{ "Event": { "published": true, "date": "2023-09-30", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-09-30", "timestamp": 1696118581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "7f11ac3f-c6fb-4570-b869-d0fba0dcfe92", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e05480-5f95-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696080567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080567, "uuid": "bb05ddc5-6f1c-4bc0-af65-635580248de6", "comment": "Malware payload", "value": "c87a69fde5dc59c228d78d8dc11d5788", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080567, "uuid": "2436a668-0f1e-4eb2-9028-7ca0e76e965f", "comment": "Malware payload", "value": "010159e4a1eee83dc163d2d8e11393886df14e698dcd07ea3728443d16fb64b6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080567, "uuid": "f3a11457-4c1d-4058-b720-17dcab9de0a9", "comment": "Malware payload", "value": "8af101db80bf7d4157b07ebd4b215294fd9b5b82", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080567, "uuid": "b6fa6fe9-7f75-4c11-8f39-9072449de351", "comment": "Malware payload", "value": "75da9a7a5942275bbc7abe9634d214faf700c794c2cb9b964fb5f22e4dbc4aaafe11d4d73703d842d816510d388df849", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080567, "uuid": "5693b775-ddac-4ff9-91a6-f7aed09ef3d2", "value": "T1C7A533603199DAF9CD231232954758CDFA932E7A301D768F85D4FF1D1E326A48A3E14E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080567, "uuid": "4ce00e30-0620-4668-b02f-05eabd4d8d42", "value": "0860544db319215145a2beb3591aa351", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080567, "uuid": "960fcab4-428a-427d-ade5-2edcbad1b8f1", "value": "49152:af1XfG1JKmVCCXO6FNrd2iObzsksKuYZfKkzr:afxfoJK45NvMiObzsksKzKkzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696080567, "uuid": "047b8fd6-646d-40d0-930b-68ee0afef5a7", "value": 2121357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696080567, "uuid": "65adfcc1-7123-4969-b773-4000b52cdc2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080567, "uuid": "6404dfac-7762-415b-8a79-90c3eaf0f944", "value": "SecuriteInfo.com.Trojan.Generic.31438111.10980.7326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4df77f5-5f41-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696044657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044657, "uuid": "15687d52-fddb-4045-bbd9-2664f51438fb", "comment": "Malware payload (RedLineStealer)", "value": "5658f79541070a0e9cb7aefb079d5b0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044657, "uuid": "9a445f9e-e3e4-4391-ab2c-61900ba8d26f", "comment": "Malware payload (RedLineStealer)", "value": "01c599527dc62eba8ba0acb2b70450dedb1892efb9bfa57dac69394df43a6728", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044657, "uuid": "e10b93df-0d1e-455d-a0c6-105ca4a26c2e", "comment": "Malware payload (RedLineStealer)", "value": "8c5dab81f88a94ad3ba7bf465c4484566f2d6c6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044657, "uuid": "29a8857d-fe47-4680-b09f-a084c16ecb3a", "comment": "Malware payload (RedLineStealer)", "value": "81af83f6ee3f90b0c81d5ac054e445994d61e23361f6d0351ccebe33f6964edc725d02f73da954a7cf3e33c3d330e635", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044657, "uuid": "e8788130-221e-46dd-ad07-75edd481fc37", "value": "T1AC35231567C56065CDF11BB00CFA03C31A31BDA2AA7C976F7B9AA95E0C33558893373A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044657, "uuid": "0cf38fb9-0ed9-44f1-b9f4-cf1265a118dc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044657, "uuid": "45b9830e-39e4-4273-82b5-ea516d309568", "value": "24576:8yT32gm1kuznBPN8clPvR9Jrb0mEPtYV3BglCi48bbpGbTkG4:rT32gqkuznBOclPhrb4KQC38bbpG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696044657, "uuid": "b9bb4b6f-f51b-4a26-b1fb-2ea9fca9a634", "value": 1099264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696044657, "uuid": "1c50428b-7da2-4bff-92c9-67e311c56083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044657, "uuid": "58bdc5e0-f38b-4946-9320-114d9f47f289", "value": "5658f79541070a0e9cb7aefb079d5b0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12918d3d-5fb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696095468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095468, "uuid": "d6781abc-bdd8-462a-93c2-3a2b9234b0d8", "comment": "Malware payload", "value": "a57eb1d65bfa3b416dc4b741184c2463", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095468, "uuid": "e175b143-8960-43b2-a3a4-39a3d387b217", "comment": "Malware payload", "value": "034fa11e0c8ac78fe39779a867f6f7189304b9a376ff16a0b51aea1cbb3c419d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095468, "uuid": "9a2c2cf6-b283-4f4d-bc23-c1af0438c9b2", "comment": "Malware payload", "value": "53b5b285959e756e085733046baea304922bb327", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095468, "uuid": "bbe0a317-ba27-4c8f-8d83-e3aa4cc38006", "comment": "Malware payload", "value": "b95918c2a57607facbb924a5baa9decfdaa55f71d662a17c1456c457bd52aca0dc36ac7868ca95d649ef93d20d982a45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095468, "uuid": "fb400798-0542-4ca1-9dcd-c1fc97e80a83", "value": "T11BB53352B7FA8673ED675731C6D83BE060F597282B3188E76384E85C4A3CE8694384D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095468, "uuid": "044e8cdd-8640-48ad-92ee-0ed3fc4a32bf", "value": "1d0e3506c01cb61e9312cbea4911e92e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095468, "uuid": "362483f3-0f5e-447a-9109-b890b7080684", "value": "49152:Wf44thgJTb0aVfsTehAh1+QKjCMG1Hsv4H8+tZOLEK2jzpeY:WZhY/0aVOZBs+G4H8ODK2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696095468, "uuid": "a14b25da-1219-475c-92ff-4cb753ebe9cd", "value": 2329437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696095468, "uuid": "fc72975b-f2fb-4b65-b4d4-bf0b7e736284", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095468, "uuid": "65c41e13-b19e-4dcf-8d35-537818a560db", "value": "SecuriteInfo.com.Win32.TrojanX-gen.9132.1932", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac12453-5f34-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696038949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696038949, "uuid": "f43782fe-d884-4c32-9e1f-3978cbfb3c1f", "comment": "Malware payload (Amadey)", "value": "08230b01834cd97b7ca1025fd1307a02", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696038949, "uuid": "f69e4ab0-b3f2-43bd-8578-095b92b58add", "comment": "Malware payload (Amadey)", "value": "0385cb1d807663acfb195e6dec3dcf4d76d47e60b130f007d2577c2e0ac91210", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696038949, "uuid": "8b1fea9a-7816-4165-b753-43de129c45ca", "comment": "Malware payload (Amadey)", "value": "ce63edae54e4b9239241683140fc30f4d0c652b5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696038949, "uuid": "46e327eb-04dc-4048-937d-7f3ead6b939b", "comment": "Malware payload (Amadey)", "value": "8e5861ad7925ea4effeea9123289154c1f6af044da513e9f1851d26e9922d78cde626932b64e69d8212b936ea242a9b9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696038949, "uuid": "32e78f1a-1571-4d70-af71-8582e3a360eb", "value": "T1DA2408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696038949, "uuid": "dbe44aed-2b86-495d-8cd7-eea84b6ccd44", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696038949, "uuid": "a61163b1-296b-435d-bf5e-e1a58eca98ac", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696038949, "uuid": "c618739a-c351-4fcd-b8e7-ec5680a9937f", "value": 224257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696038949, "uuid": "85684f24-85a9-4d30-8998-9eea20a7b5eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696038949, "uuid": "eb59b89c-12bc-41d0-a73a-d4bb8a2ed980", "value": "08230b01834cd97b7ca1025fd1307a02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "807642ce-5faf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696091787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091787, "uuid": "9c0d2536-68dd-4775-985f-4c6870ed1a4c", "comment": "Malware payload (Mirai)", "value": "de740b41c1a7f91c4a6c7186f997d46c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091787, "uuid": "16f52da0-cb66-440f-8ad7-a1ee8402d774", "comment": "Malware payload (Mirai)", "value": "04678ae045baad53b95d38b7867276bd9fff12cf22be585808813d050275d44a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091787, "uuid": "53c71069-fd56-4fc1-8533-fba9ecb761ce", "comment": "Malware payload (Mirai)", "value": "cda286716993fc81026b288a7b45c47b9dc4a93f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091787, "uuid": "b7e8aad3-890b-470c-9ee0-6c38424bd152", "comment": "Malware payload (Mirai)", "value": "af3dcae8015fd05132783fa613ba50a5a643f85988e6f765e1bf2104808ae1c597f1980150532ce800964e3b6b04be1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091787, "uuid": "307f5337-5bc1-4ae0-82ed-d3ddc5b8357c", "value": "T186534BC8A5C3E4F5EC001D79307AABB1AA77F53F2035ED9BE39E25639942203E10169D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091787, "uuid": "8f3f3502-6eed-4464-bfd5-1cb119c08e1b", "value": "1536:b5VYYpXIqVkxmxRvXMFnKia1jGKO18Hq6PW9m1Tb0+j/KUAm9Y:diYpROxmxhXMFnKl9GHCHqshb5/eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696091787, "uuid": "272e5d01-139f-4eb9-a4f3-737e07043e4f", "value": 63664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696091787, "uuid": "16c97d3d-fc95-4f9f-a05f-538e8d7734cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091787, "uuid": "59eff722-2895-4f90-b88a-55240e62f711", "value": "de740b41c1a7f91c4a6c7186f997d46c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26cca363-5f7c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696069732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696069732, "uuid": "4c1caa90-8a6a-415f-ae9f-74fb72a2b211", "comment": "Malware payload (MysticStealer)", "value": "46b0457f7e053ba665f3796bb34784c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696069732, "uuid": "73a01b90-15ce-430e-a793-aff8b6b078aa", "comment": "Malware payload (MysticStealer)", "value": "04f7b54aba4cf9f836cac0d6252fd12903e44116d6b65ea9b24250503aadc0ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696069732, "uuid": "2ec9705c-bdab-4237-b712-5c609f1cb2b5", "comment": "Malware payload (MysticStealer)", "value": "2401b09b21b1d4efdb3291bf6af3e1890e73f119", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696069732, "uuid": "b47c83b8-68bf-4638-97fb-44e1ed2638a8", "comment": "Malware payload (MysticStealer)", "value": "930e11835ce46b96b9cce922ba067e58ccbbcaef2de9e9c904e589c8a74a635cee8b3bdcb67f9f00d0cff6c4b631a3f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696069732, "uuid": "1d60f5fc-b95a-4aa5-8833-a830d5cd484e", "value": "T11174AE12B1C0C031D9A2563A06D4D3B53E3EF9700976D99B53A90B6F7FF0D82DA225A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696069732, "uuid": "8b900165-1c7d-4b4f-ba33-15c650b2c705", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696069732, "uuid": "9dde5e27-1912-4303-8476-a948418eeb97", "value": "6144:wtTeW/s5GqrO5aXnfEGIXWPvZAOlysHEuaIUPpMmonMfWYnGpjDAQt6Vs0BC+:FmcGqrOk86xbRUPumonBgqTIs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696069732, "uuid": "67370fa1-84fb-4212-ac72-36512549f1f4", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696069732, "uuid": "f6f4aabe-7695-4409-b802-b473cf510e44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696069732, "uuid": "faf488e0-9995-4ca1-8ec3-421bf00b5eef", "value": "SecuriteInfo.com.Trojan.Inject4.61510.17840.26193", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11cadfa1-5fb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696095467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095467, "uuid": "64140890-620a-4670-9976-e59ccab1fc82", "comment": "Malware payload (RedLineStealer)", "value": "0c670a6fb6fb76a3503eec73a832f9d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095467, "uuid": "af53eee6-2c1a-41ea-9fb9-da50edf562cb", "comment": "Malware payload (RedLineStealer)", "value": "06406efaeae44a51b4cef183940a9e20e62377c6f4206e2342d694be0e81c1d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095467, "uuid": "dd095e16-0ee4-4b40-a7fc-60c99e19db23", "comment": "Malware payload (RedLineStealer)", "value": "7f9ab1f57171e95d96867596ed56a5ba20827ec5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095467, "uuid": "5c238e94-617b-4291-85e8-b339de26371d", "comment": "Malware payload (RedLineStealer)", "value": "f96528cf84b82f3b4fb8cf5869b3b7da2018750f694403cc07048ea5121dd4bccc68c314591b5a0e5a8aafba167f1acf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095467, "uuid": "37e8e71f-4d94-4aeb-9949-b90393d19751", "value": "T1E8F3BF1535C0C072ED661D3509A0EBB18A7EFD343FA09E9F6B880B787EB01D09A75967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095467, "uuid": "8f35470a-6890-4654-aabb-d6134aa48061", "value": "5b961e24b82512d2a00ac6c970dad1c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095467, "uuid": "a3f8ad25-c3c6-41be-b810-9e98ac1ade14", "value": "3072:WhfUo9owo7h0BEYmbuw16GVuiIPMoC7TQVHMz/ISZS4Wfzj:WhM8iOBEBbx6GxoGjZYrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696095467, "uuid": "c1f9f6d9-3946-44a9-bb15-b0afcd4e3e42", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696095467, "uuid": "d167f7e9-7070-412d-b8dc-b9a2bd8465b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095467, "uuid": "418daf02-6a26-49ef-ad1a-b3937ff11cd6", "value": "SecuriteInfo.com.Win32.PWSX-gen.28315.7841", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96fc3476-5f8c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696076792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696076792, "uuid": "a7c46f76-a9a8-4d12-9385-1dda55970de7", "comment": "Malware payload (Stealc)", "value": "c53e0be5be43b742c96f2a090ea45cfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696076792, "uuid": "b99c09d7-2866-427c-ad7f-9e05f3fff0c7", "comment": "Malware payload (Stealc)", "value": "06e1305185cf729ed8711bb7b6d5ac195e90185237b5c14cefd747323e5b6461", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696076792, "uuid": "a40349a2-e583-4c6c-911e-fc1d3cc02734", "comment": "Malware payload (Stealc)", "value": "f23eb4a0c020f09590196f40ef3e475cdd9e15db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696076792, "uuid": "5839fefa-dcc2-457d-944e-c5588223cc2e", "comment": "Malware payload (Stealc)", "value": "7c20ce0077ba4f7d825503c573c55bc1a6387d7b9c4a7977a27992e76c5f433ca8b1af0ac1e110be29c81c096e6e670b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696076792, "uuid": "99970aa6-eec0-4f30-963c-a979b0425788", "value": "T14086560752AC9349D061927841850E459771E449CFE27AC73EE01CBAEE93DE9CB7E3E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696076792, "uuid": "ff81fc94-50ef-4992-997f-948e78ae855f", "value": "d1f4b8ce9bdb9ae4af083a2f1237565c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696076792, "uuid": "b891d6d3-de42-40ce-947a-57c09fa32373", "value": "49152:Mo6gcCn4Yk28KNRYbqTxpKyzU0JJ6cuu1Fb52/1aNQ2grVcgWVAi9Iu:+wn4k/l7KaU2J8haa1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696076792, "uuid": "3f7bbadf-3079-44c7-bf5d-2cad47862890", "value": 8269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696076792, "uuid": "4e60d15e-d1f0-40fa-952d-224c55a2b618", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696076792, "uuid": "29ea13ba-9156-434f-939d-0e7ba390351a", "value": "c53e0be5be43b742c96f2a090ea45cfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a0eaad-5f27-11ee-a6f9-42010a9c0055", "comment": "Malware payload (N-W0rm)", "timestamp": 1696033545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033545, "uuid": "4e88bc70-67e6-4d24-8d86-2ec2b33b637e", "comment": "Malware payload (N-W0rm)", "value": "aff324f3e525fdc1319eb59bfbe6070f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033545, "uuid": "03d42b9f-83f0-4c04-8cfe-ad21f07c2eea", "comment": "Malware payload (N-W0rm)", "value": "07e1f86467312719495e4012046076cda9333c0fa8a739f32f066dbcb65bdba8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033545, "uuid": "963c350a-5e37-4baa-bac1-e9e2253556c5", "comment": "Malware payload (N-W0rm)", "value": "179eed2af94554b5b67086f354e66cee4a6cd44c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033545, "uuid": "2c89b091-406c-4816-b29d-7ef2f5fb4734", "comment": "Malware payload (N-W0rm)", "value": "d857ba5330763c202eb6c42cec586ba797797d5ea0615c3001f2c7585800b143ebf17ba0e9e4251e01ee12389a5237ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696033545, "uuid": "ff36b58e-d248-4080-8987-bd21a313a6b0", "value": "T1CD349D11B5D1C432D57315310AE4DBBA6A3EB9A00B629EEF63980F7E4F243C2D631667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696033545, "uuid": "1e6f0e86-113e-47de-956a-c21fbd23598b", "value": "dc563239367bde3bd3527a2dc91eeac9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696033545, "uuid": "4e476c19-d96d-4286-ae6b-3a7fe7cb4a95", "value": "3072:7NTDE5Mno95B0Z4tu6pxdJKnyqx/doHzaGLnaVRZiTyaUDeAg0FujDqVwzKm0PYp:7O5frpxdonyq4zaG2u5AOyeKnOIquqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696033545, "uuid": "fae615d5-68ae-4e41-b53d-f30e3adfa310", "value": 246136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696033545, "uuid": "01f41032-a8c4-4b19-a55b-e431c94d1182", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696033545, "uuid": "9d884d33-c2f4-40c7-8c79-ebd9609274d2", "value": "aff324f3e525fdc1319eb59bfbe6070f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d5e236-5f31-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696037458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696037458, "uuid": "8bd1b8ad-fd90-4c55-a274-2b7cc7f7bc30", "comment": "Malware payload", "value": "8986ba6c34531e6eb853e01dbf3f5084", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696037458, "uuid": "4e4303e6-9b6b-4074-a100-a61194661ad4", "comment": "Malware payload", "value": "088c8f0e3190144e9f10d5f100a713310b8cd52c0c1804f677e9e82afd302323", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696037458, "uuid": "4f6da07c-5f8b-4f2a-a634-344bb5d65aa7", "comment": "Malware payload", "value": "4a63d1a3d58c4256bf442817d0f5038557736b13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696037458, "uuid": "01d67e7b-8c39-4867-8b43-cd05c6ce8256", "comment": "Malware payload", "value": "f9ddd13223c5fa752a355c49809d06ef572b4a292627af7c84795c1c7e59f8bcbfa86fed6e4ed577822a1e9865dab025", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696037458, "uuid": "299e22b5-dd41-42be-a429-c09126adfee5", "value": "T181B53322B2D584F5FA0254314EA077B559F8E2A10F2122C72B54AF0D1F7CE8AE13F59E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696037458, "uuid": "37defe58-16d1-480c-b859-da455bfdc402", "value": "1d0e3506c01cb61e9312cbea4911e92e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696037458, "uuid": "1b59e41d-5b06-457e-94cb-ea0a1cdcfe62", "value": "49152:WfzvkMOkbrVOzU+kXUJovDefvXTq9qHmTPQcpdAZ2rr:Wrv13brkVoDeXT0JPQPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696037458, "uuid": "5812b58c-0ddc-4827-bfc8-ccda8615da12", "value": 2296410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696037458, "uuid": "7f34f3d1-633e-4f85-a655-c43bd037ea64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696037458, "uuid": "1ced4c57-736d-4930-99a7-4ca699015f7a", "value": "SecuriteInfo.com.Win32.TrojanX-gen.1255.8062", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0274ba36-5f31-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696037459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696037459, "uuid": "dd010ccc-b6b7-4ed7-8932-e5ab836d91cf", "comment": "Malware payload (Amadey)", "value": "5192f4dfc4fb4ee5aee4561ca9870719", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696037459, "uuid": "464def11-a766-4d43-9879-f27756638350", "comment": "Malware payload (Amadey)", "value": "092d0937db9697a18d9ba9aa02733bde9ba777af97b46bba0f0c290f7cc9a37b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696037459, "uuid": "86f35d5b-d4b1-4c0c-9cf0-75167e468e95", "comment": "Malware payload (Amadey)", "value": "63eb41b4f2303c82d1fb852110259027eaafbb40", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696037459, "uuid": "927d9393-0c60-4438-b05b-6a731ed1e6b0", "comment": "Malware payload (Amadey)", "value": "2af6da70a532e0c252afa63a3b3607b1d8a1befbef16aece8095090dc2c86e2fc91ba4eeca76b32a60afe7e1de7a62d7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696037459, "uuid": "63f792e9-45f5-4ad3-b4da-eb2ce494a7c3", "value": "T11334BF1174E2C472DC7215360AE4DBB95A3DBD3009965EAF67E80F7E8F32280D631A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696037459, "uuid": "92fdcd16-6b4a-4024-b10e-c7ccdcd918ab", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696037459, "uuid": "ba85f12e-88cc-415e-9d18-2556e932a8ba", "value": "6144:+3z4SHy5uoBMFGV5PEkIXEHvZAOYcOro+gmVs0BC+:LCmuoBMUOMxyc2o9us0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696037459, "uuid": "d3fb3526-dc18-4fc1-876a-19bed2a05c88", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696037459, "uuid": "be92a2e5-0858-4f66-bcb8-7853f68f731e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696037459, "uuid": "d417a8c3-9b2c-4e05-a0f6-971e33943a7d", "value": "SecuriteInfo.com.Trojan.Inject4.61510.21187.12771", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2eb758d-5f9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696084597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084597, "uuid": "ff829cc4-365a-46dc-a0a5-5b8ea00f4a0a", "comment": "Malware payload (RedLineStealer)", "value": "78f63571bbb9a593485bb31bb2a9b824", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084597, "uuid": "91c8840c-fe6b-4ebb-9847-51edf2531df5", "comment": "Malware payload (RedLineStealer)", "value": "0987959a896c0c455707dd7b40742d6fb745475426875ecf9f795b9eb8d40964", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084597, "uuid": "e6d0b904-8432-4d03-b852-43997e9551ee", "comment": "Malware payload (RedLineStealer)", "value": "fb51c8f1f22f3b1d8952e9741aa0312d6cf156ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084597, "uuid": "7fd1eee6-3ac7-4d0a-9a00-ef8f1abe8599", "comment": "Malware payload (RedLineStealer)", "value": "7754af439ceb3dbdb5b665d70618f4d694df23a359226b24474e119af8e4868c74148862af92f6b4c60223a198a04f40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084597, "uuid": "6f5e70aa-6951-4df2-8bf7-0888ba20b598", "value": "T16C25221AFBE45013DDF90B7448F703830B72B9614D78936F2749978A0DB29C5A43AB6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084597, "uuid": "20ef5fc9-c3fc-4f6e-a73a-de78c42878b0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084597, "uuid": "a612a645-aa18-4cb0-bfc0-252b8cef5b30", "value": "24576:by74zbkeDvVu+lV97p33EiCvfHb1hcZp:OkbkeDvw+j97pnElU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696084597, "uuid": "17243470-6527-48db-8050-4e372621096b", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696084597, "uuid": "7a2d50e5-e42a-4f86-a38d-6e7ec2d0e03f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084597, "uuid": "0f16b015-1463-4503-91c4-d4a0f32acffc", "value": "78f63571bbb9a593485bb31bb2a9b824.