e9d431cfdc94", "comment": "Malware payload (Gafgyt)", "value": "e15dd03da1dba23517fd6772c5b3c0253f0ccef6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366759, "uuid": "f9feab56-d32e-4e16-be73-454f5e6ef970", "comment": "Malware payload (Gafgyt)", "value": "22f58cc4e661b4d9a0c6569fdb1f59e68ef795455938e687894f40477324f97abe338de7ea7b586c074ed3c30889a88a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366759, "uuid": "821ea52a-3ae5-4319-ad35-8fb965dc9f3c", "value": "T1AF93F892B900EFB6F40ED77A44D34724B670FBA24E531672731779A6AE322D43826F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366759, "uuid": "ebe2ca19-8b98-4f57-ad4a-a7be61e92c62", "value": "1536:4mZMaXpB8F9OEG6ktQm3r/FS3n9RIB6Yy36gX62f7vTmQ9VqXjewf2Le:v7p09W6KTG/IB6Yy36mNfmQ9VqXywf26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631366759, "uuid": "b8e06e06-b798-499f-837b-c78528a88572", "value": 91087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631366759, "uuid": "6ca27d68-7887-47b3-a454-c6df792ff639", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366759, "uuid": "8a9696df-8cf7-4d8e-9c7d-a5df6fce7e25", "value": "34244fda248ac2772699064020c1d4cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c54e57-12ef-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631357938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631357938, "uuid": "c7d04e5c-29c0-4149-ad6b-9fda7f644f24", "comment": "Malware payload", "value": "37c04f26e0b5602ec6e60c310a74e707", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631357938, "uuid": "21b31c85-5512-4e11-ab08-d89c255cbc3d", "comment": "Malware payload", "value": "dc0e27ef89ef3f3399f818185aa8800226468ca5f47fc2e912a353e617070f4b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631357938, "uuid": "3cf81287-7ead-4507-a007-3cf5668d4acc", "comment": "Malware payload", "value": "b8337607d11b15d8380f9637892ef587d8e2bbdd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631357938, "uuid": "d2c017ba-bfdb-48e0-bc1e-8a0c2492641b", "comment": "Malware payload", "value": "5529333857dc423e6fb7be925eb48c9d31073cf97759bba9ad42abceeb9126c5d63b1f33b7c2b6f07d0fa30467e337e2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631357938, "uuid": "cbb02e04-156a-4d7f-b9b7-88fc2f948600", "value": "T180A47E16B2E444BFE8268235CCA35906E77278211724CB6F0764437A5F7B3A19E3EF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631357938, "uuid": "b1c6906c-90c2-4977-94a1-d7929218b9cd", "value": "92ebe261b8d7879345d45855cc60d775", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631357938, "uuid": "aa09f463-dece-4627-bc01-97c8200dc155", "value": "3072:m4wJsJO8IUDPxWowANxTEDju83zzB2ooZutHkjKr86UWG:dw2DZWEQ3NnB2CkFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631357938, "uuid": "8bae2b42-e4a1-4d03-af15-4c9b081a3ff7", "value": 476160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631357938, "uuid": "d265c9b2-dc3f-499a-9e32-02809ee1c37a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631357938, "uuid": "7b02161e-a93d-4bf2-b475-8d191db19e3e", "value": "37c04f26e0b5602ec6e60c310a74e707.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "492277d0-12c7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1631340767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631340767, "uuid": "bf391da7-677e-45e4-bb95-1337d52a9bc5", "comment": "Malware payload (RedLineStealer)", "value": "ebebea9f2eff7060d93251e6e1ad00a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631340767, "uuid": "dfd580da-40e5-499b-a3fc-af57f1e9126f", "comment": "Malware payload (RedLineStealer)", "value": "dceba751e6f0a8c3466adbada5cc222ad99067f256cf640a1f8cdacfeba76141", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631340767, "uuid": "66d39b60-dc7e-4bf5-a859-ea0e90bd1579", "comment": "Malware payload (RedLineStealer)", "value": "156b9079f20a7eb2207475c8a4cc7e466c0a4523", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631340767, "uuid": "fdf4c5dc-1896-428c-af39-7eaab751ce54", "comment": "Malware payload (RedLineStealer)", "value": "c1b9e3635acd1b32e21a3111b12d1618f8165c06d3daa1811ae0099db805a034a8a80e1a1ee7535324b2a5b528baa03a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631340767, "uuid": "2ec4fc6f-cab0-4bc9-b349-b7ffcbc00031", "value": "T1BDE4E130B6F0C035E5F716F459AA83A9792DBEB19B2480CB13D52AEE56346E4DC30787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631340767, "uuid": "ea37363e-becf-48ad-a239-45261ea8ed88", "value": "69566d56ce8187d49438dd02ea591694", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631340767, "uuid": "a2e9303c-bc1f-49f3-91ca-204f64007686", "value": "12288:8pcx+TUuMQ8wac0MoojFFsjVCNG55GD3PSJv04JQdXzjOq38p9TTgz:Gcx2t4M5aJECGjPQvhJQdPe9Ty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631340767, "uuid": "f23dbc38-f9e1-4f7c-99c4-23254854dced", "value": 692736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631340767, "uuid": "6f69ecb1-3d1c-44b0-a61f-54a8614739c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631340767, "uuid": "29359ac6-996f-4139-b084-ed137faa8ef4", "value": "ebebea9f2eff7060d93251e6e1ad00a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea30722-132e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631384961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384961, "uuid": "72c93e0d-60e9-4efc-b0d9-11c1c3955e5b", "comment": "Malware payload (Mirai)", "value": "1d90a4f893c987b9206e6db2767eae1d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384961, "uuid": "dcf87b50-9fc5-4744-9233-4e6578bf2f3d", "comment": "Malware payload (Mirai)", "value": "de78be53180e024465fbde5bcafb5903b20e2d30d5b3d7ad792dfab43ae3434b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384961, "uuid": "39d88118-1c13-4505-9eb8-f724fb31d2b7", "comment": "Malware payload (Mirai)", "value": "d3afc0738974de59dfa311155d73571574413939", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384961, "uuid": "9ab481d9-c103-40bc-903b-0d052a5ed3ec", "comment": "Malware payload (Mirai)", "value": "aac242400087f494c2628841cfad4b18042356468325b88b07ac95a080f75f30d4283d163952fc851b9017f28a001d44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631384961, "uuid": "c73e51cc-cfc1-4ed0-9bb9-9571dbeac3e5", "value": "T156640187FB21AC2FC9400A7115DB0B5DB7BCEA9A82C7E181F3D4C51E3C6A285B7911D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631384961, "uuid": "b1029ea4-9802-4b82-8e19-b90cabb15b70", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xioU5POdOQ33Q:p3lOYoaja8xzx/0wsxzSi5PqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631384961, "uuid": "8e9b8993-81b6-4521-a7d3-f4228763594c", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631384961, "uuid": "170eb48b-8440-4e27-afcf-977dcd88a33c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631384961, "uuid": "ac2e3100-4364-4c5e-811f-184471823705", "value": "1d90a4f893c987b9206e6db2767eae1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c39688b-12e5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1631353791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631353791, "uuid": "1d51c4ab-dc2f-4e89-8064-09d1ff65b9d0", "comment": "Malware payload (AgentTesla)", "value": "fc43fad467cb917f79b5a52e100c6379", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631353791, "uuid": "4ebfe75d-6095-43d0-9b32-84b404e8d71f", "comment": "Malware payload (AgentTesla)", "value": "e0a8adea8bed9b577236dd14614279f055d88b6e485cbc8383794e319ffa9753", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631353791, "uuid": "3a347b99-f56f-4231-8e18-b8f0c2f98409", "comment": "Malware payload (AgentTesla)", "value": "4f770b903f7a16873cac60b1218734466590ed0f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631353791, "uuid": "5268e0ec-bb89-4e1d-9475-a5faf04d9014", "comment": "Malware payload (AgentTesla)", "value": "af9b82b287dffbe2af9366ae92509251f456a989c132bbfeff5b1c760e0e3deff6ac80f60c68f0ef0d783fd03b9c415b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631353791, "uuid": "67dc3df8-4b57-4cdf-bc28-6f3428c9adc0", "value": "T150157C58B995605DE837DF319AB0DC319626BDB66A36D00E20CB3F5B3B7F6828D10472", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631353791, "uuid": "412dfb0d-4f4a-42f0-a3b1-2aa2b69e6293", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631353791, "uuid": "b433f31f-6fc1-42f7-8860-1442dcb2bf80", "value": "12288:pwMpT44p6BT2p7fc90r8LUbh7QJ4EvTfER/3rxQoRrxs80lTUxHd+k4DbF53e0Ig:pDpkw60hfceYgbidLsJ3d441q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631353791, "uuid": "56359e3e-afd7-4288-a319-1102da278635", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631353791, "uuid": "a6520222-8ddd-4831-93da-dd6ea74ad3cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631353791, "uuid": "6c0ba8ee-e1a7-4f6f-9535-c3435e633628", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81bbcbd3-1329-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631382953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382953, "uuid": "06059ac4-fa7d-41b6-bc5d-bfa03bdb030f", "comment": "Malware payload (Mirai)", "value": "ab41a039f88e065100248193af0dd532", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382953, "uuid": "e73d337e-d6d2-4dfd-aedc-eb973e95f247", "comment": "Malware payload (Mirai)", "value": "e1ba49873a5cd9eb4e9eecfbf2a88e5a83dc8f0076f8c581ad8f9fb7665bc65b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382953, "uuid": "3af95aba-8c85-4cc7-b016-20d705411cd0", "comment": "Malware payload (Mirai)", "value": "c01b476a8209e8aa177623607aec50ad92f36d7d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631382953, "uuid": "f05df0b9-85ce-4fbf-9d3c-0d442df6e84c", "comment": "Malware payload (Mirai)", "value": "382bbd222f0ac5817a2a48eed0b4e2e9dc645f90b14486fcc21b479e409d50874a79121cc73470585de3a5b158c32fb3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382953, "uuid": "c99d9fda-ff7d-468c-84b2-2153de333d7e", "value": "T109439E36D82E6DD4C54A423864198FB02F23F1C892A37EF75B9182F15043AB9F558FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382953, "uuid": "702e8363-444e-47b3-bea8-e1c20e6d56e3", "value": "1536:UakqEqiFFFmwtZSwJsHyAF43YICB9CLE:UsLiFTmiKGYICB9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631382953, "uuid": "0332626a-c09c-417d-8f06-38506bcc57f4", "value": 55960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631382953, "uuid": "d83905bc-4f26-4bd2-87d2-6bad4a841b55", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631382953, "uuid": "86c67276-3e77-4565-b71b-498fd44db631", "value": "ab41a039f88e065100248193af0dd532", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c037e86-130b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631369924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369924, "uuid": "3f0dfb0d-e76e-4b16-8bb4-197b2164a9a5", "comment": "Malware payload (Mirai)", "value": "594ab17b7af4af68b6dbc3ff99c4306c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369924, "uuid": "fa41e182-5c87-40e3-912a-7278374be9ba", "comment": "Malware payload (Mirai)", "value": "e337788434b4abd85db715121f53be79526aa56f405de34b35c47547927432cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369924, "uuid": "b64156e2-7aff-45f0-af4d-285da68369d3", "comment": "Malware payload (Mirai)", "value": "4a9cb011e5dc37be06c28a8c841c31ad1fd13345", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631369924, "uuid": "1131e273-bf6f-49ea-848c-6af01ab10f31", "comment": "Malware payload (Mirai)", "value": "8824e6adc34c2e0936c91f9ef7feb678fb4735834878217598aee533fe301c3c8a3f753dabc9f6ae948a069c9e790eb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369924, "uuid": "14792e2f-eb38-43e8-b534-0824272cd7bc", "value": "T1C8E32901D4905767C2D3237AB78E424D77331BB593CB33159A38AEB42FC1B9A1E79861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369924, "uuid": "34bd9395-db97-4f39-8e26-3d55ba5c2736", "value": "3072:g6dq7BAPyzBPaSvRySK1r+nHa+Qqbz/yiWae6Jjm+QdhXXHY8:gqJPyzBPaaySMqbz/x3jm+QdhnHY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631369924, "uuid": "b60394db-7a46-46b3-a867-ba88a3241389", "value": 146565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631369924, "uuid": "329dd654-6ae2-4780-b5a5-074e2093ef4e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631369924, "uuid": "eda7bd3c-c7e2-414f-bc3a-e6dfa1c0800c", "value": "594ab17b7af4af68b6dbc3ff99c4306c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ad7ebc-1331-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1631386306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631386306, "uuid": "c3347eb8-0120-44cc-b984-53692f8858ce", "comment": "Malware payload (BitRAT)", "value": "0b06e7a995cd93d5843ff87752fdbd33", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631386306, "uuid": "c172a080-53e4-4669-ba1d-d86eee463c96", "comment": "Malware