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921d6399-5f41-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696044572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044572, "uuid": "1c1198f3-9cb1-4b21-9bfa-cb88230c3cbc", "comment": "Malware payload (Amadey)", "value": "7a9bf186be30f645dc11f7988ee5a751", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044572, "uuid": "a7d57d9e-b8e1-409e-834d-dc80112cdf10", "comment": "Malware payload (Amadey)", "value": "0b6ecf57e03839b8806319ac290d818a01f11ecf43064914c5ec649c8af700fb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044572, "uuid": "2c026802-89e6-4a31-92f8-cedbc51b1106", "comment": "Malware payload (Amadey)", "value": "23327214033ac8514aad9e965e9bad64bf99a73b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044572, "uuid": "5d64cabe-93af-47fc-8a53-c6e6d63be0ec", "comment": "Malware payload (Amadey)", "value": "437b68cc1a86ed688aae2b379f55777ae92cfdc3022a614e3a6e88a5b0f5acd3c4329c207ec745a42b01428fe8984f53", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044572, "uuid": "1aaa58a1-734b-43e9-a8f9-0b131a52b782", "value": "T1A934AF3174D1C072DC72A5360AE4DBB95A3EB97009A25EAF63E40F7F4F24281D621A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044572, "uuid": "c2774b3c-b404-40a8-9e76-17bb060e4d6e", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044572, "uuid": "3fdf813b-0122-4531-99fa-171f58d53620", "value": "6144:6zz4SHy5uoBMFGV5PEkIXEHvZAOjBVT8ITkVs0BC+:nCmuoBMUOMxZBVT1cs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696044572, "uuid": "ce1f9b7e-7873-43d2-8320-49e3c1c480b8", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696044572, "uuid": "4b412220-8b54-48ec-961c-c45ece38d7a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044572, "uuid": "34f783d2-4cca-404e-8a52-3b6b76fa3c83", "value": "SecuriteInfo.com.Trojan.Inject4.61510.5025.30434", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "731c8b7b-5f47-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696047097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696047097, "uuid": "9125f352-eb43-4b19-be7e-94a843e9abe4", "comment": "Malware payload (Smoke Loader)", "value": "f9fb604944887bb2d8f1e799c7013ac7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696047097, "uuid": "f973dbf2-b026-498a-96fa-db3fcc0b13cd", "comment": "Malware payload (Smoke Loader)", "value": "0e13c6b6934ae51a0f8b2082e5cde777d75093e105275c1422d702d9ba336d23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696047097, "uuid": "4f49f838-e9e2-4180-9a38-eac986bb06f2", "comment": "Malware payload (Smoke Loader)", "value": "0275a21881e76ea821e8e25465f7ea4c63d5bc7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696047097, "uuid": "baa62569-4d6c-41c8-82cf-cd4d57b98fca", "comment": "Malware payload (Smoke Loader)", "value": "235a39bf94dcacb50dfea140e7604f00d1932c32a73667885bdd89a1adb4e871b9953df0278c191b82224aa1cf222f0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696047097, "uuid": "89ca4576-80d9-496e-b63f-90d7a7505fb4", "value": "T1E3348E1AE2D2ACA1D52746318D2FC7E47A6FB4628F792F6B221C7E1F08701B1D263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696047097, "uuid": "f1113a0e-0ef9-4883-9bd5-a815ed5349de", "value": "a59b93a815ea9713a41e16c8d0248e4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696047097, "uuid": "8081bec0-1cb8-49fd-a4ca-448faabf6f1c", "value": "3072:2Xr2S3w+ac2dbZUyQ029WSGBuT26vhaMMlClxA6528eqhfYTpp:eyd+qdbZUy6WLkTJMgloefYTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696047097, "uuid": "de430e9c-2c2b-47b1-bf3a-484e59538311", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696047097, "uuid": "5b585fa0-37bd-49d4-865f-25e9612a4a83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696047097, "uuid": "5a1bccdd-cf24-4e54-ac1a-202994371ea1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531ab0c5-5f6a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696062076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696062076, "uuid": "2ef914fa-c59c-44ec-b208-7164e33a2ecf", "comment": "Malware payload (Amadey)", "value": "a1551c35af55dc867e46cdd3460bdb6d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696062076, "uuid": "8e7d9f0b-094d-4ff4-ba53-51ab0b0d4bb5", "comment": "Malware payload (Amadey)", "value": "0edfbd81b926c0078063c474e5515e1480b38e8ed9ae650d6a9444f7d43db64e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696062076, "uuid": "5a7c36b1-418c-423e-8534-82f1685e7302", "comment": "Malware payload (Amadey)", "value": "567b931e5cc6cb02ef22b130eb5ba54a40f2c245", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696062076, "uuid": "c389f25b-271c-4cf1-ae74-d233a16ba69b", "comment": "Malware payload (Amadey)", "value": "26616458f97e5a2dc09365d0e9843b736e550ec8630227cfac71f6d71eecfc7faec223653baf1bd652b8f6931ef24e45", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696062076, "uuid": "9e0573ff-85d3-4bf3-ac8f-7daf8f1424c3", "value": "T101352227BBE98433E8B14B7054FA46C30B357CF288B4467A3740A85A8DE3785B476767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696062076, "uuid": "8b2a5395-2718-4191-895b-b52b7e83af01", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696062076, "uuid": "dff435ee-b4c9-454d-add1-f2892fbfe7e1", "value": "24576:Hy4pnGm2tCRB+ui31vHrLIACSlLpVyIeWrg7vhfCF:S4pG5CvGLLB/8m04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696062076, "uuid": "a648aa6c-cf69-4f13-86d6-fc321ede6746", "value": 1099264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696062076, "uuid": "c6f59a86-6654-4585-b7be-204093565ced", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696062076, "uuid": "62653b4a-ae54-4bfa-81f0-c11bf86a77a0", "value": "a1551c35af55dc867e46cdd3460bdb6d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559a95ee-5fc5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696101164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696101164, "uuid": "d180c7cc-43b2-422e-80c3-24fa0170d8a0", "comment": "Malware payload", "value": "524945f720f989f7b04c058bb877d40a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696101164, "uuid": "528358f2-de3f-402f-8acc-a16af157d15e", "comment": "Malware payload", "value": "10cfb9e17b5bd1204298a805db3b1d30a746571f115ce7b23264a7539c94594d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696101164, "uuid": "2fb92963-2b0b-4127-bad4-1ba99a6a5e8a", "comment": "Malware payload", "value": "1927fbdc344e5d9d05de32f8b0ea3859c595f699", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696101164, "uuid": "f21e25bd-a1ec-4534-8f5a-e5496f5041ec", "comment": "Malware payload", "value": "13fbfee919be16edd8d6b2d0c7e2af3d096e4a47e23a7c7994e4dc073df6a31c95bfb69d4e9e41644ad09cc10c201fbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696101164, "uuid": "19667302-ae13-4e42-a323-2b9f7026efd1", "value": "T16C248D2362F1BC51F967A7728E3EC6E47A3EB451CF59675A3218566F08703F2C262312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696101164, "uuid": "5892c388-5e9f-46e5-a627-e63f4f14d659", "value": "d323d1063364fcdde3ec2d7fc616011e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696101164, "uuid": "e04b6b78-ceed-4895-8763-e4c244957e1f", "value": "3072:W/guyRtCPKPYJ2xRd9mo0iUDVEkgxm55/8lEsgx:WnPKPYJ2vfmYUD7SSKEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696101164, "uuid": "9c9d079f-23e1-41cf-8771-bc2461c4c93b", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696101164, "uuid": "431667e4-6213-4dc1-85dd-89d4e26cc0e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696101164, "uuid": "fc2c0e83-f5e8-4237-a288-74d08ffa2f15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad2918a-5f95-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696080557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080557, "uuid": "78369c48-83ea-40a8-8503-015d82bcea28", "comment": "Malware payload (Amadey)", "value": "ed0daa729fbd59adcacdbc8cd66f4959", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080557, "uuid": "595af34b-5ffb-4d26-84a3-dfa657582a96", "comment": "Malware payload (Amadey)", "value": "11e98e0b256fc3a8640aecfab5d1c7e01c6d5b39a1b01665980e14936d64236a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080557, "uuid": "755b7535-bc90-4cf0-9997-4b41f7085e4e", "comment": "Malware payload (Amadey)", "value": "beaf57035e2e71a376d8d6c488f1c1c70584573b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080557, "uuid": "606fcaf9-0937-42e6-889c-c66fec7b2589", "comment": "Malware payload (Amadey)", "value": "08c946c1075e47e13e4740b61243bf1fba90588202483713184fae3583482598272626ee296a4e89c8c06d5ee7f65dae", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080557, "uuid": "d6a9945e-71e1-4b03-b2c8-2257bfbe32a2", "value": "T12734AF11B4E1C072DF7225363AE4DBB95A3DB8F009955AAF67E40F7E4F20380D621A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080557, "uuid": "78dde703-7785-4066-85d6-6605f5dde8d3", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080557, "uuid": "a5a58254-25f1-412b-9be1-230541af5df3", "value": "6144:1iz4SHy5uoBMFGV5PEkIXEHvZAO6oiVs0BC+:LCmuoBMUOMxHas0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696080557, "uuid": "2f09a8eb-c5f0-4df7-856a-36579aee312b", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696080557, "uuid": "582969fe-84c5-4b76-8d2c-97ea22ec2a54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080557, "uuid": "3c127767-4aa2-43c0-8212-78003d4a48ec", "value": "SecuriteInfo.com.Trojan.Inject4.61510.14948.24513", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9e29d1-5fb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696095458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095458, "uuid": "5602fece-b98e-4c09-961b-226c8176ee37", "comment": "Malware payload", "value": "a23175a581bcf8050a55a2c61f104fc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095458, "uuid": "2c94df0e-dda3-4afd-a2dc-1546698be891", "comment": "Malware payload", "value": "11efa80610e8329ccc455e097a84d225ac8bd49126a062ba9506d38e9a6374ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095458, "uuid": "5716215a-6893-4d2d-955d-a5ae0af70082", "comment": "Malware payload", "value": "732859c109f4de9a3bd0a7929102cdfcc3faf223", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095458, "uuid": "4efa0eb9-344a-4e0a-9526-82441d9aa064", "comment": "Malware payload", "value": "b7e7169af817d9ad810e9f7c508ca9b2666d8911e25198dc3799b728f2d7cb54f43f3441b9a836b344c0e797645deafa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095458, "uuid": "7d1d552a-3636-4324-8b67-89b614cc1ad1", "value": "T109458E4BEA4390D1D74F26322663133F3F70DA477E309AEB92A5DD68AF626615D33210", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095458, "uuid": "eff7c061-d0e3-41c7-952f-449fb098cb7f", "value": "6144:0NJ+YFN7nxQc10OJcnNXi5LvfPmCCasa+CvbSFwk06eD3l9zw7oSNHrzqFf9Crzx:0NJ+EQcInYDfzCasXw+aP1mcqHrwXBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696095458, "uuid": "5a62a18f-ea0a-440b-9f10-554ec0d90d48", "value": 1208320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696095458, "uuid": "e818539f-b28e-4e50-873a-733dc23477bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095458, "uuid": "1ca77113-b96a-4fc7-be48-5651db5adb3c", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1TYMTF4.1154.32474", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d25556f-5f67-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696060804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060804, "uuid": "c77dfd3a-6367-4869-bced-97dea848b6a8", "comment": "Malware payload (Mirai)", "value": "b4e998a1d0450f8fbc3b6e623a4b1236", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060804, "uuid": "79e1fae8-995e-4d46-bd0e-63f02a8dfada", "comment": "Malware payload (Mirai)", "value": "1227223d5d0f5faf4e524e195e445c5d908141efc3d63bc76053ad27ed244942", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060804, "uuid": "cb753262-284f-4bc0-a025-19a14553750c", "comment": "Malware payload (Mirai)", "value": "796b44e545f36bbd386a8a8e72bf4e3421c18ffd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060804, "uuid": "57f6075f-1104-4fbe-a180-e84385cab5b6", "comment": "Malware payload (Mirai)", "value": "9edcb4d9ec0c70c2b5d89f24ee9c3867329b2314204fc25fac74eefb77d56330b4df0194e0b7386d08eae701599ee50e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696060804, "uuid": "441d4cf8-62c5-4272-84e5-3750282bef7f", "value": "T166A2D059BF1886CBC832693855E9E6D21253FCA1F2DDCC4A2A40C15FF5B33A96434F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696060804, "uuid": "bb1b735b-1c79-485f-a903-2b7764f58b41", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaHhib+502F2vwA9dWuMW21bAK1oTD:798o08kxofBE+ZkXaEbp2F2TWul0c5Qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696060804, "uuid": "fb1d52f5-a9b3-4aca-b293-37bf3b21e441", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696060804, "uuid": "f44a246a-0e46-4fdd-a906-c62bba6491b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696060804, "uuid": "e0a9e2c5-dd02-4953-bd0b-679dc3b992a3", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab48357b-5f4d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696049768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696049768, "uuid": "baf0c88c-6fba-43a5-8fa0-a204e19086f6", "comment": "Malware payload (Amadey)", "value": "2bb673d7b9c1f5dec5914b54316286c5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696049768, "uuid": "e8d50e00-005d-4ec5-b7a0-15fd3640a0fe", "comment": "Malware payload (Amadey)", "value": "12c2e508f514233c5b2ff05f7f6dc27e21ec947a6ea033e144e7db6044d98699", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696049768, "uuid": "296a95d0-22c4-46b2-9d8e-35120ea59f07", "comment": "Malware payload (Amadey)", "value": "f1c0205af04426008d3d445b1e80296f9bf27644", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696049768, "uuid": "a352a106-d564-4245-ad41-54454dfff887", "comment": "Malware payload (Amadey)", "value": "6021bc0fdae97f4e19f39a09644a52fa286b43d4a8aa17e3cf8f078a7bccd544635f4708ac1d76070bdec1050d42398b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696049768, "uuid": "b3a13a19-73f3-4a01-acd4-b7594db2564b", "value": "T19D35232263E05963DC6B63B008FB12935A36BDB0947497623346DD8B4CB32B4B976377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696049768, "uuid": "83c8edba-140b-4690-8fcb-a5ce7c73e2c5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696049768, "uuid": "cd17d9f8-5e83-488b-a788-7d1c28a9c175", "value": "24576:9yAARdwU4Ug4M40HtkJgCXaBfiXe9dshOqAqgoPE3xLAFD:YKUvv0H6kZiXTh4qgogA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696049768, "uuid": "e1fc0136-d5ee-4270-8d3d-67543a272f93", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696049768, "uuid": "9d1991ab-06af-4046-8f29-93b7c89fa0ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696049768, "uuid": "87caccad-1577-4992-a5dd-f843abbbbb2d", "value": "2bb673d7b9c1f5dec5914b54316286c5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c8ab8e-5f38-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696040501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040501, "uuid": "c03c88f6-63a5-4f57-a3c4-cbc5fd528a3a", "comment": "Malware payload (Stealc)", "value": "02c0527b5d7ae4a6e5fb3176b3edef66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040501, "uuid": "60c9c03e-625a-4186-9e98-ff59ad16a72e", "comment": "Malware payload (Stealc)", "value": "1310c11b53ad451a8222bd308be8d809e6e8969c3ab298892825b69308e95177", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040501, "uuid": "855afce6-dd50-4995-aa27-7594b851d92f", "comment": "Malware payload (Stealc)", "value": "68126e598273ccc5629c0485b3791a19bb69fc69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040501, "uuid": "b18b29a4-7bc0-463d-a765-abd5962fd994", "comment": "Malware payload (Stealc)", "value": "4daee9abb09a2bf2c3e7c3ad8745bf8da8cee687630ac054029b99dd0b53eb33cbc71645e7ca1110e59372d53351e5ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040501, "uuid": "45637d15-7525-48a9-a3a1-954f41dac5e7", "value": "T1EE349E0A62E1ACA1DB674A718D2EC7E4367FB4614F792F7B23185E2F18709B1C263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040501, "uuid": "f5afa637-1a98-46ce-b57c-26c98cfcba5d", "value": "a59b93a815ea9713a41e16c8d0248e4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040501, "uuid": "5c9936cc-7568-4148-96f2-d4f199a5b34e", "value": "3072:wXr4k+rXnUqEzmeA7BdPUdRQ0ziSXy63FTyWl65286qFGYTkp:k0kqnJEa7BudViUFTyWTV0GYTk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696040501, "uuid": "9897535e-1d81-4c66-8dc6-aae4029c7fb6", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696040501, "uuid": "6d0dd57f-0c47-4c96-b446-2e7745791f33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040501, "uuid": "a15a1a11-263f-4ad2-a3b4-1fd704e7ce59", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072205eb-5fa9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696089006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696089006, "uuid": "77590bce-5ce0-4b6f-bf21-d4feb89976de", "comment": "Malware payload", "value": "e03b29d27413c2e5be50b4dc1871b60d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696089006, "uuid": "d42f1562-fce6-4acd-8b14-01c1030fdaf9", "comment": "Malware payload", "value": "14551f460a5841d26ef2feb14ba8aa0c7207f83b33a8ce77ab9f3df01da8b5b4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696089006, "uuid": "ce1991e7-156a-408c-994d-4657ce5f2922", "comment": "Malware payload", "value": "67486253d623f378a5fd8214edeb4d0bb9ca0eb4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696089006, "uuid": "5b4f958a-0010-4d38-ac1b-f26f3061eee3", "comment": "Malware payload", "value": "2dc6845e802527fa40808ebb01bdf90fa19a85d5be80ba5a6628cdf3b116f56969d209c4e8194add0b6151a2eccc8b22", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696089006, "uuid": "b01fa01f-a069-454d-82cb-a22599e3b0dc", "value": "T140463B03F85191E8C1EED13086269293BA717C985F3123D33B61FBB92B76BD46A79314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696089006, "uuid": "621756eb-26f9-409c-845c-6158c71d2458", "value": "49152:0O6z2mRWL396rb/TWvO90d7HjmAFd4A64nsfJ6jVboGYeMMmHUM3SppPVWzjpJkA:RPcEMMdNSn9EZdgEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696089006, "uuid": "297babb6-67b4-4e84-8fd7-b8700aae1fd5", "value": 5496832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696089006, "uuid": "3edf8460-6b95-468c-82be-09b7f5093810", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696089006, "uuid": "bfb17f79-dd06-4aee-816a-b49e35345ed5", "value": "SXkmarwet7vghj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76d850c-5f9d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696084202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084202, "uuid": "e0a97a0f-78ab-4a46-a669-4a18c4094790", "comment": "Malware payload (Smoke Loader)", "value": "d5292955f46b473ff62846a4106a504c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084202, "uuid": "ce4fe4ad-1101-4703-b9e6-2d5bdf4b6f78", "comment": "Malware payload (Smoke Loader)", "value": "14a5e51f0ed1c1116de4d58c8e667cb95d4ef4a3b3c8b1d2c2c9eca99b5e16af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084202, "uuid": "aad2ce06-d296-430c-8251-2124432262b7", "comment": "Malware payload (Smoke Loader)", "value": "38dd9ce415ff29a2c09ffacd60477372b3dffe32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084202, "uuid": "046a221d-7174-49c2-8245-e32afd89d222", "comment": "Malware payload (Smoke Loader)", "value": "a4f1a0bf0c2ffa09477fa9a06b7a329ddc122eb1e1fed3a93e1d282c282c77f1dd515bfed5e49e0940319a5ab419eb23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084202, "uuid": "83a804e9-3eef-4d09-a378-ba6939d0a20e", "value": "T1BEF3C01675C0C072ED661D3509A0EFB19A3DFC740F909E8FA7880A7BAEA02D0D635977", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084202, "uuid": "9c6adab3-1c4b-4f60-b753-6b5ddc69b4ac", "value": "5b961e24b82512d2a00ac6c970dad1c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084202, "uuid": "1cfe0d25-27e1-426d-aeb5-e368122d4511", "value": "3072:WhOUozowo7h0BEYmbuw16GVuiIPMoClTrx0iVC4aw9LlKfzj:Wh5iiOBEBbx6GjXxbFdlKrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696084202, "uuid": "3eda3389-02b3-41db-81b8-6677ee1d94de", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696084202, "uuid": "151b2c60-fa31-47ac-a6df-3b9d0e0aaea4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084202, "uuid": "aca6b6ea-5179-420b-af7a-a65993dfc125", "value": "SecuriteInfo.com.Variant.Lazy.397537.29059.19696", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd2003c8-5fd0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696106116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696106116, "uuid": "ebe8a6b1-81ea-419f-9a1d-92b1ad3cd6aa", "comment": "Malware payload (RedLineStealer)", "value": "0c454fe19ab58bcbe05e0eaf0f9e5fbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696106116, "uuid": "ea407143-d9df-4a01-83e0-aa254c13c12c", "comment": "Malware payload (RedLineStealer)", "value": "14bad67ec2245532fb26c134659092a5e7adf11ee36b7db070b5540d74ecf619", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696106116, "uuid": "67331832-28b5-4ce7-b543-bce3721620e0", "comment": "Malware payload (RedLineStealer)", "value": "803982af280ca1691caaeaf85f67f1855fe44561", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696106116, "uuid": "4daae960-7c6a-43f9-a1db-fedddd6a1eef", "comment": "Malware payload (RedLineStealer)", "value": "1b627e425e878a987d9444eda7a73d6e77d8f435bdfc148446b9258866cacdb1b91705021f258003334dce6a0c03aa85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696106116, "uuid": "4c23b25a-c11a-42a1-9f78-c735b795733b", "value": "T1CC04E758364BA97EC96F487D9C700CD0767CACA71246A7079C8EF4E87A3B7819B050F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696106116, "uuid": "d275939a-2b76-43f4-85ed-740b01df7de1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696106116, "uuid": "c86e7e35-d609-4cf5-93b8-def9345547a8", "value": "3072:OHIoRDFDI0V7bCnOW0Sa01yTzEPN2wCDEE0aWcjqRLF0lJZ8e8hk:IIsDI0V7bCbsEE0LdRLF0lv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696106116, "uuid": "a5df99e0-3469-467f-95b3-8ca471c1bd08", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696106116, "uuid": "f0c3da76-3560-44d1-8b64-b2b471f538b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696106116, "uuid": "e290c157-ac74-4b41-a07a-5795ee35761b", "value": "0c454fe19ab58bcbe05e0eaf0f9e5fbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff0e62b2-5fdd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696111756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696111756, "uuid": "d38106ec-8e1c-4fbb-a553-5941131fd9a6", "comment": "Malware payload", "value": "8cec8da3bda33b1200b5fd2292c6e62c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696111756, "uuid": "2d18ae84-c2bb-4910-8f0a-c21dd3de354e", "comment": "Malware payload", "value": "14f12ce7401d5053a66773e6700addad23fc1d4e64bddabbc445ab198e477647", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696111756, "uuid": "45a562cc-6519-410d-a8ca-832de5512b5a", "comment": "Malware payload", "value": "c0f8fd0e784d1fd50ea38a72c1900532bbe2814a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696111756, "uuid": "f55ad9e9-a648-470b-a75d-993880217801", "comment": "Malware payload", "value": "cdc16d3c2f1e9547989b80a11077f9a918e7c099b41c0db9d26c9daaf035b5441c98d03a1cc9da6bb9f938617a01e382", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696111756, "uuid": "1d4dd927-2e2a-4906-9265-99bd3f4bad04", "value": "T1BB940113EBE99032D8B51BB058FB03C70B35BCA26D7896963744A85D5CB3780A87573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696111756, "uuid": "67f51e04-0c4a-4943-b5f0-38274be8ac2e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696111756, "uuid": "dd093529-1bb0-45c1-a549-0f09a29d2524", "value": "6144:K8y+bnr+tp0yN90QEPAYwyWLwAWN7ayGG5cP+a1JMl5rfz4TC6cc48J8EYWQbM:YMrxy905YyWXejpkHgz4TVrTYrM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696111756, "uuid": "d83e4076-dd2f-4b29-bab4-101d79ee8c0e", "value": 437248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696111756, "uuid": "19dc12be-0d35-4e94-be83-4e751a109309", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696111756, "uuid": "ca82da47-485f-4374-9f8f-a76a51d7a0e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c26747-5fe2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696113620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696113620, "uuid": "f8432a54-22c1-4481-8d24-694231a489a4", "comment": "Malware payload", "value": "08bf22b628d2d45a58729066ce816f67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696113620, "uuid": "0e0de9a6-690a-477e-a46d-d8d860538b6a", "comment": "Malware payload", "value": "16121eb930d81eee0431e69bb50a4010cf981fd3b9046b67fef83dffc574e895", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696113620, "uuid": "bb9f0a0a-1bef-4db6-84ec-44c039568da3", "comment": "Malware payload", "value": "b8b97963b381bc090c7713976a68f2b1ef88b2a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696113620, "uuid": "02dbfea1-5186-4f90-9f3a-a6a4f2d5ee63", "comment": "Malware payload", "value": "a9f91198b8850e2c01fea800ae805d5372f87d7357b002e066ff776bb2057ce06fb4656ba0250e0c600f952ccca3c9e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696113620, "uuid": "53f64e12-b709-461e-aeba-9c8f3a59df01", "value": "T197349E2262E0BC61E5676A324E2EC5F8362EF852FF54675B32286B5F14711F3D263342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696113620, "uuid": "8f745c2c-c5df-4e88-af77-a518f7e130ec", "value": "eb89aa3fcf43b156dad667e281a2675a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696113620, "uuid": "706b04bb-8b85-4611-9995-f7b8118fdcaf", "value": "3072:BftRpD4qonwCgGrxvFgxcHCUaZtS0S5/yATO3U:jLoZx9gxuAt0yATN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696113620, "uuid": "159e0bfe-64e4-41cd-ad14-8895408e3d32", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696113620, "uuid": "66abbeed-e1eb-44c5-bd77-961c699aeab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696113620, "uuid": "dd2a6f06-832c-46dd-84d5-0dcc645a20d7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63faf029-5fed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696118368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696118368, "uuid": "779f3f06-88af-44f4-b5a9-9c26ca82764f", "comment": "Malware payload", "value": "e11fa23f4f55462eb00c60ae54649f64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696118368, "uuid": "13eeca65-2279-4873-b636-998274a93241", "comment": "Malware payload", "value": "174824e8237a4103c1040af42714e6c9da30a3b67228ed5c3fd4a0ccf3a7fdfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696118368, "uuid": "878e7109-2438-47bc-bc3b-6d96b132ee9a", "comment": "Malware payload", "value": "f9e71ab81ce8c4d84ad3ee324270ff09e99d695c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696118368, "uuid": "6497c721-222d-4718-83e9-8a0d6fa8d33e", "comment": "Malware payload", "value": "4fc0e78c4bf3a836876665e9577c864cc800e603c75a688cfa9180dda9cd3826ff5fd973b62acec5cbb7075528bd0dd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696118368, "uuid": "5f5e0a7a-e144-4aaf-a665-fbfa365fc1d3", "value": "T1B354E142E7E89432D9B617B058F603831F367DB29D74936B2782694E1CB26C0A47277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696118368, "uuid": "c27150a5-6229-4202-8d6c-67c91a064702", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696118368, "uuid": "2d1c55c2-0787-45d0-aab0-ac040a90c7b8", "value": "6144:KGy+bnr+Zp0yN90QEBo9la28pE+GmOAdkRA+U/8fB3xo+/:mMr1y90U9lw1GmORlxdxo+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696118368, "uuid": "f120ee14-9537-406f-b45f-235a02e3f741", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696118368, "uuid": "80ddd805-e59d-4365-99c4-e0ac4949713c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696118368, "uuid": "549d449c-5dcb-42df-a7d7-c0c1c4bbb692", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "061b126b-5fb6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696094588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696094588, "uuid": "2ad20462-7a9d-463e-be1a-cfa513d53f48", "comment": "Malware payload", "value": "c49d6b18ccca97a8f0b67e527658c995", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696094588, "uuid": "198f0c71-0f86-4e6e-8b37-523e390e9f93", "comment": "Malware payload", "value": "17c2a49e17ba835fefe7fbe7197ddd47e2757d803a1b4c820bed4ebc021cd280", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696094588, "uuid": "f22a609d-78de-4053-94ef-e63ebaadaf57", "comment": "Malware payload", "value": "405b2f675344d4e742a4647343d9b93c485cc05e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696094588, "uuid": "cc0cd9c2-ebab-40db-b448-8fcb53bdc81e", "comment": "Malware payload", "value": "976d4dee2e8c8cfbf0abb7b282076366cc073842f9e074d6d84e38670f69ffe0916354eb3aea3fee261f29f7997c0ecd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696094588, "uuid": "c6b00f24-8f83-46d9-815f-863db1403513", "value": "T1E8248D2362E17D71F5676A728E2EC6E83A2EB410DF55679E3214566F18702F2C2E3312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696094588, "uuid": "a165a559-0029-4208-9779-d24fadca0443", "value": "d323d1063364fcdde3ec2d7fc616011e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696094588, "uuid": "15fcf38e-16c9-492b-a5d4-dee394f33da5", "value": "3072:b+BRCIR/L6g2ZkRfJd72vAVtLpnYkV1cD29Aq55/r8M8LYJ:SZLCyNJdJVtLpnYs1c9+wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696094588, "uuid": "14fdbfda-0100-430d-9f4e-8e932681bee3", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696094588, "uuid": "82b77a90-9051-4067-bc32-db0d10a85818", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696094588, "uuid": "fde7243c-05f4-4172-8ea4-6ff64f57b662", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec2735a-5fb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696092160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092160, "uuid": "93748c3c-8df8-4d46-8573-a87c266d92cb", "comment": "Malware payload (Mirai)", "value": "f150b954946f9d5bbda6239a41b7f2f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092160, "uuid": "fddf4b77-f933-45fa-92c4-f1d574532500", "comment": "Malware payload (Mirai)", "value": "18b6b1c8df66892c1cf06e8db38a436ceac3a4659f763ee70eec9ea1a5a230bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092160, "uuid": "ac29eafd-c44d-4c99-88fe-ed0032a45283", "comment": "Malware payload (Mirai)", "value": "9e9d77b4622c1b81c48955f773751fd478087199", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092160, "uuid": "b7ebc03b-c2fa-47f3-aeaa-6b2a02686156", "comment": "Malware payload (Mirai)", "value": "c7d904be3e06126446c7caec159a093acc14f456c52df9f4d758331f572f997f772781031164f6ac5683d17b2bb9e5e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092160, "uuid": "9a488ce7-161b-48d9-87a4-71b547b930d3", "value": "T110730986BC409E10C6C50777FA2F218E3307579DF2DE7252CE155BB47B8B81B0E2A65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092160, "uuid": "5728ac9d-6b8a-4c4d-bc54-f0a1eecba2b3", "value": "1536:Cynh7o8MhxiuZYTSuuKsEaCTlT74J70qNdi5EAzDIxiWKc3myY:V7oRSuZOSGF9tIYqNM6Kc3my", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696092160, "uuid": "5c37a3d8-78a8-441d-af3b-c010f4bf6ca0", "value": 80532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696092160, "uuid": "4f7e3014-99ad-4269-9b67-7bfcc53c4697", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092160, "uuid": "494b88a0-b547-413b-aa53-0087a671facd", "value": "f150b954946f9d5bbda6239a41b7f2f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ccfaa7-5f25-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696032344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696032344, "uuid": "6d41a035-d290-4f25-9756-deb88ee2a87b", "comment": "Malware payload (Amadey)", "value": "56cc8cdeeabda59063fbc4322d14683b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696032344, "uuid": "96c8a77c-abcc-4dc8-8959-b87a2c126437", "comment": "Malware payload (Amadey)", "value": "194835eb02355f19409d0497e6f5d75d204d9ccf4c5564654c12fd511aa920b4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696032344, "uuid": "2077f8b6-f400-47c3-a4de-f00b17126d4b", "comment": "Malware payload (Amadey)", "value": "660e4cf2a4ef14190bb3074d33e394fae4db656f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696032344, "uuid": "8cb28f0d-7002-43b1-a3df-abd781613036", "comment": "Malware payload (Amadey)", "value": "d195a39dd579dd67f9c98ec24081b3e2bb0cba6ed82d206f54713c2aa374d209f344a218f84dde0458bbc0f70424906d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696032344, "uuid": "d7d874b0-0882-4f5a-948d-d3298741a4d9", "value": "T1AF152217EAD84031CDF917B028FA06D34D317CE05C688B6A3B99995D1C32698F476B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696032344, "uuid": "ba2c62da-7d99-4fa8-a8c8-0b7349a38c33", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696032344, "uuid": "f5dd1e1b-8eb8-452f-8b26-526efddb0fa4", "value": "12288:XMrPy90bXyEByJu7akJqSWJrDxDy8ueEqwK9u9qfPCYQgdRBbKihxwLB22z6xE4f:oyWXyE4JuGHDx2eEzeqY9bv86Ycd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696032344, "uuid": "856650ee-d61a-429d-8207-8a58c5a834ff", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696032344, "uuid": "453807a6-3c6e-4f36-a829-b85870f2b8cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696032344, "uuid": "79ae72f9-50cb-4bf7-93b6-66dcd16811ad", "value": "56cc8cdeeabda59063fbc4322d14683b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0124b9c7-5f2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1696034450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696034450, "uuid": "fa7a48e4-3bb7-4a8e-91ba-50f40a03f2b8", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ebe741ca96299771acc107b28aea9b2e", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696034450, "uuid": "e725bb4e-d664-4617-8d9e-8f258cced716", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "199781a11afb6bd56c42b0edef7bb175255c46dd25024212e9aaeb8cce3f8084", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696034450, "uuid": "5b032582-3b3b-4fde-aa88-832d02360966", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "356d88efafa5538dc7526dcd4f7ca310ca6c3020", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696034450, "uuid": "ca4c7e55-3926-4fc7-abbd-76d3f6b66caa", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "7f9fc2e50d3c255206db7dff96f015d521f32b8cc3a0bbf0aab382ff5f614cd5c2ea8ff5f3c112b6f70ab86184e69d6f", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696034450, "uuid": "3be373b5-31ed-4653-82b6-9016d72f6d2f", "value": "T19434AF11B4D18472DC7225360AE4DBB95A3EB8300E915EAF77EC0F7D8F30681E625A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696034450, "uuid": "109e42c3-8888-4e7b-919f-36dc8fa4eebc", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696034450, "uuid": "18518afe-34ab-471a-a8fd-5588d8e6d1cf", "value": "6144:cH07dHH5YhBWPGmoQz33/g/vZAO2bWPKRQms0BC+:FNZYhBWOQAxQbWPks0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696034450, "uuid": "27000301-2ae8-417a-98fa-188942bac212", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696034450, "uuid": "1e5736e8-3c7e-4cd1-b24f-5b9e1965cd0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696034450, "uuid": "76032ecc-45da-49e9-81be-c7d8efba7d56", "value": "ebe741ca96299771acc107b28aea9b2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba26967f-5fd3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696107346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696107346, "uuid": "a5f6605a-3a8e-4b34-9c1a-82c2b87feefd", "comment": "Malware payload (MysticStealer)", "value": "7792228707a2c575c0c48f3d111851e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696107346, "uuid": "2f515cc0-9d12-47de-817f-7abac138a4c3", "comment": "Malware payload (MysticStealer)", "value": "19a6a588083633421ed63b0f889a6adfc7496bb4b02a23f9044678b1537df4b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696107346, "uuid": "6f799f2b-9ed4-4896-89c1-09891ffdbe2c", "comment": "Malware payload (MysticStealer)", "value": "fed25779f85fafaad47f58850629d09ee3416d4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696107346, "uuid": "ac5df153-23ad-469d-9c16-1723d16d5742", "comment": "Malware payload (MysticStealer)", "value": "5fde17b99007f4e39d6fc1aa5e2e085df5d3a4b1861a4170605b484670756dbed6cc498c6614769f1b2e02ff14cb6cda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696107346, "uuid": "7afe01e8-ebfd-477d-abf2-7eba518a98e7", "value": "T13D940263A3D94473DC752B7048FB02930B3ABC72D938D7AB2385695A1CB2AC5943177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696107346, "uuid": "7be688b7-a854-4393-9b2c-28c1c3204e65", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696107346, "uuid": "a732f8bb-f77e-479d-95ca-e31a70093f95", "value": "6144:KOy+bnr+Tp0yN90QEkUQEqCJY6Aw4PJrVkPDASebi+YtoAyNDtgXa12UjfVvvfWo:KMr7y90nQE9AwqakSebiVeAQkS2it8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696107346, "uuid": "7809df3d-d77d-442c-b061-5561a1b3fa2d", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696107346, "uuid": "e710dcd0-bb2b-4095-ba4c-7092c6b1ea84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696107346, "uuid": "2cf8c222-9ed1-436b-a4dd-caae2298727b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c4e8f5-5f88-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696074829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074829, "uuid": "4345daf3-3282-4d75-a2a5-2af5214f53b4", "comment": "Malware payload (RedLineStealer)", "value": "bb1fc5bf2231e4c315e80f6ead189fd5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074829, "uuid": "5dae2f1b-c2ce-4f1f-bb3f-68fe19b49c19", "comment": "Malware payload (RedLineStealer)", "value": "1a2bb2275675d70f133ba5d74bd6c3472eb642c7f08a772db80744b991285d9a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074829, "uuid": "dcb21dce-d23c-4c8a-96dd-afa5f09644ec", "comment": "Malware payload (RedLineStealer)", "value": "29fe8e5c1afb05b3a9fab849db4444e7af9acb50", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074829, "uuid": "4cd0cfa1-f550-4f12-a7d7-00e77dec232e", "comment": "Malware payload (RedLineStealer)", "value": "5524cf33688ca67d4a3a9e412fe0d003ad183d243c220139abd751daeb66a775a72bdee7dc960a277ace2479d4d5655c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074829, "uuid": "7715b6d8-8d4f-432a-a76f-0e91747fbcd5", "value": "T19784E023A2F2BCE0D566A6324E2FC6D43A7FF471CE196B663308561F09B01E2D267715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074829, "uuid": "2400ea5b-40a0-4dbb-830c-f6e7767bf55e", "value": "5a388ef2cf242f40b496c828593b517b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074829, "uuid": "60dbceac-5db1-4255-8f45-fe5b06c27bc2", "value": "6144:8M9HbO5F3+qwu1fMTJQYX7Ca6VKzGVy+4CQjP:j5bO5BidW1szGVp4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696074829, "uuid": "5297468c-51e1-434f-af36-c0a394d39418", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696074829, "uuid": "382b476e-e51b-4ee3-a048-49c9aa249cf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074829, "uuid": "41c5286e-8fe8-430c-b28d-1e9ec1932598", "value": "bb1fc5bf2231e4c315e80f6ead189fd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d873ead0-5f51-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696051562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696051562, "uuid": "f1ff8266-cffa-46fb-a1c4-f1077119496e", "comment": "Malware payload (Amadey)", "value": "eb326f653ba0d49d00e57dcece8b35bb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696051562, "uuid": "58092bb9-8205-4a9c-abfc-fc5f3fbbc2f7", "comment": "Malware payload (Amadey)", "value": "1a4df824b20e3ce9a552aaa98fad5a3235940b4f9631d37d084f4ebd67b88863", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696051562, "uuid": "26744f34-6851-4299-b7d6-bb0082966379", "comment": "Malware payload (Amadey)", "value": "6b4c8556eaf3e6344872ffd688c567163140f3fe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696051562, "uuid": "d40c7116-2796-43ae-869b-e1da3aa8e6be", "comment": "Malware payload (Amadey)", "value": "4a0e237c3757cc246ef0552dba04117c2964a4dd453bde0286455bc63f788a0bc9cac3faf61380a1fd45fce41053f50f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696051562, "uuid": "c8a63d61-3d57-47b8-b109-b4c073ff72d3", "value": "T19F352313B7C99173E8B11BB008F646D31E307DB4E6748B5B5384961E1CB2AA5F93A327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696051562, "uuid": "a1e6d609-1fd4-42ce-bee2-492c2f69dce4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696051562, "uuid": "ecc3587d-07b5-4289-a623-9843e0a1c323", "value": "24576:sy+GQ1nmLASp2WWG7XM/nw32+FcVTeNnU674ts/mN:b+GQ1nmLASVpXzNT+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696051562, "uuid": "255a57a8-78b6-4538-a191-c4d8a9704928", "value": 1099264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696051562, "uuid": "3f70275c-e55d-4ade-a650-b0566a076835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696051562, "uuid": "b05c4a11-996d-4617-9e43-b3eba35a0152", "value": "eb326f653ba0d49d00e57dcece8b35bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f00b516-5f32-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696038044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696038044, "uuid": "6253f2ca-4e10-4d6c-aafa-ad56eb09ac33", "comment": "Malware payload (Mirai)", "value": "e5945d40e3479f1ed749a27547875b3b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696038044, "uuid": "60d076b2-e731-4b80-8dd9-fae5b27b5c83", "comment": "Malware payload (Mirai)", "value": "1aa3174d988b4c088cc875cbe367f5dafdc5c50fcba42133be15a819d3b856b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696038044, "uuid": "c49520c1-673d-4e32-beb2-9f589d38deef", "comment": "Malware payload (Mirai)", "value": "9a97f7c40a5b3cd69832da588ef7ed29c55af868", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696038044, "uuid": "62a26796-d14a-4dac-bbd5-7aa6a33387a1", "comment": "Malware payload (Mirai)", "value": "05b86d8ff0b4b8b6c3b3524d078b7c285fd2240cea544407719e9314e0a82d9a7d3dfd2a86eff797342d6409ffca7024", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696038044, "uuid": "9b2a572a-6a8c-4d35-9be9-7d13dfe390e4", "value": "T13F333BC59583DDF4DC1561716173FB338776F43A116AEA87E3A9EA32BC82641D20728C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696038044, "uuid": "7039a246-6157-4f4e-b4a6-cb12d02e0bdb", "value": "1536:wYwtguXlPIDwMgZ7EaM2DAH8Qf1T6svBe:wYw2aPIDwPSaM2DABNTnv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696038044, "uuid": "a5a2b3cf-5954-4f95-ae98-657766eb9310", "value": 51388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696038044, "uuid": "4b3bb691-35f5-4bdb-9c76-365ab9da982c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696038044, "uuid": "c6bfd2c8-46de-442e-b665-ccc3016662e7", "value": "e5945d40e3479f1ed749a27547875b3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c3e8647-5fb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696092156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092156, "uuid": "255f8ba2-0992-49b7-8ecf-1a1738ff7eff", "comment": "Malware payload (Mirai)", "value": "1239443b6afbd220a90c1e3dc9143832", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092156, "uuid": "bc77c094-d764-4c64-aa70-bd761e9e1921", "comment": "Malware payload (Mirai)", "value": "1ae80e91fed022dd809e3b9522ac36d29d7311956a60ef8243a356f02a6f7827", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092156, "uuid": "cc9ac080-71d6-472f-9bc7-c87d0a7c5c99", "comment": "Malware payload (Mirai)", "value": "104e47a659bc4eade69c5a65a36f8dc92ddec537", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092156, "uuid": "0eab8d39-a681-4655-b2d3-ff2b3f2ac230", "comment": "Malware payload (Mirai)", "value": "aa0fcf2f8947cfd968c5a6a9d369eadd77f4a54cfa7a49b58a2cbc9a2ffe2a06862884572a5327a1940e1109e1a1e8bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092156, "uuid": "e512ea55-283e-46fa-870f-8f0aedea34ff", "value": "T1D2B329C0F58B80F1D447087090A7FB3F9B31E5A65132EA2ADF9D9F31CEA3941960669D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092156, "uuid": "4c47a3f4-8ac2-4486-8adf-7f8cc1808dee", "value": "3072:raaqMJyPjLAooqmk6dVZ4trVuNQXF1qqWe:raaqMJyPjLAooqSk13We", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696092156, "uuid": "28ce9d76-d448-4790-a546-21745e713b7f", "value": 110664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696092156, "uuid": "cea98032-1cf6-428c-852f-4b5d946bbf7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092156, "uuid": "08023ced-3beb-4a12-b9e3-260acfaccde0", "value": "1239443b6afbd220a90c1e3dc9143832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "993efd6d-5f2f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696036853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696036853, "uuid": "03f075ae-53fc-4e84-8916-4fddbcd767d8", "comment": "Malware payload (Stealc)", "value": "b3f42b33a6201216d8682d2e53552b83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696036853, "uuid": "390ae6db-78c1-4508-9fec-27ad4c4c3e9b", "comment": "Malware payload (Stealc)", "value": "1b2f49a7d3f41631b9db7b8a1bcf8d4f81207a41e2b5b21d1435f0d63bd75f1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696036853, "uuid": "807e1937-6871-4eb3-8d3b-c3bb2e609dc2", "comment": "Malware payload (Stealc)", "value": "ac728fe6745fe585d83905750f9a46b94e685b50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696036853, "uuid": "2aa7ae13-bdb2-4521-a38e-26d44b046360", "comment": "Malware payload (Stealc)", "value": "f28caf93284e0caef29bcac54620f466ef50b9c04466cead96fe30267458b04c7a40f88c7a69701ac97867967916ed27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696036853, "uuid": "7ea638da-cf49-4d06-a534-b1c2a408c33c", "value": "T175C5F0423F598A01E13A7A32C5E34119476AF9C77363F61B2EDB03E94A123CD5DC89AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696036853, "uuid": "18e61848-09b5-4aba-b8ae-5ad7c5d477b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696036853, "uuid": "2777b98d-0487-40aa-b4a9-55ee73db23b5", "value": "49152:OQsIYaqMoq24tp4g9Vo7q/oXJmxeqU3rR0BqrzSrwG9Mg:Wpaxd19xqt9CBqrzSrwGOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696036853, "uuid": "340975dd-68cc-49e0-aa9b-a3dc2a536a32", "value": 2622520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696036853, "uuid": "62d082b1-96bc-440f-b12f-06f6f94644c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696036853, "uuid": "c8f9409f-8c71-4db5-a387-ad4450c9a188", "value": "b3f42b33a6201216d8682d2e53552b83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7bc4499-5fb3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696093571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696093571, "uuid": "1f02b219-992d-4821-97ed-8bab5407d577", "comment": "Malware payload", "value": "fd2d84bee10bbccb7b590e1025752873", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696093571, "uuid": "a54ca70c-5048-4658-9021-c8c9f48e4b37", "comment": "Malware payload", "value": "1bb662d598172326e5ddd54f879bae3a6fea58742af0f44bd3934003da625384", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696093571, "uuid": "aa560561-f226-4ea9-845a-be27e5903d26", "comment": "Malware payload", "value": "c0fbb34903a19dcf4591ba7f88c3995d183fefe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696093571, "uuid": "2ec8ea8f-d42e-487e-b4bd-758e11873a9a", "comment": "Malware payload", "value": "456dcee83d80fe43b5c120caf9eb8312b7789d226bc4de1a11afb1a617f583e95a72003a2824ce8d882b7f4e03bd2283", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696093571, "uuid": "b2b3c266-c5cc-4196-a6f0-eb673261f40b", "value": "T16756019269E421B8C0F3D136D687966BF1A2710517629ADF16C84E122F13EE16F3F372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696093571, "uuid": "c813e25f-0b25-468e-9102-948bf66d2a9b", "value": "e8918470006188a2ec6edd20dcec679f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696093571, "uuid": "ff361769-a077-4ccf-8a49-69b2f94ca476", "value": "98304:3453W8vYIC+RgZkKIXfEIeYUAlLc3A6fv4i/NTJVLpxrOw1xitse3Jk9yfPDnmY:o53W83p5XfEI5WNn4QNtVLXrOw2TSsfS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696093571, "uuid": "df4d8c9a-d482-42e8-a5e7-28806abcf3bf", "value": 5969920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696093571, "uuid": "b28c42d3-e306-417a-a097-9af6f25ca811", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696093571, "uuid": "a7962f38-2da6-44cd-89b8-b2605bcd0fc8", "value": "loader.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ccd8946-5f95-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696080560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080560, "uuid": "88c0cedd-56ca-49ec-95ee-95e4ac9ad277", "comment": "Malware payload", "value": "427d0b56575a5832f77fde5686b4319a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080560, "uuid": "06bdbfae-6204-49f8-b4dd-13093902a988", "comment": "Malware payload", "value": "1e22d8aa9ef11a057d19adcdf232485c9d063050860aef7866d92a5d82e72da5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080560, "uuid": "5f697f7f-8a90-4646-a4f4-e8c5bbf3fd8a", "comment": "Malware payload", "value": "ad8823800e3d00bb56bd004245ac7e4a74bcd186", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080560, "uuid": "70c6959c-1190-470e-a6ef-1bd12cda3d49", "comment": "Malware payload", "value": "fd89a6760227579d4a04a5a3da3cb874dd41de97662fc424555f53017bddcea2e14a3b7f800d360dc6586ec382e265fb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080560, "uuid": "914ec2c7-1db0-477c-8887-9588fcd115f1", "value": "T178432B72F4D305B2C0D5A330DDE5C71A3B3B6B10536248D7619C0A8A2D219E6B63B73E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080560, "uuid": "189a2d2a-dc96-4f34-9a02-ef8c4d40e9bf", "value": "384:U11hLwl82gBTHBFFbCntgmDyK5+rgAWyL+936Z77H01Hne9hVlubo:URThFFbLmDTU/43a7TCHGhVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696080560, "uuid": "65e9bf39-c663-4e8c-9039-6189bf16220f", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696080560, "uuid": "ee35821e-79ec-4c9c-a6aa-60c5b18ea818", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080560, "uuid": "4ff54674-27c0-4c78-b093-d8e1983f3e2f", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.13628.26077", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f64d6a5-5f67-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696060808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060808, "uuid": "3b21f125-1ce6-4b5f-a9ce-8f41e462046c", "comment": "Malware payload (Mirai)", "value": "813cdef067282e513b25d577e7b274d2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060808, "uuid": "5c470712-665a-48af-b4e9-bbf0219a25e7", "comment": "Malware payload (Mirai)", "value": "1ef9a28a5c8635df58b2b9c5eb7040031c7f1b748c00d6376a59262c42fdcc12", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060808, "uuid": "9b45b591-e6b3-4935-ab0f-9b7a0772eacf", "comment": "Malware payload (Mirai)", "value": "97c4887a3d965124f006d086da98f27876b024e7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060808, "uuid": "d618a488-8905-4134-9764-4c75ef83258b", "comment": "Malware payload (Mirai)", "value": "e1ec130eead4391ce2efea04d12d88bb573505b6cf833d53c01021a217595dd19487d6a9a20f1746cae397f128f78899", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696060808, "uuid": "5ebf2750-e3a3-4f85-a8fa-f52f992fb2b9", "value": "T129A2E11177532D66E3ED1C3CC96A821BB9670BFC80F6327679405620C94D21B3E39A4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696060808, "uuid": "da735b10-c387-4c78-8b9c-5009ecd31f99", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjchymdGUop5hu:vvQn4j+ZO5fKAlxos3Uozs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696060808, "uuid": "43f8c753-7f25-482c-8a32-bfdc421ce719", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696060808, "uuid": "9ab876bd-0854-488c-ab9c-28aeaf8d5e59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696060808, "uuid": "b560d87b-1610-436e-bbf2-82634bd350a0", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d985c5-5f9d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696084204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084204, "uuid": "0efced3b-3bf8-4bb4-bdb8-632e6e38dea2", "comment": "Malware payload (MysticStealer)", "value": "7a8fb035790633a8ae8894441fbe8775", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084204, "uuid": "59d41a98-d1a3-492c-be3d-bcd56ec73dd7", "comment": "Malware payload (MysticStealer)", "value": "21df3450742709214c8f330f87956d5e871816eb9cdbcf503c49786651c4d6b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084204, "uuid": "9959fc8e-1365-4739-bd94-d495fdb9c407", "comment": "Malware payload (MysticStealer)", "value": "b7b316bf93045e82e8755c3b819f49c8fa44ba9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084204, "uuid": "ff44fa23-3b91-4910-a786-ccc36b9957ea", "comment": "Malware payload (MysticStealer)", "value": "b31464bb6e7bfc4a19daa8a07ae14410d3755ea428afe45bff973e63045238fb2e3ae090bf8d126fa870e0623e260a84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084204, "uuid": "db391272-0665-4859-9c9b-8d772563c3d1", "value": "T14154C001B8C48071D92384384895F7635D2CFC273AE6CF6BDAC045767AA42D2BE7DE69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084204, "uuid": "7acbbd13-607b-4941-9232-a8a64a4cd589", "value": "5b961e24b82512d2a00ac6c970dad1c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084204, "uuid": "2be94215-254d-45e9-b2d9-78543e87f9f4", "value": "3072:WhVUoyoyi7Re9jWW4Vu6106vOiIPMoCT7NxH/F3EPVYtoz6HyWzybWMQMlB2mlIZ:Whe/KajWpVP06ffH/FEpWz2hIvPpTrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696084204, "uuid": "119b7634-c0a6-4460-8ecd-d66bed9d820e", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696084204, "uuid": "0cad2cff-3913-4dfe-810f-4aa9f5df2494", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084204, "uuid": "1c4b4f84-d959-4c5e-95f0-bfb412f28a7d", "value": "SecuriteInfo.com.Variant.Lazy.392901.17019.21993", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "619cd0a7-5f8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696077991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696077991, "uuid": "6de00c5c-1b97-4d3a-b00c-19e37e8ebf20", "comment": "Malware payload (Amadey)", "value": "30e243e05fe0bc02ac1a447f471f7168", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696077991, "uuid": "68547909-8211-42a6-abbc-2bb7ac6f9491", "comment": "Malware payload (Amadey)", "value": "21e1fbc1ce0b6ba128af488fe54a09a8ca65282345d41adb3d962c977f02e2e6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696077991, "uuid": "f5bf16f0-0f2c-40fa-8b15-bdee926448fc", "comment": "Malware payload (Amadey)", "value": "34e06a1f32a6735e309541d9bbf54a3039769472", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696077991, "uuid": "c94e3962-0581-4cd4-90da-6c8f5482a960", "comment": "Malware payload (Amadey)", "value": "7abab47b4602f92465173b7c6584d7b1afbb1efc691a25e7d7c40b2c070ca17456f0eff7aa41d5506dd495ff059118eb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696077991, "uuid": "8c6274ef-9952-4ac8-a9e6-cc9e8de4536a", "value": "T12E2408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696077991, "uuid": "d43d6051-988b-479e-bdd1-989cdf205640", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696077991, "uuid": "7986d651-33b7-43e6-84d0-dfe65533d424", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696077991, "uuid": "3c9bdfcb-b8a4-4684-9f4b-f84cadbc9a5e", "value": 224259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696077991, "uuid": "fd10b1c1-38f4-4f36-a9cf-1266ad71969e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696077991, "uuid": "47e77e51-49e7-4b53-8fa2-4c3003678b17", "value": "30e243e05fe0bc02ac1a447f471f7168.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "937db14e-5f41-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1696044574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044574, "uuid": "fe53c825-ed99-46a9-9c10-9488e47a4fbe", "comment": "Malware payload (Fabookie)", "value": "16e1b0fb578bc6d4eb28a5389a8436dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044574, "uuid": "af546596-f9e9-444a-94f9-6d111c157d84", "comment": "Malware payload (Fabookie)", "value": "221a6c13a9650792ab206e9103190b0cdeb556806ce2250b8b1111b0605098b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044574, "uuid": "69658962-c7e0-4b0d-b623-9eef894304f8", "comment": "Malware payload (Fabookie)", "value": "22a9fbdf81a2a42ee618ab480d41f372786c39bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044574, "uuid": "ff629035-3ace-42e9-8628-e10e51da4b79", "comment": "Malware payload (Fabookie)", "value": "68991cbc56f694975afbc643998d416b6d6e866f6c66baff487dd1fac980dabb357c4fdf23ba316f2bba9c20f15ba61e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044574, "uuid": "40745c0d-17e6-46e6-b06a-16f2cec68d01", "value": "T17814576079EE8DFACC95D9268623CC206DEF235E3703D2994E8C81D905753B671B3D29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044574, "uuid": "a68c5f6d-e44f-480d-9283-c4d6d17e97d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044574, "uuid": "7bc119ec-10b7-4879-9eea-b902694319f1", "value": "3072:l2/sV9z2jS1AKYasumNZdt1ZJXStr65d/gKUoeLywm7QTE1P+QmkTgh:A/szaQURLdXiN2D5e2hcI1Pv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696044574, "uuid": "368339e9-76fb-4a54-80eb-bfeaf5dacaff", "value": 208752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696044574, "uuid": "ea5c6c23-072b-4f59-8e79-59112994a12b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044574, "uuid": "d130c72e-7c54-46af-9e16-4d5b1515fb11", "value": "SecuriteInfo.com.MSIL.GenKryptik.GOHP.tr.8412.31890", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f6d16f-5f71-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696065194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696065194, "uuid": "326ffa6c-7ce8-42a9-8094-9900cf4199d6", "comment": "Malware payload (RedLineStealer)", "value": "d1581b2f078035d3df7e108150c5b0bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696065194, "uuid": "d32eb2c4-32e2-4bc6-b24b-53b8728382e1", "comment": "Malware payload (RedLineStealer)", "value": "2267a25ef0920dc4cf6bb3e37da149be15fde2b56df8e0e0880ffd4ca5b2c1d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696065194, "uuid": "6cdb8c01-e641-4fe6-9981-7ca5df2a4ba1", "comment": "Malware payload (RedLineStealer)", "value": "1a2ccc742c769b6c077767fb03feb6d067877021", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696065194, "uuid": "645d2ad0-34d5-4a24-9eb2-d974b3faf60e", "comment": "Malware payload (RedLineStealer)", "value": "937000be9e44d969ad197694ab81071b15aba8183f474a1dcb392d35272e08ca5c8b82f0c7790678c211d7dd0023a40d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696065194, "uuid": "4ece4401-e1f2-4abf-9863-2ce551d166c0", "value": "T15394D022A1E1BC60D95667318D2EC6E4763FF471CE656B27B3189A6F1D702F2D2E2301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696065194, "uuid": "12c0421e-6589-4bd2-8f16-f3a0b22c58e2", "value": "50fceee6f3fb6eb6577a605eb92d5359", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696065194, "uuid": "903a8ced-1031-4d32-b853-31fb3bcc26dd", "value": "6144:vHsoXG8FEwFY21jFR0Cw467hWvUydYoVYrNZQbpWiT:vMoXbFjbW4NvU1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696065194, "uuid": "345f8fee-f820-429d-be09-ef99e1a01928", "value": 409088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696065194, "uuid": "c78a27e6-3313-4a13-ab21-a1c9948122f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696065194, "uuid": "1ea2fd46-0f9b-4d0a-8206-164ff033a90d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e56895-5fd0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696105751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696105751, "uuid": "d4dfe876-a552-45a5-bb9f-99c5c2175d85", "comment": "Malware payload", "value": "c594cefe6ddfd19e7ecb0e749b4063dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696105751, "uuid": "1c91c9fd-a408-45be-a05c-460e75b1feae", "comment": "Malware payload", "value": "23a5ce1becbbdec0486d5e8085d86c9e4275eba14b0d2c29f54ddfcf7cf1ce70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696105751, "uuid": "f9c60c5a-76bf-4022-b7f7-d17a4fc267bf", "comment": "Malware payload", "value": "3c78b4feff67bd08b6c327531cb220cc9d92578c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696105751, "uuid": "52fb0130-c763-4ef9-bcc1-514a66650f36", "comment": "Malware