payload (BitRAT)", "value": "e3af8858c75afbcabaddb545a5db6f2b3f46926f77bf87a14b1dfd0a7a45d6c0", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631386306, "uuid": "2fc47bc1-b2d3-4341-b655-f88d0bb09fb0", "comment": "Malware payload (BitRAT)", "value": "908836c520f9748ea4111859f114b7fd4a10b1cb", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631386306, "uuid": "63e1c356-012f-46f3-a709-e100067758ef", "comment": "Malware payload (BitRAT)", "value": "a8bfc77283fd4362aef99af9f51e1275b59a6be76af445634498462c4fac9f63cece87fb69984f1b99f91faba9f3e1bf", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631386306, "uuid": "ad58c419-aa44-46a8-9049-50314f63e154", "value": "T1FD154AE69D4284F1E1221E3C99DAB6A47C7BBDD03D5DCD852ED53C0A1B37190392A22F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631386306, "uuid": "01b30a4d-0e5d-49af-8eb5-d10674ac7c3a", "value": "a6d91731528782b69b7e09d9c7278463", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631386306, "uuid": "ed872794-3a61-406c-9343-4fe43870d969", "value": "24576:F5Kjv76jPunXEigzMa0qZXOYb8JFjffNzGs3YUO11:F5KUPk5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631386306, "uuid": "2b1bb457-a894-4932-a47e-be1ce51bc014", "value": 933888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631386306, "uuid": "d38d8ee2-c2bd-4339-966e-a4fe7695ca60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631386306, "uuid": "ca35d3fd-62b3-40ba-951d-edc5b4dc37a1", "value": "Mvsgsrwoiahpjmjzemtpqydtliqlqqosom.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19acf72d-132e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Vjw0rm)", "timestamp": 1631384926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384926, "uuid": "a7dbafcf-88c9-4e24-8333-2ff97ac8b912", "comment": "Malware payload (Vjw0rm)", "value": "e42d34f7c318c8f4444331b58517a582", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384926, "uuid": "39bc6e75-73cb-472b-817f-82885f42dfc5", "comment": "Malware payload (Vjw0rm)", "value": "e4a7c3ccf07158984d50ebb1124663776ad95d9e857fea7eef5ce87eb9bc62f3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384926, "uuid": "8e3f70c0-4ea0-432e-b142-e1b3e087238b", "comment": "Malware payload (Vjw0rm)", "value": "083c8fa495b38c1509a267c1a07873caf914b57b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631384926, "uuid": "e1e5f6f4-8f38-4f07-a799-97e3af5312bb", "comment": "Malware payload (Vjw0rm)", "value": "0f01b49009fbfd437a9cec0c9e0df8c9dc60cdc5fdbf7b67636c7038cb57ba207348f73a3647be992175a01dc24acd6e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631384926, "uuid": "88b91ee7-1b19-4611-aba3-aeabb75eefb4", "value": "T113D2278D6C92F18DD911D0783A6F69C827F8A34BD44893CE791DB7448F22258C3ED6AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631384926, "uuid": "894031d7-0861-4020-9ae1-b26d12f5d7f6", "value": "768:FFmyIkgi9DUrXv3GXvLFvMerx88f55JDP6Ga6bj:azVrOXvZvMerx88fHJDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631384926, "uuid": "e9629458-b005-45c9-b8cf-75243b4d9b24", "value": 29485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631384926, "uuid": "5507cea4-9ba2-4f7d-ae1b-a86b17e868af", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631384926, "uuid": "49fc576a-fd7d-47ca-be95-3e80bb486a87", "value": "POS_1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eecb5805-12d9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631348776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631348776, "uuid": "28e4b14d-7c19-4bd8-8ccc-7ebbc1a26945", "comment": "Malware payload", "value": "5338c6f1fd81bbdfbe0127dc6e2676c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631348776, "uuid": "6c1e4f28-8aea-4a68-9dae-87b502ef90d5", "comment": "Malware payload", "value": "e4cf8390df0db1d1e0d703427544992d5e4622f44986350e5143ffdac25af20d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631348776, "uuid": "c5a75eec-3c97-4217-a5ae-18cf194a96bf", "comment": "Malware payload", "value": "5b332fd2cfc379db4c32d888ec560b059932dac6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631348776, "uuid": "5528e933-2fcb-4abd-ab45-c100a17ea203", "comment": "Malware payload", "value": "fbdecf7b9f8a1ff590516ea91e79cc730f5d87b809439509a0f03d8c792e4c6f430412b80cd2090c902be42835f65b16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631348776, "uuid": "31386b6c-2266-4631-b223-cdceb66e3074", "value": "T119A312A29EF9E656DC6246F0A518DEC7BB04FFBA1D4F894B05961CFE9BF34818420107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631348776, "uuid": "02995e88-a139-476c-ba4b-1465e61787ec", "value": "a50e815adb2cfe3e58d388c791946db8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631348776, "uuid": "e2db40b0-048f-4efc-b019-0fc205ca1719", "value": "1536:7ogJhX7rgSs9a4g1p7ck0qgEdWcDVMB8vAmbhWBLVTDVadyDfDXx/Ac:EKhITZaVR0qDdWkVMB8vAmbKYyDfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631348776, "uuid": "7e3d3139-b40e-41b3-bcc3-d004f9cfcd5d", "value": 98816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631348776, "uuid": "bd5eec34-724a-4e2f-a215-221ca4bc7817", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631348776, "uuid": "c9e77a7d-4bf8-4ad9-af29-06b85f683016", "value": "5338c6f1fd81bbdfbe0127dc6e2676c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bdfe871-1305-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1631367535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631367535, "uuid": "96be0db6-9de1-4b33-a1c3-424e95069167", "comment": "Malware payload (CobaltStrike)", "value": "5d3f6a7b3fe57c1934ed6edcb61e2580", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631367535, "uuid": "11f874ae-b8f8-41e6-ab5c-f3350f5ac0be", "comment": "Malware payload (CobaltStrike)", "value": "eaa3ee2a7f1b96d3c7502d7705fcb5c44b9381e393bdbb80d72971011a9747cf", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631367535, "uuid": "2a001b3d-e0a9-4f70-afb3-224159397fa6", "comment": "Malware payload (CobaltStrike)", "value": "26834152099f87f00f01c66626ec5fb096678198", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631367535, "uuid": "efb99468-7bef-4941-b7f9-b3a404c6461c", "comment": "Malware payload (CobaltStrike)", "value": "aeb0359807ac60d07cb0f57c4eacc988be90d790e286e32fc2946417d536ea5ce23f8e395de3dbac0f2b33b29f7d347f", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631367535, "uuid": "6a84af09-06d8-4ad5-97b6-f3fe4525f323", "value": "T1FC24D072394CDF25F531D17C385A94B53D8383F3F8EE4E9BA65F66DA02161188BB0289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631367535, "uuid": "71173c9a-5ed6-43be-95a1-82b0694ea71a", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631367535, "uuid": "4ea94a94-6d02-49ac-b976-1f539c762e19", "value": "3072:N8CqZr/cYcavUIZSiVsR//zcVh2h5Ma4T1Rle/LkcIcJmIma6LUwi+7xM3HmoBqs:7MuavKiurcMN4TIIsmnQBEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631367535, "uuid": "50fb45b3-8925-4c28-a4fe-7333e02c1b63", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631367535, "uuid": "f38b1d59-7c4e-44c4-baa9-04b48c72952e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631367535, "uuid": "d88b32be-0294-4c32-b313-b28129bd4a80", "value": "cs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c988aba5-12e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1631352149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352149, "uuid": "0afcdd54-bbf0-40c9-ba66-d1b4317bc418", "comment": "Malware payload (Gafgyt)", "value": "549c6eb1f259ade98610c6b80c87438e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352149, "uuid": "b18ecf5d-2572-4da3-b6fd-50d77cb3e9e4", "comment": "Malware payload (Gafgyt)", "value": "ed023987ac708e57f59729d28b3f4c32b5297c6c504a5225c0ffc9f4bf8b205a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352149, "uuid": "f17cc11c-b674-443c-9ed5-9ead12213e18", "comment": "Malware payload (Gafgyt)", "value": "4fdda5ed57c30ab0aee77302707c77886350db99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352149, "uuid": "10986f99-f846-4dc6-997d-b397d3fe8de2", "comment": "Malware payload (Gafgyt)", "value": "63f8f1cf0bfcc3823bc4200311aded5cde39f3eea3531f6816aa1be8926d8f2a70390e8d6200fd68b9d2ee34fce37440", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352149, "uuid": "77d84a04-7ef9-4ea8-97ba-63adc060b109", "value": "T1D5B33A0798615F77C045ADB529AB5530072BBA120F4F1F9AB57CAAF4074F8CEB40EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352149, "uuid": "70ab243c-ed61-4618-a523-0c1e9d67a115", "value": "3072:btTQn622oNI8zpUE5hLwtOCwLkY0Px9gQNfR:btc6Vs/UE5hLwtOLLkY0Px9gQNfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631352149, "uuid": "48cf4ca0-4e8a-48e2-82e7-fd58406931ed", "value": 108415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631352149, "uuid": "c795a1f4-98e7-4f38-b934-d047fa3df333", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352149, "uuid": "d7768c92-3d45-48bc-a722-b68125af1deb", "value": "549c6eb1f259ade98610c6b80c87438e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef9a8e7-134e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631398920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398920, "uuid": "133e22c3-777a-49c3-9fb7-1b663cdc1481", "comment": "Malware payload", "value": "0f10a2acefb700eaa9000dca04daff36", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398920, "uuid": "8be0f3b0-da13-40b0-afa6-26278f0c3fce", "comment": "Malware payload", "value": "ed5da3d36d9916a6082c34d4c523f7f73eceb390cd1d5df6de84202d4b99e10a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398920, "uuid": "d54349d3-051b-4609-a5ac-35b4b92873be", "comment": "Malware payload", "value": "d027c30fb446495408050e70bd0c33e39b03b3ec", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398920, "uuid": "a12194b4-2ed0-4e27-a84b-020c8e18acdf", "comment": "Malware payload", "value": "383e6f31fd441c17bec2f58552242884f8d1d6f6adf8f0e95c5ff0d5a2f28434a4a9def87e03f487b472212241019a10", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631398920, "uuid": "f0ee9848-eca9-4084-bb3f-eb39db76de4d", "value": "T168731AD6F703C7B3C80311F2119BAE6B4931BFBA1836DA4AE374BD64A6324D16112F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631398920, "uuid": "a4c91eb5-de25-478b-a6b9-2aa958a035d0", "value": "1536:x/Ig5r9UxMim9aFLrW0cNTAWtTUtW1xVra:b5r9UxrmD3NTAWtTUEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631398920, "uuid": "40da0771-5af5-4b3a-80e7-a146e4ca6f85", "value": 75000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631398920, "uuid": "a76a20d2-ba72-4cac-b152-156cb4c11a28", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631398920, "uuid": "1d44f5ac-59cd-4332-ace0-8f836e382138", "value": "I686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829f3f8c-12e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1631352889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352889, "uuid": "119acdea-51f1-4686-a513-f1999fcd8ed5", "comment": "Malware payload (AgentTesla)", "value": "da1ae3e242e4e8acfcef2d034ca5f871", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352889, "uuid": "2ea303dd-e36d-415c-99f4-c47fa0fff76c", "comment": "Malware payload (AgentTesla)", "value": "ee579953a0b2b6b9bb053704feed8436cd118cd94a4f60068499749df8b61050", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352889, "uuid": "38120a8e-33d6-43cd-8a8d-e4bc2dbb1c07", "comment": "Malware payload (AgentTesla)", "value": "11db4fb568fa3bbe4d9d5ee6acd8030451a219e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631352889, "uuid": "e9cb10c4-b11e-4954-be01-4168ede0b320", "comment": "Malware payload (AgentTesla)", "value": "1a77289d684c9ebacd9d17c50e0857cfb3aadeb2901ad4829562ba058eb85ac8bdea77edd264b7c45660f1e473444fdd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352889, "uuid": "c1fde398-d80c-4d7e-9277-bf39b889b513", "value": "T15E35DE7DAD9715B3DBA9B1BCD0D2694EE24628EB23316DE9C1E6B3CE2007543719630C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352889, "uuid": "42b0645f-5161-4668-aee4-0e76c50a507f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352889, "uuid": "591af2f6-f570-409a-90ac-d54b2c4707ea", "value": "12288:huF84DtPASSVdYiO5GpS4u6C5oWpf0y3k0Vb/AElj8iDxLBYR1p2Z3+Xf6Mei0DL:hRsQDqxfvu/oS0iqOGEDQ/Rl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631352889, "uuid": "15c629ba-fb0e-45b0-8a7e-806ee37d2047", "value": 1157632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631352889, "uuid": "7c4a621f-553a-489e-8f6d-00277db2122a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631352889, "uuid": "11c5abbf-e8bb-4f1d-88e5-72dbb652ac63", "value": "Document Copy_doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3641e39d-12ec-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1631356627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631356627, "uuid": "524ebb06-65d1-49bc-9fbf-62bb254c2cb7", "comment": "Malware