payload", "value": "a9b748b7a2c8164b4cc37a101b71370631547547f732db76f33760bd8c7d0838e761fd8b4762e450a1ea2d6643e97533", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696105751, "uuid": "6aa48476-5e5c-48ba-88aa-bb82846a592d", "value": "T1DC249D6366E17C65E567AB3E8E2ED6D83A2EF411CF24676E3218565F08701F2C273312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696105751, "uuid": "68c3ba64-6f59-43de-acd8-924c2ea23dc2", "value": "d323d1063364fcdde3ec2d7fc616011e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696105751, "uuid": "88c0e79c-fb77-42d1-a178-759273b1ca13", "value": "3072:MVmR74AZSJU/IXjnzCxnT9YIdDlLrpJ55/vgx:yWsU/IrUZYeDhrfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696105751, "uuid": "fb19bda4-f6da-4332-b7ef-4efc6a4725a0", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696105751, "uuid": "0b49cdc1-2bb7-499a-a736-def038057969", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696105751, "uuid": "12b9ed00-ebbc-4ef4-ba17-a36da683b855", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e6ed09-5fb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696092172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092172, "uuid": "168a3729-6d32-4ca7-8234-cef005b6f70a", "comment": "Malware payload (Mirai)", "value": "1ac1d6e87ab90bbc37a1a740985c5bef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092172, "uuid": "0f3c4ad8-53ec-4a7c-9751-09fbdb07f5fb", "comment": "Malware payload (Mirai)", "value": "243c83e530eff883de1dea5c746feccbea8c34e155dd9e4c0868d47c0f02ff67", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092172, "uuid": "2137a546-e17f-4bd2-9ebd-0737d5fcb6ef", "comment": "Malware payload (Mirai)", "value": "3d2fb32705be50e11492e39e3ef0d0382fc7ac1d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092172, "uuid": "a8261f01-fd3e-4bad-adb4-49986ea168c2", "comment": "Malware payload (Mirai)", "value": "c611ee484cdbd7b89c41cfe86fcf583b5b2d1cb6374c8ff0237ccbe408a1c4b3f6236e36f3b52a08853c56611804bc38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092172, "uuid": "870f68c2-2368-45c7-91cf-87771d5d730c", "value": "T126732915B87A2E17C0E4927E12FB8615F2F5330E1470862D3D790F8EFF64684A94A277", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092172, "uuid": "957c0726-1c82-42d3-bfec-11be3aded6e0", "value": "768:Z7ROahnu+oRA44ju9dTHZsZTWYGtSFIO0ZLBXRW4W53dP58iPRunXYLt1rpz/xm0:pcku+M4i9ZarQEVD4prLJTZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696092172, "uuid": "3a80b646-a530-4665-a676-ea832b24551d", "value": 75104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696092172, "uuid": "4645ca53-2fe1-4a14-b38a-be47a2791e27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092172, "uuid": "a233c72c-b169-407b-bc59-88b2a3ee05dc", "value": "1ac1d6e87ab90bbc37a1a740985c5bef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f1dd8c-5f70-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696064582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064582, "uuid": "89e8b780-c9eb-44e6-968d-2cf553d05f36", "comment": "Malware payload (Smoke Loader)", "value": "0b7a3c94d00527964649bac299287a65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064582, "uuid": "4507e91e-eac2-4284-ab15-5cb98e3ab0bf", "comment": "Malware payload (Smoke Loader)", "value": "24477641b629722762c83e88a0d5406e2c1322100e07553552e9ab7dd6f5f728", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064582, "uuid": "94fc45de-1ad3-4196-b85d-a3452833971b", "comment": "Malware payload (Smoke Loader)", "value": "4520501f24da04d13d55c747c4bb7c358717f5c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064582, "uuid": "4194298e-dd7a-4053-9420-49c55ddbc0d8", "comment": "Malware payload (Smoke Loader)", "value": "723ed55e0e8646d6def1d711e2a0e134112e437225c5cf0bf127c13f2315b35c5e383851bf5b42bf2a2b56e9c628548c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064582, "uuid": "5219065e-0c0b-431d-b492-5e0e06f506c2", "value": "T10C349E2362A1ECA1E52766718D29C6E47A3FF471CE69672F33185A7F18B01F2D263341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064582, "uuid": "1d188712-ba7c-4665-b855-3fab99c5f824", "value": "50fceee6f3fb6eb6577a605eb92d5359", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064582, "uuid": "55a1600a-73ec-453c-b27c-5e038b4e1d83", "value": "3072:CXjDR4LBf6bnwrMK1IXVlM1Z2ZjnwGzmbpvWgJ4yiaRFcWQY815V+O3SiTC2:CeonwtIXVGjkzEZh9FIBlCiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696064582, "uuid": "f4984eba-88cf-4bfb-b050-04cae6c35c2a", "value": 252416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696064582, "uuid": "329b78b1-9ae2-45ba-a0e2-f5304195656e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064582, "uuid": "30f25d4e-0c6f-43e1-a3aa-b0326bd6350a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1fc03e6-5f69-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696061778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696061778, "uuid": "53265458-1009-49a0-849c-a8178d4edb2f", "comment": "Malware payload (Amadey)", "value": "298501e26bfe53d37eef3db9e1d4f0f0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696061778, "uuid": "c14f6ad6-6701-4c0c-a998-7f297cdd8a02", "comment": "Malware payload (Amadey)", "value": "2498f3731f28ee9ecd69110ee8ca909b4bf86ca07011e9f015f71a0cbe48e54b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696061778, "uuid": "87ff9c10-2f4c-4717-9f4e-6ec5694adb88", "comment": "Malware payload (Amadey)", "value": "7192d1fa80bab6bd354ec763fe7b986d378663ae", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696061778, "uuid": "3367041c-419a-4285-a036-4f86cfdf4cb2", "comment": "Malware payload (Amadey)", "value": "120a1d2c3ae1a0912e03c5d8317d4731f5c8ae707c1fb72386d1391d4ad039c029e6c5ac9f4562c587bcb0bfc04ae073", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696061778, "uuid": "4e6474c3-72a5-466e-80eb-17068d1fb64a", "value": "T15434AF11B5D2C072DD7225360AE4DBB9DA3EB9300A925ABF67E40F7D4F30280D635A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696061778, "uuid": "b4318aa2-8785-4961-a198-188dae5a3a13", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696061778, "uuid": "d29b88af-583d-40c6-a173-835b2e3e9886", "value": "6144:BXz4SHy5uoBMFGV5PEkIXEHvZAOUH94nAVs0BC+:CCmuoBMUOMxad4ss0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696061778, "uuid": "58f07eaa-1c1e-437f-b073-71fe719df93d", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696061778, "uuid": "de4ce10e-c283-4568-b089-7214d1d46cd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696061778, "uuid": "3f1a2806-f92f-45c7-9e2c-3f39ff61757b", "value": "298501e26bfe53d37eef3db9e1d4f0f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa0acc9-5f44-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696045856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696045856, "uuid": "e17923f0-4360-4586-8fe9-93a8c682cfa8", "comment": "Malware payload (Amadey)", "value": "d677de5333ac8a4000aa60d1acb4556b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696045856, "uuid": "98d34d87-45c3-4742-848e-a637d552a097", "comment": "Malware payload (Amadey)", "value": "24a61fb2f1455cc499dd499085de3013e8fc7e6f138e882aded99f9576fc0c82", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696045856, "uuid": "5f82295f-5a79-4242-b19e-204abc0bfd25", "comment": "Malware payload (Amadey)", "value": "989a3b37a730cae9d56a87f1bc01962cedc5d56e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696045856, "uuid": "a862a62d-1bbd-4cca-851a-0394f3520a63", "comment": "Malware payload (Amadey)", "value": "a2f1cbabb36e352609214e1aee3350cc9ac3839356c857fc04b2760ce59ee092a24e9e16edc3f2c33097f3ecae1465da", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696045856, "uuid": "97a4bc97-4059-4f1a-83f5-ab9981f588ea", "value": "T1722408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696045856, "uuid": "536c401e-a777-4e1a-a0a3-01ae87e43dc0", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696045856, "uuid": "dda96077-2527-4d42-a749-4d34004971d7", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696045856, "uuid": "0992598e-6b1c-4253-ab35-ffd5f3820ca0", "value": 224317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696045856, "uuid": "3e45c02a-8de6-4664-a8eb-a4d72af56a67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696045856, "uuid": "ca8cf79b-53f5-48be-8f8e-41c9e99bbf3b", "value": "d677de5333ac8a4000aa60d1acb4556b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10bbb826-5f48-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696047361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696047361, "uuid": "de20f053-1d07-448d-9431-006fc9b318e6", "comment": "Malware payload (RedLineStealer)", "value": "7ecc5e4ba5b36f2ddb5574e050bfc3d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696047361, "uuid": "61ceefad-6fa4-4abb-ad66-9624c2d84e02", "comment": "Malware payload (RedLineStealer)", "value": "24efcd187b1aa712649a01b01539f960018010b7e0885d67994b748eca7bbf23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696047361, "uuid": "35df638c-d5f9-4ba2-8420-75495dfa910f", "comment": "Malware payload (RedLineStealer)", "value": "4b60221dd7c957102ee6e38aeeee1e0dfd1436b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696047361, "uuid": "73a354aa-d095-4003-99df-a0abe36530a0", "comment": "Malware payload (RedLineStealer)", "value": "b844d5b2557a8f27f17b07c071fb024c8d9da65b26ec10bf1a4bb0a053d878597ddeae224b6b174ae2ff526c0c76a840", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696047361, "uuid": "62b05c88-9a9a-4616-8b2f-da342492802b", "value": "T1B33523A7A6FC80A2E4B51B70B1F307570B397C955CB85B6B73469ABD1932284E072337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696047361, "uuid": "ad78cf53-f9e3-48f6-848c-7e74e3d8fb36", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696047361, "uuid": "6d62f1a6-b606-4166-94b3-b632980c775f", "value": "24576:sy4cYJwivXGEac9GKOUwk6Y9ZDwkUy4XJwSO98yEnhY:bh2z/+N26YYkUyq1yK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696047361, "uuid": "dcdeb687-e9ba-48ef-9c73-8ff3ca9729d9", "value": 1100288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696047361, "uuid": "cf703f21-1334-4816-8270-555f680256f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696047361, "uuid": "0333c03d-3520-4acd-b210-6c01efecf3a0", "value": "7ecc5e4ba5b36f2ddb5574e050bfc3d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92609e1f-5faf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696091817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091817, "uuid": "fd60fb39-b059-4f4d-8e43-048774028b16", "comment": "Malware payload (MysticStealer)", "value": "9485d3885122a50ecd370a5bdd290c06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091817, "uuid": "2a9cd01d-4afa-4d8d-98ea-ffd061d1db29", "comment": "Malware payload (MysticStealer)", "value": "257a0fe5c63457581d8445103ee781dd5ff2a8b1b32f79943454f7002e019110", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091817, "uuid": "3581aac7-1705-42a6-a001-51dc58cc7ecc", "comment": "Malware payload (MysticStealer)", "value": "711138b0cea577b38a891963e2af6b2bbc493248", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091817, "uuid": "4cb0ad8f-266d-4f87-9639-c483ecba2e9a", "comment": "Malware payload (MysticStealer)", "value": "5b35ed3347364be3407252cf7cceb17fa508ee9c5eec745eabc2f06b5367cfb1710d0c67c5a7e774ead016993423d367", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091817, "uuid": "bc3c0c24-b192-42cd-9907-fefb6878e8c0", "value": "T1B854BFE273D0C0B9FFC23DF93A819251850CD8E54E349DAB195C1B686F2D1E19922FDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091817, "uuid": "9aa215bc-206e-4bcd-8207-d24896a8746e", "value": "5b961e24b82512d2a00ac6c970dad1c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091817, "uuid": "e1ebfbf2-72df-4d74-ba94-1e1f53691969", "value": "6144:WhxrKajWpVP06vxwp3u8emM3f22EmVOJ4vGTrj:WLKajWoue0kJ5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696091817, "uuid": "411c3a98-68f2-459d-8db9-723bfe660e96", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696091817, "uuid": "e1eb1460-0136-498c-8ee1-1b27806bfcca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091817, "uuid": "fdc47dad-0eee-43fd-8a9f-3282c17ae1a2", "value": "SecuriteInfo.com.Win32.PWSX-gen.8023.26060", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1055fdb6-5f41-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696044354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044354, "uuid": "6a06695a-a7fd-4a2a-adf1-2cd09dd9f34b", "comment": "Malware payload (RedLineStealer)", "value": "5a815025282c4411b06050ef28302ca4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044354, "uuid": "6ee8fac6-df05-4374-a967-fcf61df57d7f", "comment": "Malware payload (RedLineStealer)", "value": "26e149f309c393fbdd07f390f28046ded7557d39d7328e2377563ca55c2e304c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044354, "uuid": "b29e5a74-86b8-4184-b695-9db4850296fd", "comment": "Malware payload (RedLineStealer)", "value": "41581729a394c17993b3ec8ebdbeb48715d53069", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044354, "uuid": "3a88beb2-ea72-45d5-9363-10dc0799d3d8", "comment": "Malware payload (RedLineStealer)", "value": "266e93315343569879bab9f97f54da22ec2a9f3dd82e8f11635dbf3965253b234a17a1fc09c962eb6de3025ff5d24cfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044354, "uuid": "633e4875-7d3f-4f25-a1aa-90dfdc2b336f", "value": "T14834AF1174E1C473DC7215360AE4DBB95A3EB9700A917EAF67E40F7E4F24280F622A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044354, "uuid": "2dc5c5f2-90a4-41bd-9801-985517a3019a", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044354, "uuid": "b5bc09f8-3893-49f5-a2c7-87a3af9fa269", "value": "6144:1Vz4SHy5uoBMFGV5PEkIXEHvZAOpT3Vs0BC+:kCmuoBMUOMxrZs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696044354, "uuid": "2d6d17c4-b8b1-443e-8d77-6ab1ae504066", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696044354, "uuid": "55787228-aabd-4809-9795-1dd9ecdc3719", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044354, "uuid": "ab6da5d7-567b-42c7-a5fd-26f5ff23f84f", "value": "5a815025282c4411b06050ef28302ca4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d3425f-5fe3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696114209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696114209, "uuid": "b7b66ed6-b7b0-48c6-b112-c1703aa9339b", "comment": "Malware payload", "value": "383c228466ffd0a1bf58a12c7463b006", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696114209, "uuid": "d885e0cd-c339-46c5-a221-26943320de80", "comment": "Malware payload", "value": "28cc2908031b0ad21c6591f3fbd02bf24c0a6ca81efd25fac9ecb2db92c2f922", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696114209, "uuid": "6d5c5eb1-6a44-4ad3-bac8-89806a24ba45", "comment": "Malware payload", "value": "b8b39c2494a7262dea76b79d8c5c0ec0b467a57d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696114209, "uuid": "e54eae84-ac88-48e0-a359-4fb11d695797", "comment": "Malware payload", "value": "edf540d3e053dd89f9c3e5e02d9d60027567f26bb3af2b960d6c8065060618849cd12e87f161e4b1cb724efde5b4571e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696114209, "uuid": "3a32b3be-aa51-44be-a7e6-bd3dfd5ffc32", "value": "T1C2231841B8818623C6E4137AB66E46CE372563E8E2DFB3179D221F503B9682F0D67F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696114209, "uuid": "90b1ef7b-a03b-4357-b3d5-e880dea35dfa", "value": "768:p9T3kFvFsOvIZg3VevqKxpn9m+/8KlUfPoV3//N+WX7JTzLgwo:L3kFvqOv0Q8lgxfK/z91o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696114209, "uuid": "6fd4b007-0cef-4925-a9df-118bab5902e0", "value": 46864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696114209, "uuid": "722528fa-355d-453a-95d8-8199e0771b69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696114209, "uuid": "8adfc9f8-30ae-4ae7-990c-d091dc4fcb76", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78caacff-5fb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696092204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092204, "uuid": "f73d0659-9efe-4f9a-a41a-5aa17f8458b4", "comment": "Malware payload (Mirai)", "value": "109eda6ed909793aabe225275db13554", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092204, "uuid": "f6551470-fe48-4cd9-9960-b2167e59f4a8", "comment": "Malware payload (Mirai)", "value": "29efd8ddf62663ddd25fae6f169bc090ebdc53464cf379d19edffcdebddec797", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092204, "uuid": "b7bdb36f-55c1-4a6f-b9a6-8d2e106e1f80", "comment": "Malware payload (Mirai)", "value": "860988c542388b527179c99ff1c5f829c1dcdc89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092204, "uuid": "6185b3ee-2fc9-4fbb-a10a-9fe270026874", "comment": "Malware payload (Mirai)", "value": "a5796ee20894ba47d7e046f6b4d214794b0fb3afcc520cec472ca0ac08924dbe7aff6ae01d6765b6df9ac5ad8a2290ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092204, "uuid": "5f983a6b-e58f-46cd-a312-7c1139e50c19", "value": "T17593504E6E714F7DFFAD823897B79E209309339216A1C684C1ACEE025E70389741FB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092204, "uuid": "37a39285-b326-4368-a6f1-691d03472ecc", "value": "1536:fUNyqwipEXzKt4kKSdkVz+lW8EYExjSk7IB6CUeHXYpvJQEHVB:8mkKSdG+lW8EYExjLMhUeHXYpvJrHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696092204, "uuid": "cf3e8f19-d8e5-40f4-a48e-86e4ac9eb62a", "value": 92268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696092204, "uuid": "b225c9b2-4530-4996-b2df-4d1f725bd256", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092204, "uuid": "eff18ae8-08d3-4db0-bcf4-d04f896bf7af", "value": "109eda6ed909793aabe225275db13554", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f830f257-5f3e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696043455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696043455, "uuid": "9369d6a1-1502-4389-add8-21a149d86e96", "comment": "Malware payload (Amadey)", "value": "b727989fa52aca8bca731c1191a61297", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696043455, "uuid": "2315f716-851a-46cf-be2c-2660ce50cb9d", "comment": "Malware payload (Amadey)", "value": "2a0cfa914d5e5d11b20017ebfe65a537b8ec160e8091aadfc25bc82c19a5cea3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696043455, "uuid": "91a51c1c-0d34-43ec-be8a-7f9fda8e7700", "comment": "Malware payload (Amadey)", "value": "b3c311ba01c4bbeb17c430c4baeac3ce9f3d7db2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696043455, "uuid": "f7cc2c78-b4e3-44ef-9de5-393622744da6", "comment": "Malware payload (Amadey)", "value": "09954b67bddd7389ebca9cdc08444aa2ae0ad037b4475df1af44486609598a1905cc77d48d8fe26b431f70df9220fabb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696043455, "uuid": "43a28fa9-e55b-42a4-8b84-d56f8f87977e", "value": "T19734AE01B4D1C472D872193205F4EFBA5A3EB9600BA559EFA7D40F7E8F202C1E63566B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696043455, "uuid": "6f9f2e2d-000b-4d6d-995d-a8639b1d8f25", "value": "73011e4ba8dc0b0dfec2e41202c785bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696043455, "uuid": "27de19c6-b27f-493b-af54-6dbecd2c9f1b", "value": "6144:WgCQN7Gvda4NsjH5wzz0mAOHVbL+H3viKC:Wg9Gvda4+mTb6fiKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696043455, "uuid": "4d70d100-432f-460b-aeec-4dc8899d88c0", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696043455, "uuid": "36982fb6-58ca-4faa-8980-b9dbc12691f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696043455, "uuid": "5975c462-ddf9-4429-a0f6-00fd09f96b4b", "value": "b727989fa52aca8bca731c1191a61297.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45654075-5fb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696092117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092117, "uuid": "34f38a0e-366f-43d7-bb99-d5d1222a5b18", "comment": "Malware payload (Mirai)", "value": "f195566e238c3cf065374c2e979b0615", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092117, "uuid": "2e4b9031-e090-4074-a4d9-272f5f21b93f", "comment": "Malware payload (Mirai)", "value": "2a2df71e9bc832e6abbcca68b49b617103143407b01afb5bbf83751d0150b06c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092117, "uuid": "11b60abc-797f-48b6-af0c-82bc7ee2f280", "comment": "Malware payload (Mirai)", "value": "c33e739a0d41c7124b779b9e01ff0ac16007101b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092117, "uuid": "1e824b84-1838-4ce4-be71-936f0fce57a4", "comment": "Malware payload (Mirai)", "value": "b2c84fd1fb6a5b6b3422fe8c211227e5dd4a854ed8ff788128904720ce125a51eff108c24ef44e9e0eafef558cdc9513", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092117, "uuid": "3a742622-8d42-4af6-aa9e-4315e87bf91a", "value": "T1C7631879F10AB27CE9E59034F84328F92D510BA8379CD1C3A0D35175AE74B0EB51AEDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092117, "uuid": "c0d472d9-451e-4d28-b69b-54cec85ddc01", "value": "768:FNVQarJnjGp2Vz9c/9gBtXDI9oR/yGHHHHHHEO6HHHHHHwiu:FNVK2Vze1g7jR/yGnnnr6nnnwiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696092117, "uuid": "9a02a4dd-408d-4eb7-940a-b12074cb36ec", "value": 67168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696092117, "uuid": "afefef27-b40a-4d19-9cf8-db86f1cdba7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092117, "uuid": "1fd36027-0420-433e-92ee-d5744873090f", "value": "f195566e238c3cf065374c2e979b0615", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "385c0e43-5f6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1696064178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064178, "uuid": "c8fee305-66a1-4201-8bf2-6858d3c35be5", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ec1f8fc7e7b05b23eb6608d2256d098c", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064178, "uuid": "6baf23ce-adc1-44d5-877f-952917b09b4e", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "2ab5d501450f133411b9ccb07ed25897ff6001748d2ee877662d429576078b29", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064178, "uuid": "97de4df1-273e-4734-8b73-49b1ed5b8c1d", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "d56caf1b557b3aaf78cb09070ff22456c8dbdaea", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064178, "uuid": "fb45fa8b-b130-4e5a-acee-94d58dfd203b", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "6aeb52aed89424c3a4d7bbd2717fb6356b37896e37794c6d3da1bd773394ad5fc6c5af32d417cd232d54a69aa5d3ab5b", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064178, "uuid": "ac52d94b-c1f2-4b0d-919c-2d15d28a73d5", "value": "T15034BF11B4D18072DF7225360AE4DBB95A3EB83009A55EAF67E40F7E4F302B1D631A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064178, "uuid": "cbdec1de-405e-4048-bf6e-5f3659ae8563", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064178, "uuid": "90afc1fb-7687-49da-bfa1-e9fe2c3b319a", "value": "6144:Z/z4SHy5uoBMFGV5PEkIXEHvZAORnAqrcVs0BC+:SCmuoBMUOMxjAa4s0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696064178, "uuid": "0962881f-3983-4a45-80da-2a3d7c13dff5", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696064178, "uuid": "9b745c2e-46f8-4522-8bf0-1512853f292e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064178, "uuid": "bc99a483-dd36-42f0-b890-2deef4c6f310", "value": "ec1f8fc7e7b05b23eb6608d2256d098c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7136c33-5f46-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696046755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696046755, "uuid": "2301e9ad-26c7-44b8-86a9-95eff9454a05", "comment": "Malware payload (Amadey)", "value": "d413551985ffea0c35fd73e7553bba33", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696046755, "uuid": "93b70289-cb1e-46c6-97c5-d9cca2694fe6", "comment": "Malware payload (Amadey)", "value": "2c35fd29f7f110425c57518a4405cdb40705a914bc11fb22e4dabc5750ab4bf6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696046755, "uuid": "dc3c10b8-5cc2-4640-a198-1c44a96fd56f", "comment": "Malware payload (Amadey)", "value": "e3a5f8df190b77fb2794ee6439b2d9be77dfd111", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696046755, "uuid": "d92e0637-c6f1-4cf7-807d-1a973fa8cbb7", "comment": "Malware payload (Amadey)", "value": "c1398eaef643c9d067019642fe49f10476fa7915792ee0f2b8c5cab783d2ef9e009e42ca91d9031e0f3777b3a1fa7391", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696046755, "uuid": "bb0cdb72-cf06-4cbe-9a56-326775cf42cf", "value": "T1A02408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696046755, "uuid": "99868e12-6d45-4aea-b0f0-7ecea9d78df8", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696046755, "uuid": "e379f4d3-6070-425e-bf0f-c7ad49b2b12f", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696046755, "uuid": "6592379f-0d8f-4d1e-a8f4-b757b262d06f", "value": 224322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696046755, "uuid": "d5f13611-a1bf-4485-968f-13c2433262df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696046755, "uuid": "4f10ca08-adb3-4706-802e-cbcb0a805938", "value": "d413551985ffea0c35fd73e7553bba33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95633ccf-5f93-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696079796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696079796, "uuid": "25c205fe-1ed5-4ef8-ae23-eaf17a2c9ff5", "comment": "Malware payload (RedLineStealer)", "value": "429ad4903a0eb5549c81d73f1a6069f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696079796, "uuid": "d4cd6993-3c1f-403f-875f-a63f796c3a27", "comment": "Malware payload (RedLineStealer)", "value": "2c5442a2626607cc413da2dc65b02f0fbacb261243ddde5672ba811c27f43c08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696079796, "uuid": "6de5c865-65ca-4a5e-bad7-55a9223473b5", "comment": "Malware payload (RedLineStealer)", "value": "46b6d31c7105411079989ee25081756ae971e936", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696079796, "uuid": "89f2db5f-cb77-4c8d-9fb4-b11d54508a6f", "comment": "Malware payload (RedLineStealer)", "value": "aa674a8e3cadc1fb42ac7748849f45d8456329d51ca4977f2751f67ee589ec05fe00054946688b0deda2a67b41507563", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696079796, "uuid": "6efccc38-2f7f-48be-9fcc-7a65c895ae6c", "value": "T14C252307F2D88437DAB11F3058FA02831B31FDE14874874F2749969A99F22E9A47677E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696079796, "uuid": "e72b8d22-ddaa-4a0b-a23e-7aa4cd3fad75", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696079796, "uuid": "08349618-f7ab-463e-ad49-d881d709dc26", "value": "24576:JyF5ejFHm7pOl3vlBOWsrqYcjXaQBqEnw8u2G65e:8aBHi4hfDs+YcjXaQhwHt6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696079796, "uuid": "ab6fc3ac-fbe0-4b40-843f-2c32013e6456", "value": 1013760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696079796, "uuid": "3ba5ca5b-e9e1-4ee8-96db-c4e119f8d396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696079796, "uuid": "08dfeffc-5871-4c61-854e-35440972f137", "value": "429ad4903a0eb5549c81d73f1a6069f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0499e37-5f87-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696074741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074741, "uuid": "f430e88f-462b-4dd4-950e-eb86cb4d8bb0", "comment": "Malware payload", "value": "905beeb62a986dd645799937b69ae867", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074741, "uuid": "80842551-ce71-43e0-b1d8-bab8873c6322", "comment": "Malware payload", "value": "2ce06ea838ff7987486eb638d2d2286b63b7ed6b27076ac528e31b5385f07106", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074741, "uuid": "34c78db4-edc0-4257-b52b-2d84f78489bf", "comment": "Malware payload", "value": "9792f1d2ec7802a26a2ae3f3e5c8f3bd75b4ea69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074741, "uuid": "fb831a86-6887-4d37-8add-4da016e7abc5", "comment": "Malware payload", "value": "856ab036f2ade18f20863588a89a15feeab7cef7af18cfc6d313af897cb7fa0145e2c2ebac33f6f8ae1e558296d4f9f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074741, "uuid": "e2f2b412-1105-4a2c-8759-b24aa446aa3a", "value": "T197A533A520D50272F17237F09B4BD66A0E72BC83A5347F67471848E0EA01F54AFBB61B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074741, "uuid": "ae70c13d-cf06-4c54-86f0-4bfa8c661597", "value": "7a5e2524b66da5177b4ec46d305a3dd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074741, "uuid": "997f2ea6-aa41-48cc-9c93-0348826e0e51", "value": "49152:IS4je5R2J6L0wOU/uuzbLi21uwsdV72CajPPpCa++OMdcHc:ISz54o1XGLbSjoa++OOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696074741, "uuid": "11455bf8-0d31-4d6d-a6eb-f71686bdf3a2", "value": 2232364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696074741, "uuid": "d1fa71b6-6ace-4c6b-ba6e-876577e98003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074741, "uuid": "2e6e3a98-cb7c-44b5-a59a-10a8330e3d7c", "value": "SecuriteInfo.com.Win32.Evo-gen.3997.22049", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea9316d-5f67-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696060887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060887, "uuid": "a0642a4d-c14c-4515-af80-997202b49f55", "comment": "Malware payload (RedLineStealer)", "value": "4d3d3e269b3fe6c81e7fd330ebcc3a9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060887, "uuid": "e1b7a008-d07d-4b6a-b827-7c3fccd32078", "comment": "Malware payload (RedLineStealer)", "value": "2e494e4c3d836328a67e497d81ca0652b586094846d6d0505134613820e14e6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060887, "uuid": "ef3f52b1-cdf6-4033-80fd-dee8d947ea03", "comment": "Malware payload (RedLineStealer)", "value": "63ff1af264a84a72e4699d22b05df60456ef8f00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060887, "uuid": "416986f1-ea91-4384-95d9-34602dd554f9", "comment": "Malware payload (RedLineStealer)", "value": "07115dbe765c4a6c8a97458f28c9f1afe618a7c88cfd0ffac46104ef196bdc63e5a2bdf43eba93f6ac9085b0fd2ccc95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696060887, "uuid": "a1b2aa5d-7441-4284-91ef-d2009510676f", "value": "T1CC3523976BE80973D8B61B7048F20A870B367D307D3883AB2BD2595D1DF25D4A93172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696060887, "uuid": "2ed38f78-8919-48d5-8da8-470a714d0913", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696060887, "uuid": "a058c9dd-7dba-4062-8b3a-16759719f9b3", "value": "24576:OyR9ZHgujQTMsuKIpBcm5zZvRuLkNWy0YdQD7He7D:dJouK+VzFRuRyED7He", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696060887, "uuid": "fc1375e6-4776-425c-b8ae-6618abc81ee8", "value": 1099264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696060887, "uuid": "2ab6768c-c336-4653-ba0e-d9d4a592e9a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696060887, "uuid": "e4850209-f045-47fd-8e89-34dd40df5090", "value": "4d3d3e269b3fe6c81e7fd330ebcc3a9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f010d42-5f62-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696058767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696058767, "uuid": "08857024-a7b6-4e8f-81f4-f45595f20873", "comment": "Malware payload (RedLineStealer)", "value": "93229405b90e0054dbc7b73b96295e75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696058767, "uuid": "b04099d9-1560-4c05-a70b-fd4bc3f1606f", "comment": "Malware payload (RedLineStealer)", "value": "2fa4d4e3649f73f9aa4d42ca74ffc1758fce4ce9f4ceccd8aab7b336f4ac0852", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696058767, "uuid": "c59f03de-2b19-43c6-86f1-082d24eba6e0", "comment": "Malware payload (RedLineStealer)", "value": "33760ad63e4761c7bcbc8e7e4e3542051c63c713", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696058767, "uuid": "3de3f70a-e320-4afe-9451-a188546cf6d1", "comment": "Malware payload (RedLineStealer)", "value": "054c894d427016eca2e0892ba088fac09faa4ff9cb98b22811b4fdc045515799a4661b2744b88998b745481d7b66bf06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696058767, "uuid": "44ade5a0-2c96-4055-be65-415ff94d91d9", "value": "T1333523469BD89532FAB51B702CF742930BB6BCE05CB8871A3745C8190D729E8E672737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696058767, "uuid": "5b538632-9d5c-4ce3-8b78-e15af812ee7b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696058767, "uuid": "4e0f0e39-a604-4cd8-bd8d-f486e2482f29", "value": "24576:dyJb9QdfN5VJ9+IuZlSGeXBuVzaVSd3J4Vi6:4dK5ZuZlSGQBuVzaVSd3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696058767, "uuid": "ecc8f104-28c5-406f-bcff-f7d4f65fdd66", "value": 1099264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696058767, "uuid": "a30b4634-a0b2-4982-81a2-cc2454273317", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696058767, "uuid": "aa5311aa-0048-4eee-be13-5f499edda7b3", "value": "93229405b90e0054dbc7b73b96295e75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40776bd2-5fa9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696089103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696089103, "uuid": "b73f18b2-1459-491f-89e6-7e396524b450", "comment": "Malware payload (Amadey)", "value": "aea4409f2ba1aa507709794cfb447cc8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696089103, "uuid": "bcd65206-7f4a-4a31-aee8-6d82c070795f", "comment": "Malware payload (Amadey)", "value": "304c50d025bb2a17a37b3a3f12122a3d44740c86161c63c5eff8b9da61e594c4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696089103, "uuid": "e734b6bc-67a4-4c40-9f53-eae882dac26a", "comment": "Malware payload (Amadey)", "value": "68f525bf9b833a74fc5713c3e84a39a1a685cbd2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696089103, "uuid": "114f8fd1-aef8-4f65-90ee-016a80986628", "comment": "Malware payload (Amadey)", "value": "1604e10647adf439ee57807f3c12c2f956f71f20ca40628a01e137c90679403270e3bcf64bda866fc3df06ed6018e686", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696089103, "uuid": "f3eccf3e-2a10-4b23-88b5-d78f32454797", "value": "T1C42408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696089103, "uuid": "4eb9c3b7-8636-49f6-a8e3-e37a949f0d6c", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696089103, "uuid": "8c3cc190-60ad-402a-95ac-0034a44110bc", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696089103, "uuid": "b7487057-30f3-4cb5-b7ef-612afab0a585", "value": 224360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696089103, "uuid": "bd5e5669-d165-45ee-bef8-49f694eaf3a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696089103, "uuid": "7a88bd1a-0fd0-4a4f-a276-ce40165ba8ff", "value": "aea4409f2ba1aa507709794cfb447cc8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b87f8ec6-5fde-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696112067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696112067, "uuid": "6528b46f-2689-484d-a658-ebc514b1e055", "comment": "Malware payload", "value": "884af2d7cc3128dd1e7e3e19b184f7fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696112067, "uuid": "e2b63cba-a832-4855-8bb2-6b6f8ed53a76", "comment": "Malware payload", "value": "312f76520d3afd443605167937eaf441f126036ea3b57902fd3d9b22cc210681", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696112067, "uuid": "c6a60669-bb72-4bc1-8f5b-86f008fa633d", "comment": "Malware payload", "value": "ad24f495da23ba63bad8e54574510a9c60edf6ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696112067, "uuid": "a907b34e-0712-4867-b439-e84e38f4de92", "comment": "Malware payload", "value": "b108c54eb8037f3093e9825ba9809a39811912fda235aad5e35871db0c20e0661e6d5527ff3c6a27300b98450c6cb28c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696112067, "uuid": "478f820a-8ea2-4234-ac2c-5457140ab732", "value": "T100248E2362E0BC60E56B66328E3EC6D87B2FB511DF57675A32144A6F09B11F2C673312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696112067, "uuid": "ebbace42-3c01-40db-ab43-42590ab79d36", "value": "eb89aa3fcf43b156dad667e281a2675a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696112067, "uuid": "b21ba5d0-8b4e-4a52-a553-ebc7cd65364d", "value": "3072:8DORczDkzzLwcFIvAR9vryrhBLM6cV/gS5/4VMJ7Fg3:YDmzLOAR9jyrhtje/LGsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696112067, "uuid": "270a6563-ebdb-424c-ade7-ce559a12214a", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696112067, "uuid": "4bcf61c7-33c4-41f8-afb0-abe4895bdd85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696112067, "uuid": "d5c17af7-4436-4a0d-8a12-da67b9fcc685", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea79569d-5f53-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696052451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696052451, "uuid": "e33ac36e-b835-42bf-af03-a1ec1f053f27", "comment": "Malware payload", "value": "5cac2e1188f2acc46b3c4c34f3c23fab", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696052451, "uuid": "380b24f3-8b90-4b36-a421-8403c93b12d7", "comment": "Malware payload", "value": "31b2a2d05ece48cc34331aa5502bb75b3f0cea31dc1d87afac40d729aa802eda", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696052451, "uuid": "8616a5b0-310b-48f3-b185-bb9aaac929f4", "comment": "Malware payload", "value": "8250e0ad2df49bf498b70877f64fab47ae864bf1", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696052451, "uuid": "805e35b9-2f11-4438-b500-75e0f2447cd3", "comment": "Malware payload", "value": "162af2c41f45dcb87bf15437839418856ce34b74019d47cd8a55870e75a550f7c2e7e53695f0163b997485fc35fac055", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696052451, "uuid": "79bca1c0-602a-4a66-9767-a2db14fc2b5b", "value": "T18036E0DEFB946E1EC87200334A861335665A4C2DAA56C707568CB73E38B35E44FC6EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696052451, "uuid": "031f48b3-ef07-43e1-9869-8712fd4605cd", "value": "98304:TAbB8xYwXV/wSy0YZF9rqsuIdmMoFKswUjS+qwxKbkc9k:st+XoDv9rqMdmMqKswUJqwxKQek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696052451, "uuid": "83fee6c6-c6f3-4f51-a40e-1d319f656147", "value": 4907570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696052451, "uuid": "2d098e28-033c-4a89-a6d3-093e51663cb2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696052451, "uuid": "cababf0d-f115-41f1-bc2d-94af75b6bfc9", "value": "virus1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d53f874e-5fde-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1696112116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696112116, "uuid": "38f3897a-4d30-4cbf-934b-0e89e149b928", "comment": "Malware payload (RiseProStealer)", "value": "d2c21d5b9d62e1755161ef3d223d8fef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696112116, "uuid": "3c7f6081-c423-431f-9128-efbc0298bd3f", "comment": "Malware payload (RiseProStealer)", "value": "322f93b4b3be76e1a86e00eb83745a6b8958ef5042e4c72887547369ae446812", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696112116, "uuid": "237e57d4-74a0-49c2-9aff-f16e536920c4", "comment": "Malware payload (RiseProStealer)", "value": "3a8234eecf91c08d92dcb4d3b708130e1925088e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696112116, "uuid": "69fcf2ca-dc2c-48a1-91d6-2b6a12a1fd76", "comment": "Malware payload (RiseProStealer)", "value": "c3c46768b056331805b345fe38b5e4b8f40f8612dd70182dc8cd2d16ff73c3613c927e2ba1e8d2d0fe033ec566858e81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696112116, "uuid": "ffb5103c-a562-4f40-accd-d11fdc595c2f", "value": "T120C51246B7851DEAEB03513C85CBD3213734F6E123626B270A38E3351E57AD1BE8B612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696112116, "uuid": "84f5a21a-c6cd-4117-bb3b-49d8be1a9aec", "value": "cc3583a3d47c342bd019bdbc87b4d7b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696112116, "uuid": "85674411-07b7-45d3-a75d-23972d351985", "value": "49152:nHoGp18BUfHeCl/7UNTkd6e7kL6ZGmcemv4ef6yHv0sNnPQJv+vLHOm:HrR7lzUNodc69cfgO1nYJv+vLHOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696112116, "uuid": "2880df9f-3590-4ac3-9e75-1001539029db", "value": 2617647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696112116, "uuid": "266fc616-1bd2-4022-a5ce-b1780c598176", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696112116, "uuid": "fbb35243-90a2-4318-bac6-ae7f36210b70", "value": "322f93b4b3be76e1a86e00eb83745a6b8958ef5042e4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d932e19-5f27-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696033344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033344, "uuid": "81d2d042-0891-4e74-8c6f-02fc440aa81e", "comment": "Malware payload", "value": "94c48a90a871ed2b1e61e0bcd043438d", "object_relation": "md5", "Tag": [ { "name": "BinanceSmartChain", "colour": "#A43486", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033344, "uuid": "ce0275aa-0ab4-47a1-a6f8-242d317c80c4", "comment": "Malware payload", "value": "323721abf8944d47b096e21c141208de8ad4bdd3e63cabf171ec03a35974026c", "object_relation": "sha256", "Tag": [ { "name": "BinanceSmartChain", "colour": "#A43486", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033344, "uuid": "1c8d82d0-70a1-4c22-a46b-340daf57d994", "comment": "Malware payload", "value": "2ee786db7725ff1a2fa97d5e717e5bdabf51b97f", "object_relation": "sha1", "Tag": [ { "name": "BinanceSmartChain", "colour": "#A43486", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033344, "uuid": "57e82b9e-6f23-4233-941c-bec8d0277737", "comment": "Malware payload", "value": "9b8775448c9ee1e6795a396802bf12b3129f4c91ba2faa99c2053e2e3fad5867120201e62e7e1611d918e0886efcdfa3", "object_relation": "sha3-384", "Tag": [ { "name": "BinanceSmartChain", "colour": "#A43486", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696033344, "uuid": "dc35d54f-4d53-4c86-a1e3-fc901b03bbe4", "value": "T1975633D6DE03EBEFFE5F9833BD1E8ED6C26431905320B53A5067F896D00A7669920346", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696033344, "uuid": "d4727c33-523a-4570-8eb4-aca88aca3748", "value": "196608:mURCLABMGC8FbjtbCgwLcKSz3dM5euASKnRcS:mRrRQhCAKSz3cm9nV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696033344, "uuid": "fe3843e1-8a90-4640-8d06-d59f1be574a6", "value": 6382502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696033344, "uuid": "912034ef-d068-4623-a002-bf7fb51856d5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696033344, "uuid": "eb8ba65d-7392-479e-937a-c1b8245afc0a", "value": "Flr\u0435f\u043e\u0445 lnst\u0430ll\u0435r.appx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83badc9b-5fe6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1696115415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696115415, "uuid": "d941eecd-27d7-4ac2-a91b-537a08fe6a70", "comment": "Malware payload (RiseProStealer)", "value": "f282bcdaa278fd35993315cebbf5d072", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696115415, "uuid": "cd283e05-4d9f-488f-9415-af098ef92c85", "comment": "Malware payload (RiseProStealer)", "value": "3237c81c20eec0a5dba5e2e6d07fb0dcd5130cece116bb4081286784c2dab395", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696115415, "uuid": "b863c37b-8fef-459e-ad4b-c060edd580af", "comment": "Malware payload (RiseProStealer)", "value": "51d3e910703e708a27a0f323612f6f772a6505e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696115415, "uuid": "c7081888-df69-4081-b74e-c7c773f9cb24", "comment": "Malware payload (RiseProStealer)", "value": "fe8c69ebb16923b4b865a749704159971c6b6b41f061d81647de0da7508690573c401dd5577c2be040f64413508971c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696115415, "uuid": "448f6233-3f5c-4929-a3a5-38cb59e733c1", "value": "T12A54BF2366A3BC20E5666A719D3EC6E8762EF411CE59575B33182F3F19712F2D623302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696115415, "uuid": "05af2ee9-3e5a-480d-b473-0b337ada9043", "value": "eb89aa3fcf43b156dad667e281a2675a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696115415, "uuid": "1268cb95-d575-45e2-b6a5-7ec5fc82f953", "value": "3072:m/DgvPFQ7hKqAZRlOF6qBW6Wp8+0PdKRKZedAs3EnFRwS5/S/ATO3:kgahKbZvKhWVVRKZOi7S/AT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696115415, "uuid": "25c23dbf-ca82-49a0-a23d-732eb4b6d9aa", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696115415, "uuid": "2f370e23-74ec-4dcf-aa7c-ddc51f948e54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696115415, "uuid": "0fdf4051-0b71-4de9-8d00-bab53f1f766c", "value": "f282bcdaa278fd35993315cebbf5d072.