payload (RedLineStealer)", "value": "6d4cb1408547671d88ff1988b449f286", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631356627, "uuid": "810c4699-5a78-439b-ada9-2a565470b6af", "comment": "Malware payload (RedLineStealer)", "value": "f2e367fb119960952c2ec2d59e1617f8653fd0e8ffb18a5d632cf5ffc1b521bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631356627, "uuid": "385742d3-2d41-412f-b78b-ab0770fdb893", "comment": "Malware payload (RedLineStealer)", "value": "063b69c7a034ff5065787c412c5ae21d3a965fc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631356627, "uuid": "1571754b-9f1c-46d8-86a0-324ec888e970", "comment": "Malware payload (RedLineStealer)", "value": "e10b7f942f3325b7e478e51909d0d3f6e41a7570a1fd613f0512696be302dd567ace1af0dce1c062063c805b47bdb7e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631356627, "uuid": "a7376735-e5db-4f30-a0e5-c003e0e3c00d", "value": "T186A4142864BFC01985E3EEA52EDCA8FBD99A55E3640C703701B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631356627, "uuid": "3d45f89b-5826-449a-992c-3d3226d81d1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631356627, "uuid": "81538ea9-33c8-48c9-aed0-42972ed67ea6", "value": "12288:fklT97scjSC3jh4/Iqi6orq7xwFoPMXmXf8Gmt3hiIA5BIF+/5PmU:63jhFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631356627, "uuid": "cc7e6269-7375-456d-b91e-d778d3515d96", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631356627, "uuid": "a45331cf-d5b7-4934-b81e-b79877ee281b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631356627, "uuid": "c2d1450f-ad30-4a46-ada4-800f01c968ae", "value": "Run.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0feb65f9-1303-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1631366441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366441, "uuid": "afd248e2-f8c3-42e7-b094-07273c15f312", "comment": "Malware payload (Gafgyt)", "value": "cc21e3ceb7d50551a4ce52c33111ad46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366441, "uuid": "db9ad5c2-57c4-4afe-ae23-dbbe493b1787", "comment": "Malware payload (Gafgyt)", "value": "f39a7c9bce3bad9868578474ab3fecfddee496bde52bb7de0a9b5b76ade7d016", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366441, "uuid": "172b28c1-d9bb-41ce-b381-9e560263c2bb", "comment": "Malware payload (Gafgyt)", "value": "4aa7ac344ed34e10c1abf5122a411bf26598b15a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366441, "uuid": "148389ae-2e32-4c13-b3c5-908593f6c6c0", "comment": "Malware payload (Gafgyt)", "value": "a411c7908456e7f588f8f4933e031f22c121984609deeefdf956c4736bd9c95effa069569f5530e20a00f2fc74b6e77f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366441, "uuid": "438e5bb2-99da-4ae1-bcf8-cf025dffd561", "value": "T194931A41F9408B27C2D227B7E78F439D37366A54A7DB330269257EB42BC279D2E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366441, "uuid": "475787a9-f94c-4f5b-821e-a6f576b62245", "value": "1536:EIkg9VQPAWeMTEb82Mm3xDKMsF0rOLcvZNPzRxQMpy2SjmokCmCVrQAFW9OXkYe:dQaMTDWWFGZNPX5SmCmCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631366441, "uuid": "631dddb9-3144-4acf-a891-4afe57b5cd86", "value": 97538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631366441, "uuid": "bfae063b-b24b-4256-8142-34a1bf1f0281", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366441, "uuid": "242887eb-a23e-4986-be13-c3a359b9ec92", "value": "cc21e3ceb7d50551a4ce52c33111ad46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9037943-1303-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1631366751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366751, "uuid": "4645c15f-0c17-4559-b459-e306b91b5fbb", "comment": "Malware payload (Gafgyt)", "value": "95990c7ccd71404cca66fe240082aa06", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366751, "uuid": "227ad651-4ac8-4738-bcf8-fb76c9f83645", "comment": "Malware payload (Gafgyt)", "value": "f4fab3043e272204dc85b19da724b88f33e2e023cc350cadaf5882a7532ea667", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366751, "uuid": "11abbfbc-d2d3-4ebe-8048-b1400735ca21", "comment": "Malware payload (Gafgyt)", "value": "24cfd3484a8374fcc8da4931ceab1c1a91b04e73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631366751, "uuid": "c8a077d1-aae2-42eb-b7a7-e99fd6a5715c", "comment": "Malware payload (Gafgyt)", "value": "27595365a292337a44201414397d962010d7fc27470a8454de8d135955c79328b6e9b1344ff17f0aaa2a7c51e95300b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366751, "uuid": "88882b93-c98a-4d5f-83af-d15537c35885", "value": "T134E32A09EA408B57C1E2277AF7CB424933339B64A7DB33095928ABF43FC27995E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366751, "uuid": "a23789dc-b3e1-4d5b-94c8-b1b0d827b2be", "value": "3072:fuNaNpF4uVN++dkhnxSQennF4M/9OD4bNWkE1kmpwfvRQfZn:mNaNpF4+NChnkQennCM/9ekmpwfvafZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631366751, "uuid": "6c593c83-69da-4bd8-8326-077f14d02a68", "value": 150385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631366751, "uuid": "d0120a7b-61a9-4d93-a993-3dd43ed9cf73", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631366751, "uuid": "498947f8-1aae-4243-b5d6-be8dd0574450", "value": "95990c7ccd71404cca66fe240082aa06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd89a77-134e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631398915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398915, "uuid": "81fe8f53-2a19-4c0b-bd34-91c859397fe3", "comment": "Malware payload", "value": "9490c4f408c306f43b35209e5237f4d0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398915, "uuid": "370ea384-42f4-4681-862b-fd581263e97d", "comment": "Malware payload", "value": "f6bd40d183df11dad433df4b844273eca3bf7056eea8d85bd157866d7de60450", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398915, "uuid": "95ce4a7c-d16d-45c6-9ab3-612dbc512984", "comment": "Malware payload", "value": "5e7c9b46aeff045020be0095bed109b7a7fe99e0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398915, "uuid": "6d84ff1d-b099-4733-a3e3-7cc5b29b1494", "comment": "Malware