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd332ab0-5f90-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696078682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696078682, "uuid": "d71033ba-5c2d-490e-93c5-5cc01b239fe4", "comment": "Malware payload (RedLineStealer)", "value": "0cbd944fe1ebc4f4ba7bf105127383e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696078682, "uuid": "b205e0cd-d1f0-47ee-9f72-d0bb3fa15f83", "comment": "Malware payload (RedLineStealer)", "value": "3325e84a732e61754c18109e5ea93e9a97536af9bb9eaf2358d7c8c7d14a0dc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696078682, "uuid": "9c51dfdb-e678-40a4-8b1c-d770ea0a8d75", "comment": "Malware payload (RedLineStealer)", "value": "492f14bfada3e0d8202a9d729e084f04dd6964e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696078682, "uuid": "c48ca6d9-a888-4da0-975b-1378104b4635", "comment": "Malware payload (RedLineStealer)", "value": "8aaf1481865c6afaa5a16151f2087d6be38935c3282be3171f9885c1c05745b51f1513449ef17b23a7439d8d0af187f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696078682, "uuid": "6cd2f95d-db96-4235-969a-77605107975f", "value": "T158647C693EF07F71E9420435C6348E92F734E8AC2904B89F6732FEAE57D089CA51D895", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696078682, "uuid": "46187a43-ba1f-4b6b-9ab8-1f5314c11d83", "value": "5b961e24b82512d2a00ac6c970dad1c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696078682, "uuid": "02eb49a5-7c7f-405c-a416-df93435b2184", "value": "6144:WhZG0Qo7QkQWym0jVxsgFwlQts/nh6Mfg/9Xcj:Wu0Qo7Q9BxsgOiIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696078682, "uuid": "6723612d-0ffb-4663-b3ff-60dfd1420368", "value": 317952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696078682, "uuid": "80e67d34-f591-46b7-bfcb-7d8e71a2e1ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696078682, "uuid": "1e4b03c1-c243-458a-9c75-23c868dad304", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a92ba5-5f92-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696079340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696079340, "uuid": "0c4f2c39-fdb6-4fbb-9527-976c252f8d40", "comment": "Malware payload (Tofsee)", "value": "d0ba60a323b92b06dbe8c6008b96cd4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696079340, "uuid": "f5022779-1f6c-4b05-93d7-34ba77c0ba60", "comment": "Malware payload (Tofsee)", "value": "3395259ecc9fa03bd596a3fbf725546b60b10921215591b50fcbe791a53b0d95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696079340, "uuid": "9abfee8e-9314-4099-8d27-8aa31ddd1ee8", "comment": "Malware payload (Tofsee)", "value": "092bb6a6f7e8ab01a5693165c3dd297923b64320", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696079340, "uuid": "d2296ab7-2b58-4046-bc17-eda7875d6723", "comment": "Malware payload (Tofsee)", "value": "cceccfc3f296f7856cab9c1cb6e50adc805ca8c30ef480d503ec2ee43acd83b8adbb57e3ffb393f7861b02613ed33d2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696079340, "uuid": "71661273-55fe-420b-a6ca-9f647b752bc0", "value": "T1E634AF2362E2BCA9E56766714D2EC6E47A3FF471CE68676A3314562F0CB01F2C263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696079340, "uuid": "5393d285-13a5-43c7-8f35-8f668457f44c", "value": "5a388ef2cf242f40b496c828593b517b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696079340, "uuid": "be527d8e-e88d-45ce-b8da-bd371515b0fd", "value": "3072:hXjIsHBDaxUZhOWvSeMVtzCgfcV96jEsNpxSAiTBRMl6vdBp5VWQfJzm8i:FJSUZyTzCkmQbpxS5TBRM01nhJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696079340, "uuid": "55181adb-73dc-4b15-9e74-794a758bf501", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696079340, "uuid": "9e588116-39b5-425a-8095-e9da76ccf640", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696079340, "uuid": "5cb640d2-62e3-4c27-b663-6ac9937f9320", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d83517c2-5f2c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696035670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696035670, "uuid": "47cf071a-ee17-41c4-9cb2-55cbf516e9dc", "comment": "Malware payload (Amadey)", "value": "b3403c98ed8fe928ec85c828954f52bf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696035670, "uuid": "94ea9cef-ff3b-4ea5-86ef-811b8e0d05bc", "comment": "Malware payload (Amadey)", "value": "33c29b46c078a5aa16324ea2e8c15767f9852cb34c1a7b7501d1d32e2cf62035", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696035670, "uuid": "94047cf7-3cd3-432e-a316-7266d3e7d78d", "comment": "Malware payload (Amadey)", "value": "d71bf60e6d2880eaa37dc9fec79d98ec7c114083", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696035670, "uuid": "dc581e67-3adb-4d0e-b112-d33e2a81a748", "comment": "Malware payload (Amadey)", "value": "2dcde34b89ef120ce9356da3a2ffff0ef5eda73c0c7eb70a1c9dd2bdd2dd0dc587be4fdcd3c9d6a57c2d71acf0419cc5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696035670, "uuid": "4f31f12b-db27-4e83-a073-0bb61fc8fd18", "value": "T16F452303EBE99132E87427704CFB12C30E3ABDB49D7C9B6A2695644E0D71D54AA7231F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696035670, "uuid": "c27afffc-75f3-4148-b652-1580a360815b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696035670, "uuid": "90a0f754-2ca1-4209-b1a2-7f6594526d4b", "value": "24576:/yXv3IYP3gF0lmlWDY08T9AEbm6665GVFsTIKm:K/IYP3ezlgYTxADiGqIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696035670, "uuid": "7bd29f5f-99c4-4a92-aff2-52b97c5a5877", "value": 1192448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696035670, "uuid": "40b161ea-ea8c-48b9-98ac-3437a1fe34e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696035670, "uuid": "14c226d3-d2a8-4056-8cce-7bd3f4a7ec86", "value": "b3403c98ed8fe928ec85c828954f52bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99050345-5fba-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696096553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696096553, "uuid": "18ad8cf0-544d-42b7-a4f4-caa5500f6824", "comment": "Malware payload", "value": "65eb3f22c36f9029ad00888f82ed044c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696096553, "uuid": "cda2743f-0937-484f-a01f-0cb56d9f5b50", "comment": "Malware payload", "value": "34bdbd14e1d6cb007b01e6c63a2657d0bfd7a1aebbde88a934e81d0ad5b4dde3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696096553, "uuid": "8abd1bc8-32c9-44d3-9329-2e30323140b4", "comment": "Malware payload", "value": "e55eefde82489f92064f486101d4679152bd4eed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696096553, "uuid": "87a6af7d-fe9a-4862-8c6b-1c7a43f9c2b3", "comment": "Malware payload", "value": "f2d3ca9cc53b4ba9d9cc53e93c4d1ac6fec2d58f6b25797bdc47401182ef3648c29f73af6c1df06b84d07bf0af028602", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696096553, "uuid": "9a65e533-576a-4605-801c-ab93993075c3", "value": "T142647C446A8B8225DB5949B927333D1094ACE8E71B3F0DC723C4466FDE53F976082DEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696096553, "uuid": "5de82f15-8918-4a8e-9ab3-4c41a5c3ee63", "value": "5b961e24b82512d2a00ac6c970dad1c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696096553, "uuid": "525c58da-fd78-40db-8e0a-690850383fad", "value": "6144:Whb1kQRrux0TLqBCXcWyIAHZj14mXzGrLKBvWjTaz18Fj:WvkQRru0XcWyIqGrLSvWDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696096553, "uuid": "9fec5e2a-afe5-403e-a5ea-da59080ac33f", "value": 317440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696096553, "uuid": "78c65e08-d541-4eb0-88e3-698734e917d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696096553, "uuid": "1cbf49e2-03cd-4604-944e-fe876450a727", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21e9a9e-5f4f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696050665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696050665, "uuid": "c4c76691-03e8-4f1b-a0d5-b18fc22ddb5d", "comment": "Malware payload (RedLineStealer)", "value": "12669d15a1695d3c5494a45eefed1b0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696050665, "uuid": "dd0e880a-0998-4b07-b104-660e79ec4e1d", "comment": "Malware payload (RedLineStealer)", "value": "3523b6abc491f0b831e13afafb3afe0181a6d68f290d659baa081b46a522a2bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696050665, "uuid": "6b19f3c1-5da6-4351-ba69-0f4784866721", "comment": "Malware payload (RedLineStealer)", "value": "33b13a496807087bd67aad9f664042fe6f16b6da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696050665, "uuid": "82bf6de5-f68e-4112-8a7d-53181a0a904a", "comment": "Malware payload (RedLineStealer)", "value": "39768fa94dbdbe4df10fef341545636569fb99daa5d1be4428543c38033b17216a813ccd1dbfd69690a3ef378f46e956", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696050665, "uuid": "2fb46d4d-1519-4586-92f2-0894f198c194", "value": "T1AD34AF1974F1C472DC7225360AE4DBB99A3EB83009915EAF67E40F7D4F34281E632A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696050665, "uuid": "7e853260-1af1-431a-b4d2-4ef899bddab9", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696050665, "uuid": "9eaa6447-58f0-45d1-b19b-14a893296ba8", "value": "6144:APz4SHy5uoBMFGV5PEkIXEHvZAOnjrv8B05BWVs0BC+:1CmuoBMUOMx9j40Ks0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696050665, "uuid": "a0a0a227-426b-43f8-9818-1de7b07a9fbe", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696050665, "uuid": "451bfc49-af0c-4f53-9732-8676df1b1aad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696050665, "uuid": "10a81a7a-efec-41a3-b186-61bca911f2f3", "value": "12669d15a1695d3c5494a45eefed1b0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed75f822-5f61-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696058469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696058469, "uuid": "c943b27f-af27-4488-8fcc-96237fa63700", "comment": "Malware payload (Amadey)", "value": "12a21b562abff71edcd897645a8cd0cd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696058469, "uuid": "6659bb61-b68b-4753-80bf-243c31c38721", "comment": "Malware payload (Amadey)", "value": "35fb345cc29f78ae45bcecad14f0a2803c407ae2b9db2e734435a75ccc84aafc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696058469, "uuid": "32e6c9a5-78cf-48e8-9346-8086993d7648", "comment": "Malware payload (Amadey)", "value": "6278c52d41f61ddd3317a405784f6a7b0f933b44", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696058469, "uuid": "be67e39d-a2c4-4985-b918-50288fb99fe9", "comment": "Malware payload (Amadey)", "value": "51733cf9b25a4c90e14fd9332d31bfb0e381fc3718353bf5f31391f15917cc6e93898e74b00a5b2b2f3af255932d3c47", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696058469, "uuid": "b58e57c3-713b-4c28-9861-edf8a0d345ff", "value": "T1492408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696058469, "uuid": "abd63441-7d0e-42c0-a2e7-4a94942fb0d4", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696058469, "uuid": "49b25d6b-25bd-4d16-9108-5c8376a24970", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696058469, "uuid": "aad3b0ed-40ee-469a-8d37-bb7fc5a89f67", "value": 224427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696058469, "uuid": "f9b281f7-3a56-4395-9353-8c1b042cadab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696058469, "uuid": "766f04b6-0933-4913-b65c-f8b28f53dd6c", "value": "12a21b562abff71edcd897645a8cd0cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8084c171-5f87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696074607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074607, "uuid": "9fa03ec5-33fd-43ad-ace4-a5ae0789c104", "comment": "Malware payload (Mirai)", "value": "0c588e71bf143c9a0f55d27e23964ea7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074607, "uuid": "a2cdc249-557e-4dc7-acb2-a0c38b541e33", "comment": "Malware payload (Mirai)", "value": "368da8ca60d62e60e758d4aeefc8758cacd8e58a0e141c98fa6ee9909c2e960d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074607, "uuid": "61f330e3-30f0-4d8d-98a9-acf29ae7f0ec", "comment": "Malware payload (Mirai)", "value": "76b566a34702cd9eca028898da07b43538c04ba4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074607, "uuid": "9f06aa43-5ee3-4d5c-928c-1a8c1540f2d6", "comment": "Malware payload (Mirai)", "value": "02e94de649132139ed43a5df804647124b66a1683ee0c07980e056fff6966c46a193d14292f55c66409f1cdf8449fa95", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074607, "uuid": "bf8841d7-9a21-4f3b-b79c-7004018191b6", "value": "T152C2F1601A83D871C0720E7ADB7FCB5B960515A972AB34A71718C39841C31CBAFF6E4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074607, "uuid": "f7a56f85-380e-4fa4-b111-59d809b0753e", "value": "768:9VT9kSCVG/S1CMnpxgj7JHlp+7If3UqG1:9VhBCmMnjg/tlp+7N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696074607, "uuid": "dc476c0d-c9a0-4fc3-a17c-c798a72354a6", "value": 26160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696074607, "uuid": "b0cee9f1-9b77-435b-8079-0c1f1bf2ed45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074607, "uuid": "209636a1-e7b7-4e81-8ca0-f84fe0f323ae", "value": "devx.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1af7346-5f73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696066153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066153, "uuid": "baf5de43-438d-4ed0-8552-de49fd55cc06", "comment": "Malware payload (MysticStealer)", "value": "8d1d098f9ba224fafe5f5b6d6f589a13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066153, "uuid": "674c2529-3a76-4621-b2c7-f60fc36fcc04", "comment": "Malware payload (MysticStealer)", "value": "36bed127ff6e554a6ed83d82f1d9930e094943ca2aca070fa95c2151e4650e42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066153, "uuid": "b4f57e77-faa4-45de-b894-5e12176662a1", "comment": "Malware payload (MysticStealer)", "value": "880061f851d14644374867182c33c25b658f2ee6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066153, "uuid": "50db557c-3827-46e6-8fe1-1bce8afa7fc9", "comment": "Malware payload (MysticStealer)", "value": "1441c9a18651fa6ed1a0bd9101dbb4af1734624cca932fba1e470316a0e5aae558fc89f60d8f9f0ee2f7b9e39d4ac8d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066153, "uuid": "c93a8bb7-9753-48cd-8070-82f6ac5903b4", "value": "T14F74BE1134D0DD32E8722B3A4EDC5BF8252EBA604E5566DF47EC0E2E5B203D1D6276E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066153, "uuid": "e7d4c640-399a-42ab-b4c1-c8f4c786d9ca", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066153, "uuid": "9c92c4ea-eb0c-4fc1-8c7f-75e8a9ccf2ce", "value": "6144:sJTeW/s5GqrO5aXnfEGIXWPvZAOdyJMT0Dl+QENqRnjVqcVs0BC+:JmcGqrOk86x+R+BNqi4s0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696066153, "uuid": "28ceac43-4cf3-4672-a57f-a09001b9a8a0", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696066153, "uuid": "e7417d23-6120-484c-b63d-6f2b4a011d78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066153, "uuid": "ac04907f-6cb2-413b-b082-ecce69471d03", "value": "SecuriteInfo.com.Trojan.Inject4.61510.9476.14529", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e826d834-5f9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696082941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696082941, "uuid": "e4daebe4-a731-463b-910c-118bcd169926", "comment": "Malware payload (RedLineStealer)", "value": "578f2f9123a5b99ce37af66d0b1322d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696082941, "uuid": "350c8f36-01bc-4fcb-9b84-130adea00439", "comment": "Malware payload (RedLineStealer)", "value": "386c2b30d0f46306b8691661a0b73163989f6412f903573012b5ba0c35525dcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696082941, "uuid": "6b933058-0512-4368-8559-d4313768fd5c", "comment": "Malware payload (RedLineStealer)", "value": "7f27b8a0faf4d529381c15e044ede6c52a369437", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696082941, "uuid": "f1e6f0f4-8a6a-40f7-b8d0-df309cd1170c", "comment": "Malware payload (RedLineStealer)", "value": "2f5620fad201ab8626f77c0e99d57b5e72f4a89ea02bb9d9c76d4af48e2a3b8b741432fd7cfe90639611f9951bda5900", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696082941, "uuid": "90eedd4a-580b-4254-932d-3bbc0ee9a1dd", "value": "T16B945A15254CC44EF6CDD97A81E6CCB54E626526E2B4429A22F920FCCEEC3B7761720F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696082941, "uuid": "afcdf403-9898-4ae8-b593-794ca9a2574d", "value": "231ae748dbc4fa94aca4a2ab6a3f3a91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696082941, "uuid": "248f55ee-1e9f-4ae9-b55e-c1119ae13182", "value": "6144:VC2CLcc7ylpGKOlOCxjAa9c+kIfBCInzwA7SsOi47VjxqQYT47h0s:VxRc7yWnxjB3BRnzwA7nOZ7GXRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696082941, "uuid": "d1b68029-07a3-4a15-b57b-7eb28e63fd5c", "value": 417281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696082941, "uuid": "fb89883e-51fb-4320-825b-9839b25f9b24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696082941, "uuid": "f849daf4-209f-4172-babc-0305812f3f47", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169349cd-5fb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696095475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095475, "uuid": "87a13d2d-875c-4032-adb7-1060396a5d5a", "comment": "Malware payload", "value": "54c43b68c08945cc84c7c859685d12a6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095475, "uuid": "19726bca-1de6-44a3-b22d-1a0858e26f03", "comment": "Malware payload", "value": "3877d44471fa751f84da84d7ce2d1cd7c802c881e0bddc9227dd1b78c8176525", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095475, "uuid": "3f7657a8-6ae9-4ed2-b7c3-191a135de40a", "comment": "Malware payload", "value": "811a19d339bf29d7b4d43b0ba3921f7288739aec", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095475, "uuid": "88828cc6-2084-4d9b-abbe-7975dcd38941", "comment": "Malware payload", "value": "05d075de8643ca8b8908d6ac5f7962da1b8cf238337d9a067bb7ef7e9eb4ca058551e4aa9a1ffc7605272c8981ae2bf9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095475, "uuid": "4debd480-e6f7-43af-94d4-6ef30b78f9f2", "value": "T15E656BDA2BD8C552C2F52B300E065EC65E6E5E25BE8E40633E4CB50B9F339D4A732D61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095475, "uuid": "d593d33b-70e8-4dfe-a73a-32e970322247", "value": "a6d5186954e13954826e6d368eb82cdd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095475, "uuid": "aed90017-ff3a-4970-b299-15bfbffb2449", "value": "12288:AWTejoJJMXnNRuPg3wRBUZQxqpq30ChwDbonPltVwXU3GAIq2eE:XSsAnrcHRcQa11bUO0IqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696095475, "uuid": "c7d91b75-f27b-4658-99b8-8699a50470d3", "value": 1425499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696095475, "uuid": "3c19c15b-182f-4df8-9b2a-72b405ed948e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095475, "uuid": "7776d41c-e226-458d-8d3a-0a34992c1dd9", "value": "SecuriteInfo.com.Trojan.Generic.8710286.11605.21205", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c321dd3-5f95-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696080559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080559, "uuid": "4c3016ca-364c-4d86-951f-8df905621dab", "comment": "Malware payload", "value": "3175c40ff0c5b9d7346ac0f3772dfaa2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080559, "uuid": "a4c3a54c-85be-45c9-819f-a940e4b5421e", "comment": "Malware payload", "value": "38ddef65caed8667cf609413b6f3c6722542239fd6c8e2ce6fb9cc43a2a3ef0e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080559, "uuid": "c2fb778a-4e67-45aa-a061-0ce0ca9dd3b2", "comment": "Malware payload", "value": "06eeb3f63b5a16e7fdf41c0d17869c2657fd622b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080559, "uuid": "aeb37a91-6e01-46a6-b1b0-dabac72c1eea", "comment": "Malware payload", "value": "6baafc892b6103e61705fa37669cc852b541d220f2f02a69149d7cfa858ebcdfd1004207e593b7f11c34b4648efa1044", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080559, "uuid": "8d0e0426-2058-4153-b905-a1af7c70f68f", "value": "T13B95D082377680F0C4AB06345E27E36FE3705A014F6ACEDB95D0258C9C725DA7D7A39A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080559, "uuid": "06219fb5-abe7-42cf-9ea1-cc1b2a87b73d", "value": "317f9da236ed42b2c51e3ccdbb82e29a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080559, "uuid": "690aa670-3f27-4363-862b-9480321a74bf", "value": "24576:V9ah+UklQtDMSnx21r8bwTjuWrDU4Ag+aDq4Ue764d5G+ZU5s8tbsodiwKUSVQxN:V97UIUgSnx21rLdDMw5G+yftXFFOvNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696080559, "uuid": "7229276f-2270-423f-b3d0-594796e7a051", "value": 1913535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696080559, "uuid": "7364a066-6574-4b65-8899-17393a2dfd8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080559, "uuid": "d0a219c1-9f63-4cd8-a16f-76efa0101369", "value": "SecuriteInfo.com.Trojan.Click2.55197.9468.16050", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dcef14d-5fe4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696114573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696114573, "uuid": "073701b2-7506-4482-a603-45092557c13e", "comment": "Malware payload", "value": "3e54bc559813b3b887de44604644a083", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696114573, "uuid": "d980a9b0-c2c3-4bc7-80a2-27fbf9eb110b", "comment": "Malware payload", "value": "38eca8e8f88a15c11fdfeadf43c454386d27f479eb1235ae4ddaf3958624ba0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696114573, "uuid": "a4cd6a15-97aa-4ef2-842d-a4c2869aac98", "comment": "Malware payload", "value": "6af11930891b523991ee1115c15e9d72b46f3a28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696114573, "uuid": "a5899a33-a097-469d-995d-7d877a3e8b82", "comment": "Malware payload", "value": "388b978950e8fac9d63b19e2b33c8e955f361a816ae4e54448d390940386ff563de95b68aaca3c9acb9e3f5479afeb18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696114573, "uuid": "387982c3-de93-4899-82bb-e3baf3f4d091", "value": "T14E348D2272A0BC51E5776E318D2EC6E83A2EB452CE55675B3238EB5F19702F2C273311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696114573, "uuid": "e1a4ff90-ea57-4dc7-8a03-a100a25e979f", "value": "eb89aa3fcf43b156dad667e281a2675a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696114573, "uuid": "1f0f21d8-c66f-417f-9a75-7132f1680eae", "value": "3072:HDER0MfinkOKUtMSdWxLZ9dUMglZlwrrKST4S5/RFleRATO34:EfQZdWjXUhZ6ZvR0ATV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696114573, "uuid": "7727b482-4d7d-4d63-9d46-53334fce8163", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696114573, "uuid": "eb2727a0-3be2-494f-8d15-48bd5f24e73e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696114573, "uuid": "4f9048a3-dddc-46b7-acaa-beb58e38da99", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6284a383-5fc6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1696101615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696101615, "uuid": "4c41538e-6583-43ee-8de7-8004201661b5", "comment": "Malware payload (RiseProStealer)", "value": "8854d03d7617d8531eeef0779ff70d80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696101615, "uuid": "26411c55-3620-40b2-935a-c2d293e560d3", "comment": "Malware payload (RiseProStealer)", "value": "38f591cec623aa78cf91aa34e13bba63470bf671534536c1a2458598a17128de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696101615, "uuid": "cee58f5e-c7e7-486e-846b-f3f2d9f91ff0", "comment": "Malware payload (RiseProStealer)", "value": "52c4bbbd7eee7f5638f85c38378f7e61cbe3da59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696101615, "uuid": "f37bfaca-95bc-4bb1-a7da-99eda5d5430e", "comment": "Malware payload (RiseProStealer)", "value": "10cb7ecab857a2d82ccced135afdf975a7c95491d1e33b77871f6af9985cb5c118f96fc4050e897cf37badb1031885ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696101615, "uuid": "c55ce112-254c-4267-806f-475999bcab91", "value": "T17154CF3361E17C51E6677B728E2EC6E8FA3FB461CE58675A32085E5F09701F2C262712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696101615, "uuid": "a5d4713e-58a7-495c-98be-36deff428810", "value": "d323d1063364fcdde3ec2d7fc616011e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696101615, "uuid": "5b415282-407b-4b28-a783-6c3f18ddfc4b", "value": "6144:1YNsovb9ia1g8mI3f9JAmW0T6pPrXdpMxLCYrV:1YNsM1fmM9upjNgCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696101615, "uuid": "68cf97b4-1c9b-4437-8224-8932da63df24", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696101615, "uuid": "c3ad3f7f-74ac-4d94-bbf6-a56a72f6ba7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696101615, "uuid": "15aeb423-052c-409b-b3a5-b98ced6bebdf", "value": "8854d03d7617d8531eeef0779ff70d80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3489939d-5fa0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696085217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696085217, "uuid": "60195ffb-466a-4e47-9b30-1c3378d574ed", "comment": "Malware payload (IRATA)", "value": "50034508ea0fa366a4f25df39ca7ef45", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696085217, "uuid": "9c88daf2-a095-4494-8d26-a8f2f70a16b0", "comment": "Malware payload (IRATA)", "value": "39d7bdc9751ffc013822809f86418d7e40f0ce6ca469516d9d0647665e374a7d", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696085217, "uuid": "7363871f-8347-4ac8-beb3-89dd08b39d61", "comment": "Malware payload (IRATA)", "value": "9dc3e0af47e13e6c513625c548b3836c92a6d7d3", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696085217, "uuid": "5950fbd5-08e9-4825-951d-588455d12084", "comment": "Malware payload (IRATA)", "value": "6263878fee426f924e7b1d36c3a03e38e454c6e848e2ed6324499995d6516f3ffeca5087f541b8c2cb55abee927f1818", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696085217, "uuid": "c463fe59-f59f-4d77-ad93-510dcfb52185", "value": "T1CBD523A3F6B7A95FC833C13121851336111A4E19CA41AB873A4573EA74FBCFC87866D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696085217, "uuid": "206f4182-ffe5-4cc0-be70-d5d2f678f65f", "value": "49152:KE7aJyrmt0js2UVvz7ve7fa1W+VNBQFgqHfXWMSJpMk3lOV34dNJ1vmAYJgQy310:KR3u5UVr7vebx+VNiy6SHsRANJIJY310", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696085217, "uuid": "b2581176-b7bd-4843-b812-16ad6c76d5a6", "value": 2748493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696085217, "uuid": "2153d65a-4b19-4df0-8add-0df5ac4071cc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696085217, "uuid": "bf3d5181-b6c0-4260-ad58-2798b33c868f", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4efe2df-5f74-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696066615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066615, "uuid": "10000c83-cc31-407e-a34d-a6beb30271c1", "comment": "Malware payload (Smoke Loader)", "value": "a821d2b2c3a38a1239fcb515a5c7e9ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066615, "uuid": "f7243a64-51dd-4201-81e4-b2081ef5361f", "comment": "Malware payload (Smoke Loader)", "value": "3a4af1c874707ed02912ad75e46f0a5c4e2d06d0e592a1494d714fd6149219b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066615, "uuid": "4baf6d92-d9d2-45ec-bc93-2bf1440c8021", "comment": "Malware payload (Smoke Loader)", "value": "beeed71a60cec4a9440f82469986253925442abd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066615, "uuid": "cc8f12a3-5007-429e-a477-ee060e55f231", "comment": "Malware payload (Smoke Loader)", "value": "db3a27b0307eb2eb38d5c312aaab8e7c532a40ae7e6f8d7eef902c1845b7e0e1086095617369b3b0883136d3a485483f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066615, "uuid": "2c5bba18-53b5-4da5-b0da-0a3d5b61e08e", "value": "T19F448E22A1A1BCA0E56766714E2DC6E87A3EF462CF59676733386B5F0C701E2D273311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066615, "uuid": "2fc50fe3-b7c7-4f01-a993-1775f0723b49", "value": "50fceee6f3fb6eb6577a605eb92d5359", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066615, "uuid": "aa6de950-2875-4901-8b7d-89f94cda0b58", "value": "3072:9XjKeZWBXtW//efgB7DBdCqDi0iuCGCIe8AuXD7h15V8KtFiTC2:5Uo//5B7VdUIeEHT1tFiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696066615, "uuid": "08032347-3454-4ada-a03a-2aa4069ac2d9", "value": 254464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696066615, "uuid": "ce76c823-4b7d-485c-afd9-b6251456da67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066615, "uuid": "d598fbee-9d90-4784-953c-933193b4f77e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858ecc90-5f7c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696069891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696069891, "uuid": "c8a883e3-6a36-4ab3-94b6-3d2c85340259", "comment": "Malware payload (Amadey)", "value": "768539e26747a828202296e12eafd9c2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696069891, "uuid": "e191de27-2b4e-40bf-9762-dc39cd424041", "comment": "Malware payload (Amadey)", "value": "3b39ae35a37e7ce527857e14eaebaa6278b46bf9eed608b8f88831f4443a6eaa", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696069891, "uuid": "855a2332-324f-4010-a7b5-d0570fd40137", "comment": "Malware payload (Amadey)", "value": "76165b84f509a64dd26b1320998d4746eba6a158", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696069891, "uuid": "7459a55b-dfeb-4069-bb3e-b5f361cdc03c", "comment": "Malware payload (Amadey)", "value": "a5392393dc03bee9dd211661b4ef11b54eaa25fe932b12ea2d2abd04a30b1dbba9ac36e38fea03b053fe8b374c200779", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696069891, "uuid": "cd3daa52-79c3-490e-95c1-53e3c5baafec", "value": "T17B2408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696069891, "uuid": "cb01c94c-8ef8-4db9-962f-c8cc81bf6c30", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696069891, "uuid": "edfe6166-9949-4ba7-bd0a-31d801c53f5c", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696069891, "uuid": "539daf22-a85f-4682-a8c0-cf54f11a65f2", "value": 224675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696069891, "uuid": "0e80cf32-8e43-4478-8548-faaf2628ab76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696069891, "uuid": "1697627d-2c04-4af4-936c-c29ba1529781", "value": "768539e26747a828202296e12eafd9c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fcfbe94-5fb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696095463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095463, "uuid": "54779309-4199-4c36-9fc2-2dcdf7d25a7b", "comment": "Malware payload", "value": "16ac6ffa1e3c384cb9d82cd29e76137d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095463, "uuid": "f5f48900-5460-4351-a53e-dbdb5cfe0371", "comment": "Malware payload", "value": "3b946a58ce49ce435f861f868a19dce47bbdde166a5826826097bd04a13ec74b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095463, "uuid": "307b5671-db93-447a-a2d5-6de3ddf63562", "comment": "Malware payload", "value": "d3e01ce515843d903727ff2c0e4784e84135a323", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095463, "uuid": "d581da37-66b3-4a93-8dd0-d2ee94652155", "comment": "Malware payload", "value": "1f98dbfeb02cee0200f445ff0c7beb7540950759fd0541a992ef96fc943a9a33cd9173a9f0f16dee8667b4b6243cff97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095463, "uuid": "41ff20c1-59ce-4f16-a870-d2c8becf26c2", "value": "T1085522F466F7DD97E004D77F8844BD318917017E671B96A9EA84372FF4A2209EF0A109", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095463, "uuid": "fff4fe5e-6f17-405d-9997-facde692e58d", "value": "e710feb0eb6204d1acb452f545c64c30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095463, "uuid": "f06cf557-2559-412d-9ea7-01a3f6ed1900", "value": "24576:57USTEdH0+9Y/3veLZjEfNxohARLQqaeoPGfTtK/cRgOnmq9g6OB36rKX67:5xkH3Y/3vedYfDoheDaLPJcOU7m6WlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696095463, "uuid": "f33118e7-1928-4001-89fe-08d1a5e6be91", "value": 1336582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696095463, "uuid": "6b6892a1-45b6-446a-a523-0072abe9cbad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095463, "uuid": "d6cfa0d9-be8d-4db8-92f7-14eb21dfb41c", "value": "SecuriteInfo.com.Trojan.SMSSend.3052.18588.32457", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d220808-5fd6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696108505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696108505, "uuid": "7a8582f1-1b4b-499a-9043-74b9864ced05", "comment": "Malware payload (Mirai)", "value": "32bbd20537427d66c0c881489e9f87be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696108505, "uuid": "5c5ce75d-39dc-40af-8c1f-502733c9f60c", "comment": "Malware payload (Mirai)", "value": "3bae990296fc18899d3490b9f95915cf998f4db54d4c0100b62d6e4a73383cf2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696108505, "uuid": "caec2a79-df9e-403a-b938-024ede32da42", "comment": "Malware payload (Mirai)", "value": "47bb7f037076df6d4e2c6b86c53e687372ae3a3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696108505, "uuid": "c3d09930-21e0-4f4d-9e62-5c0abb1236b7", "comment": "Malware payload (Mirai)", "value": "d2ceb95d4d556c7c46a42f98cd7c174bb5a70a3d2a8a88c398fe38df423e14dd463b540dcd1a949c23aa6ba2b795a7df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696108505, "uuid": "5cc6407b-8a0a-4f7b-8bfa-3c6a4c4e1c46", "value": "T1E5C35A89E5C3E5F6EC004A78346B9F31D977D4BF213ADEC6E7E86D22A815541C1032AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696108505, "uuid": "b4a71065-574e-4f4b-a67b-2dc35100c718", "value": "3072:rbasBpElV9cT2c4ZnF4Jfwmvx1J7oCHLs/qljpL66yzV:/as3ElVmT2NF4qCx1Hs6pS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696108505, "uuid": "0c210d0d-1221-4ded-815f-20e4cc58ae65", "value": 119696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696108505, "uuid": "5892a402-e93b-4011-a56f-fcf2f48449c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696108505, "uuid": "606d41f0-f41c-4c04-9123-d03bb3933401", "value": "yourbiggestnightmare.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea099c7-5fa5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696087596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087596, "uuid": "dc723da2-5647-4618-9629-578cfa7059b2", "comment": "Malware payload (Amadey)", "value": "ff03dafc39978d6af445d3de10a223b5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087596, "uuid": "8c5ec99c-570c-47f4-8689-50192f0707a5", "comment": "Malware payload (Amadey)", "value": "3c3eb7507299a6cc5be59bc180fcbd32cf72bd0759bca78269686c7f25d46c67", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087596, "uuid": "3bd66379-e2ba-4817-8f02-d0aa51e02b43", "comment": "Malware payload (Amadey)", "value": "93f2c294a3e4a6c693c716c1ff92c8ec42eb7774", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087596, "uuid": "f12387bb-1704-480f-b9fb-ea8c6e2b4a6c", "comment": "Malware payload (Amadey)", "value": "52a76891f008a658e47a4058ba7ba6a34c7d9697a51f3a2731d6139664271f0e96efe1fc01237d7d285161d0df8474cb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087596, "uuid": "d57513f8-f83a-4d53-acdd-70b09d90b173", "value": "T11825225A97E84033E8B5237044F6178323397DA18AB4C3B73686AC4A5C73EC19934B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087596, "uuid": "cb2d58f2-5db7-4d06-87f2-4df44838f339", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087596, "uuid": "f33dfeb7-43e6-4fca-a71e-029cdba4e7b7", "value": "24576:1yjD25kINOYEIl0ark8IGvoghAU5F65fbtKo5E9v2hE/xoRM0:QjZIYKCarkSogCUGVYo5Mvf/xoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696087596, "uuid": "18cb0f64-4c5a-46e3-b181-d774a176d320", "value": 1018880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696087596, "uuid": "905e60bb-5ce2-4f02-9249-ffd305b1e395", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087596, "uuid": "0fa09a3b-dd62-4db9-b797-78ac518f7c2c", "value": "ff03dafc39978d6af445d3de10a223b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f2ac92-5fa3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696086716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696086716, "uuid": "cf92c2b1-35bc-461c-8d69-0b692de15e52", "comment": "Malware payload (IRATA)", "value": "a74ac58d2142128505dca5898e743210", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696086716, "uuid": "a46535b2-4b1d-4ca5-a9d8-24dbfdca20ad", "comment": "Malware payload (IRATA)", "value": "3c7b79074767704bff3ec266e2b006c8e28ca12f921b17f50472fee57aede29d", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696086716, "uuid": "37158c27-f31e-4dbf-9efe-5ce476d0de1b", "comment": "Malware payload (IRATA)", "value": "cc2c6cd5868ceb02093ee613102a05ff980c52ef", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696086716, "uuid": "7677ffad-7acd-4a83-90d5-23c42ee8bcda", "comment": "Malware payload (IRATA)", "value": "be78cd965de771c76742e3e8f9ab6b85a0a652ef06a2eebd223e6bee4c78ec6b0f4d2f63564bfd49d574f83c7b4bcc97", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696086716, "uuid": "0d995241-d55b-4b3c-b871-ae8234ec4bdc", "value": "T170851213F266B507C832C1322445273961069D19DD42FA4A398D37BE3FBBEE84F856E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696086716, "uuid": "c5d4ba19-c5f4-4c45-b095-c5ef31f5ba40", "value": "49152:Bs/ikkp7XQoio8uuWoTc1T3suZUtaFB08isds:eikkpXn8XcLsFO0Mds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696086716, "uuid": "8de223fa-970d-45da-b038-8e530f8c2340", "value": 1867005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696086716, "uuid": "a6963453-e106-4900-99fd-668860c6e573", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696086716, "uuid": "629d0908-b192-48d9-9976-500da63fc999", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c349ac-5f7d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696070484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696070484, "uuid": "97106514-9801-4ee0-bc16-ae07d29b1115", "comment": "Malware payload (RedLineStealer)", "value": "dc062986a0acf016b2fb5edc0d9c3a4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696070484, "uuid": "e4b8398e-7838-406a-8af2-87745a5262ac", "comment": "Malware payload (RedLineStealer)", "value": "3ca27f58f147d0a2da8a868f8e73c7cd5917106741d67ce79ceb88622ae2d428", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696070484, "uuid": "040dcd62-8611-4da6-b912-24a5b028452e", "comment": "Malware payload (RedLineStealer)", "value": "187cc01b5d1525b53e4a2b0608a90b413244a388", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696070484, "uuid": "105d3fd8-0fe7-4ddb-8e8f-6a9f1b2e5927", "comment": "Malware payload (RedLineStealer)", "value": "75718d47b1a766b438c34344e50c8d25291f24b4508733c12f2316871321276c95b668b8dc6a7b6d891815c46d08274c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696070484, "uuid": "2d83fb42-ff6d-4633-aab0-1ba9690413af", "value": "T133352311B5D989B3C87217B009F782C71A363CF2992D0A7B3656ED861CB2AD1B532377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696070484, "uuid": "ed5780e1-336e-4e4c-99e6-e9febe07829e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696070484, "uuid": "4186a6ee-93f6-4062-86ef-e00758661857", "value": "24576:MyAApfcUUWSF8bGQFVmrw54J4Mw1C7r8LHveC2bGekz:7rRcU48bGQXxMwArAHmCUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696070484, "uuid": "30aea493-42a8-4832-ad72-26e8d36c6f0a", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696070484, "uuid": "6724f4b4-aa45-4cb9-99f4-99f9b79ca85a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696070484, "uuid": "f0520b0d-227a-4840-a185-6dc8e854a20c", "value": "dc062986a0acf016b2fb5edc0d9c3a4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f1fdde7-5fb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696095462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095462, "uuid": "808509d2-508f-42e4-b7de-7b049f6d93aa", "comment": "Malware payload", "value": "8cb698075d9018280139fb7c3aa79673", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095462, "uuid": "1d9a0971-0ce4-4a9c-a3e5-64794376d420", "comment": "Malware payload", "value