payload", "value": "37b0eab0e4e25f6d103b79da7761b54ac621be46fe2440b9ca83d3d7ef8b1f12e7f6d190e2e0d6c0699bb302a133aaf7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631398915, "uuid": "fc6b292d-57a9-4213-a67e-a27f188534c8", "value": "T181A31948F851971AC3E332BAEB5D514E32271FE8A3DB30259930BFA423F26E61535D25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631398915, "uuid": "a9ecc661-5112-46ad-b913-bc48317214bc", "value": "1536:ygn77+Rq4FTyy0RVagQFrJ7zGak5iCcdGieBkp33T3riO5uBO2zWhYNcKq:1q7cvaRrhiaCkp33T3uOoTiBKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631398915, "uuid": "ef80c9c1-526f-4d14-840c-3e20676bf061", "value": 103244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631398915, "uuid": "84bc38b5-1773-4196-9beb-37de348f3003", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631398915, "uuid": "b7bfa303-0f04-47f9-800e-8e56fbc6dc2a", "value": "ARMV6L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12bf7714-133c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631390927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631390927, "uuid": "6e474adc-7a1a-40f9-b9c5-29988ad869b7", "comment": "Malware payload", "value": "60d12d8cb455663f29c670436e19539b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631390927, "uuid": "29dc18eb-660e-4347-afc2-3da000f519fc", "comment": "Malware payload", "value": "f73aae62b00a5cc2dd5e1e484e25ff47ab8ab8c01ffd88e17a44779c1ea7699c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631390927, "uuid": "d7a71a83-95fb-4a50-a06d-52447cf48b3f", "comment": "Malware payload", "value": "610f0cf34c42ee57c9810e2e3392b4df3bda33eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631390927, "uuid": "13af47a5-c37f-4fff-a488-c80546927e86", "comment": "Malware payload", "value": "6f6a2b6404631f2150ba641671ddf513e51f0326b121277991862183a8483af1657be8065a27dc65416566873acc8031", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631390927, "uuid": "7408cb3d-135f-43a9-bc06-5f721cd0f4bc", "value": "T1A44533301C409441D22D86F38E7697078F791B6C60F049EF76E726BA88D85AECAF9347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631390927, "uuid": "d16b9c60-3427-480f-847c-ef8ff3e18774", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631390927, "uuid": "2fd05f5f-9522-4c29-9097-43a1a277533b", "value": "24576:+iZvHUN5bRaUG9VHlwx8m6xq+cDWhB9w2IOFeJBtC3+weLPFXui:+iZfOUUOlly8jxhcujVkBU3ALP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631390927, "uuid": "da70d3ef-ba4a-4bb0-898c-93be07508925", "value": 1167360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631390927, "uuid": "b7ec71c9-899f-4795-8c26-86aad279e316", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631390927, "uuid": "32d13b5d-551f-42e5-bc30-ea48708a4214", "value": "Cheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0b2466-134e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631398917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398917, "uuid": "9e996e8d-d46c-456d-83e6-7cb0bb4eace4", "comment": "Malware payload", "value": "1011362bead7f9e3b988cae78a16ae7c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398917, "uuid": "fde3e04c-faed-4f8b-b3a3-d9f1f5916d9d", "comment": "Malware payload", "value": "f968398a83b7f4e6e6ea789b2a4f81394ba140440ec022b451a2716613fa069c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398917, "uuid": "405d15af-55f5-468a-aa35-0c93460ab9cf", "comment": "Malware payload", "value": "28d59f226ed2512289dea90d06fe51dce18ae3ed", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631398917, "uuid": "af5cdbce-74df-499b-8b01-f2139f550f37", "comment": "Malware payload", "value": "2864ea3a6f2e5d0194bca88ff82f7b53ac7f64b935e38e3de560178b983bdb61e8fa7a251d9b4aa9315383606aea9ca9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631398917, "uuid": "cd02393b-2a48-4f4e-af31-23b3cef67ed3", "value": "T17193E744FD15971BC3D372F6EB5C068D3A3A1FE8A7E731269930BEA023F56D12525920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631398917, "uuid": "d4f3fbbe-8c19-4cda-80f7-927c15620153", "value": "1536:gbquFTGNCXWYaK4nLwH9XpW4yAyehsfWyOCOVXvU3V4obs:ITbmYOLwHC4oHWykEKobs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631398917, "uuid": "1c09c149-bfcf-4f7c-8a67-956bc79612c6", "value": 91856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631398917, "uuid": "85036cae-22d2-44b7-9b0e-5f84094abcf7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631398917, "uuid": "dbb4e0d3-a382-48b2-a78b-c327e52c06aa", "value": "ARMV4L", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0657f850-12c7-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631340655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631340655, "uuid": "6af7b9b7-7236-432b-9290-5e080742c37e", "comment": "Malware payload", "value": "9be0075b9344590b3cabf61c194db180", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631340655, "uuid": "e6d01b43-149e-45a5-b121-ec5f86136e0d", "comment": "Malware payload", "value": "fa8f807eaf7f442b57db4f7dec9666184cbcc65d0df0e17526f184ab724ab82b", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631340655, "uuid": "4d80cd35-e064-4ac0-8367-d06157f7d649", "comment": "Malware payload", "value": "ddd745506a83df003247825ea94e4584cb98504c", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631340655, "uuid": "7e70295a-41f6-401a-8750-624430612928", "comment": "Malware payload", "value": "de2c0a4a7aea7d3aa3c42d53a82915e272b95fcead3cc5b5b6dd67c608bffc5ace57b200d99181752fa9191666e5ee0c", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631340655, "uuid": "9be86aa4-f21b-4e95-9afe-ad0d284dbe57", "value": "T177C533F1D9493079D5EB663F393D6D85387E24CB9F408A1F3A19A3104821EDB6A87F18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631340655, "uuid": "03c154b5-84de-4cf1-938f-e47ebbee4ee5", "value": "49152:WLcFq4zYkNMDoLNE2h2OSzwz/3vuDk9/MA83fyuUyAIKwgo5/BV:gcPbxPhrSsz/339x83fZU6P5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631340655, "uuid": "20fe48d7-fa3f-429b-a0c6-bf4dcfaf8dce", "value": 2711508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631340655, "uuid": "c72141c8-0648-4915-a583-3fd53cec9d2d", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631340655, "uuid": "425ccd98-5a2f-4bcf-b4cc-b654399e8131", "value": "Rapid Change of Stablecoin (Protected).docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a5e553-1339-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631389959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631389959, "uuid": "ad7e9eab-fe9d-4b5c-a835-a0f202abf1cd", "comment": "Malware payload (Mirai)", "value": "636aa97c7ad46fed231b156e13c7ae8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631389959, "uuid": "138c2364-1e0e-4399-843a-9e75084e1118", "comment": "Malware payload (Mirai)", "value": "fb0e8e77a3603bc0ac1c610cba13b84310a7ac024eec30514b1e41ead3d6491d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631389959, "uuid": "6b965a13-fbac-44c5-b100-0d1ac953dcbe", "comment": "Malware payload (Mirai)", "value": "78fae6ca4aa7f634284dad64877065ae806f387c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631389959, "uuid": "9289f6df-48ad-4fb3-9fec-cca089ddbd94", "comment": "Malware payload (Mirai)", "value": "880a1c4f6b59ad8450380431eb3555a484eb9d51c698da629fa9e82bb1a67da247bdf7cf11e18b9d34b1afcde45cd0b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631389959, "uuid": "07b361b8-91fd-40a8-b8cf-cbc7560c933e", "value": "T12A534A25B9BA2E23C4D5A47A11FB4B15B6A157CA32B4C61E3D721F8EFF116406803EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631389959, "uuid": "0769da88-3e87-4dbe-a74f-e4dc71655e2a", "value": "768:kuBoadnzUXnfIapq9/Gd5yWisU1yf5f3M7CgDEBg6zO+ENaJIsn:vBtnzUXnfIapS/Gd5yWxU1y53M7oHvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631389959, "uuid": "5fe1cf2f-84f9-4212-b292-27ec0a6e7e99", "value": 64352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631389959, "uuid": "eaf457fd-ef39-4bf1-b2ea-6156c585a28c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631389959, "uuid": "f3b2c2a0-9b1e-4623-a0c7-c26214172321", "value": "636aa97c7ad46fed231b156e13c7ae8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b24492b-12c4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1631339536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631339536, "uuid": "96d7d06e-de8a-47b2-bc5b-5e570b620b60", "comment": "Malware payload (RedLineStealer)", "value": "f752040c5645a94432ce9fd6aeb0e04d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631339536, "uuid": "7b507bab-c8b1-44ab-b8b0-830d8dc5b3e5", "comment": "Malware payload (RedLineStealer)", "value": "fc40949e683c9024184a97d697f9f18494aaff1d0d524a070c47661a786e4e7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631339536, "uuid": "c06cec1a-aee2-4e26-b417-3653d2155f31", "comment": "Malware payload (RedLineStealer)", "value": "f07481217cee08253a5ac4999eeec96cf3d6df7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631339536, "uuid": "ecc9780b-4868-487d-8d89-913bfd719243", "comment": "Malware payload (RedLineStealer)", "value": "695bf613a18fc5dcf5534525e249a71b846a8898592eb636e82a7495f8d814a1b6d7c3ceee7516f65307890536f2d33b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631339536, "uuid": "40608f88-5463-400e-995e-a37be3e95e28", "value": "T121F5C06A6161C5AEE50400B0DA41FCEC9D537DB884A8056E30DA752FBA6F7538CDFC8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631339536, "uuid": "d073a5e6-eaa2-41cb-932d-c558259761a8", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631339536, "uuid": "6fe246fb-622a-4e0f-a63c-e3ef1a95af80", "value": "98304:Rnv7FSG5AhUh76MOK4fsIlyrbR9CkNrL6NpFQBfpQSg:5F+hUh54fJgnR9u7FQBfVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631339536, "uuid": "81071027-d1cc-4219-9581-d11472bd7be7", "value": 3556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631339536, "uuid": "08f487b8-589d-465b-be2a-6004063f3764", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631339536, "uuid": "6834808d-410c-4c11-85e9-46f234ce8cd6", "value": "f752040c5645a94432ce9fd6aeb0e04d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7453898a-12ef-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631358019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631358019, "uuid": "b5ab35ca-6d4b-41a4-8afd-acb67167c918", "comment": "Malware payload", "value": "8ee1081cdb755f8bdc9c6bc19d44bee4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631358019, "uuid": "a44c5994-c269-45de-a4fa-aaa367710f55", "comment": "Malware payload", "value": "fc6f922a95f8c286ca88a750910e3b81544f93c628b85656e4be0cee78eea086", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631358019, "uuid": "eb865ec7-7bbd-498d-bbda-397743763612", "comment": "Malware payload", "value": "49ae23ba5d02f16b62c291ea6d42016c0e684eca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631358019, "uuid": "c186c845-9965-48c9-8476-7972353f2377", "comment": "Malware payload", "value": "d0afb74475e64415de3aefb65b031a348043a2fb0c7dafa4ad21f2dae75e7a114037c5c68ac3cedfe534ba9b4cf68198", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631358019, "uuid": "91e000ea-4098-48fd-aa5e-fe42ee2300ca", "value": "T1D7726C2DA7C8C7B5DCFE1E758CB603420A72C35B99A2BB6549C8C2959FA334106E3771", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631358019, "uuid": "f7783cf1-bde4-4793-845c-19b091bca3d8", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631358019, "uuid": "2699ae13-0cd7-44ed-841d-2b0e9c62003c", "value": "192:SeUXS1d8tKqlY+b8jbNFVROBhevBvtyE1XQyIW1vRYle0NTPuRRmdBXuySd:IC1mtxlY8u7uhevvjXQ8mleJE0yK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631358019, "uuid": "eb33a650-eadd-4af9-a86b-4ab7d74ba240", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631358019, "uuid": "431132bc-459b-4866-bee8-14c5b82f65a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631358019, "uuid": "a4585eb8-80e1-447c-93d3-95a5f116ace5", "value": "8ee1081cdb755f8bdc9c6bc19d44bee4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c63df36-12d5-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631346678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346678, "uuid": "d0e61529-f4b8-416b-b486-4c65d9178b96", "comment": "Malware payload", "value": "1b7a6aadd6da69544aadee4057b2a415", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346678, "uuid": "c5fd947a-a77c-4909-bb23-4255f2dc9211", "comment": "Malware payload", "value": "fca8a3b741242dff4e66deb713bcc278ad1da6ff219fcae1b98ea23f3640e9ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346678, "uuid": "954d8165-0c35-4d80-81fb-8f115768e1a6", "comment": "Malware payload", "value": "4a7e3435dc2013c4ca0564867d5598f403163dcf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631346678, "uuid": "3d17b180-d62d-4510-bc45-f75d9a2ce6fd", "comment": "Malware payload", "value": "0957d786056aeee2b4893bc9be2982216a307647788669a3db8f48628ee001826f886309494ad55541ee1d72e20040a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346678, "uuid": "7eb194c6-0fb5-454f-877e-dc7ad14e7eea", "value": "T1F5E48C3769FA0C05F55A09B00480B330D2B61D96798E8CC3DA8D7A5AD137BEA70DE56F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346678, "uuid": "e1a18e3a-1d88-42b3-9f66-f7de5a8d1abb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346678, "uuid": "f7e1c67c-1859-4dd1-942f-7e8eb083dc10", "value": "12288:ssaLQ5GXw8xMN7XiDAU5yGLKlf4EO1q+Ao56Nfwic:uQkCUALGLMcpAo0Nfw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631346678, "uuid": "46b98e9d-e614-42d2-aa6f-a64821192a17", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631346678, "uuid": "ba20438e-a727-44f3-b91d-a80c679e357f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631346678, "uuid": "379242c8-12bb-4e4f-9154-4e336faf5006", "value": "1b7a6aadd6da69544aadee4057b2a415", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e824c1c7-1345-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631395151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631395151, "uuid": "9b62dc06-a4c4-424a-a4bf-96d4f945d443", "comment": "Malware payload", "value": "e7caf25de7ce463a6f22ecb8689389ad", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631395151, "uuid": "946893c1-0e57-44cd-9b3e-1d73cca54215", "comment": "Malware payload", "value": "fe1a734019f0dc714bd3360e2369853ea97c02f108afe963769318934470967b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631395151, "uuid": "1c92bd1f-dc1f-4572-aed9-d9c558f19e8e", "comment": "Malware payload", "value": "16b3487022b674040227afc8979ffedd2f70b67e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631395151, "uuid": "61eb4870-576d-422f-bf9b-81a970a856e3", "comment": "Malware payload", "value": "3398f3af0b86def807d129bf33f32132b48512abae12dc8b4d9a6dca587f36fd56396af2dff02062ce9f9dc47808ac91", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631395151, "uuid": "54d49200-4fdf-46bf-9358-12076ae383a3", "value": "T12755AE8AF718A62FC87741324AB6077252434D46A983DB471A69B21C5DBBDC04F9BFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631395151, "uuid": "5bd42ab4-f4e8-4d8e-9e33-39ff7481cdc0", "value": "24576:bQkx+GHuZtL0GCmrc9sUEX6bZ5fFmYZuoayaPx153g2Ap6RrexakZu1:6ZtFzrqBGiZRFzZuxjPx1hg2AYRre8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631395151, "uuid": "43eba0f3-f093-4b42-b891-eab900ce7557", "value": 1337147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631395151, "uuid": "29cab2e9-a4b9-4c35-aa50-dbd65d772ae9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631395151, "uuid": "85c60ceb-c900-436c-829e-f9252b1f9fd0", "value": "KISA Mobile Security.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b67bfb-1337-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1631388860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631388860, "uuid": "8686bdcd-cff6-4b1d-946c-708057c13034", "comment": "Malware payload (Mirai)", "value": "416717a74d51ca6a2c1e146dd8d94602", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631388860, "uuid": "c021e0b2-1536-4e64-b716-8b1d96e9ab5e", "comment": "Malware payload (Mirai)", "value": "fef244ab331430e7aa42a53d964a101798ada8af9908779ef01ba34d1fb2b37f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631388860, "uuid": "9d36be55-ec15-4622-bc17-61c105fe7b14", "comment": "Malware payload (Mirai)", "value": "31ac7a53317b8db8ff4ff791d09fe802c7db6740", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631388860, "uuid": "2ed225ff-f9bb-4740-a59d-581eb5299d36", "comment": "Malware payload (Mirai)", "value": "5ca1bdf632255e32fc3e15da4016be13c97430337570647519197fef2e79e84ef2676e5a5ff409013657cd8cdc2a8a1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631388860, "uuid": "d26d4613-3342-493f-8f92-fbc291dde821", "value": "T1CE733B95F4018E7CF88FEABE50254E09FD2163805B930F2BA6B7FDA32D631955D02D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631388860, "uuid": "8220a25b-1657-47e2-acb7-1bbe27526313", "value": "1536:kCkOYTfDdV2KaPpc0OCmg6dEPGsDLIn/8gXIDIWtvqjc2Q:kC4V29pb3WvXj5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631388860, "uuid": "1337d56d-50ef-4aea-80fc-31361043b445", "value": 73948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631388860, "uuid": "e0263718-c7ee-4933-9f8f-786de33d2d95", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631388860, "uuid": "3c440ede-c313-45f3-b3fb-f897fa06bd4b", "value": "416717a74d51ca6a2c1e146dd8d94602", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68793bcd-12aa-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1631328364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1631328364, "uuid": "c76a69a8-25b9-4e43-9708-6603f029b3a5", "comment": "Malware payload", "value": "e3894640f59c6c6cb903283b58c10643", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1631328364, "uuid": "533edbc9-c6b0-4da1-92f7-4381d6ab28d3", "comment": "Malware payload", "value": "ff3ac54c998fe747b7e438c4021d0f87495437e347e4f54c83ebb51d8d7e4aa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1631328364, "uuid": "d2b0ed83-c1aa-45e5-a6b7-833d7965d064", "comment": "Malware payload", "value": "5aac0d8c895a48710a4f5728f6042676bafd86bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1631328364, "uuid": "60562563-4256-4134-98d3-2154646804b8", "comment": "Malware payload", "value": "ead799d38fcacc4299768b8e3ce11aec961fee55d0ef4c6fe31997bf7dfc5e083a78b18be23f1151beb3f863b0d08ecf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1631328364, "uuid": "6e722730-7652-4805-bd8d-c454557ba469", "value": "T1C7B68C0377F90194E1B396389AB24152EA73BC555B38C6EF11AA524E5F73EE08D39323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1631328364, "uuid": "8cf48fc3-4ac4-4eb0-afba-93365b249c22", "value": "2b1ae11ec9968601c8cbc262fb77ef9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1631328364, "uuid": "a73c7d09-a0d4-4ee0-beab-b2cfbeeb4d1e", "value": "196608:P21Kxo1KreSiIkG2534Tczr8Pu8WgLiZdjf7N/c/CB:O1co1Krehjxzr8PL/Li/7N/SCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1631328364, "uuid": "a6697402-bfa4-449b-ad95-8ebf0be7805a", "value": 11332032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1631328364, "uuid": "db3e4aaf-2775-4849-83eb-4a4ab054f181", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1631328364, "uuid": "ba7b874b-4110-4fa3-9630-11628d233b31", "value": "HitmanPro_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }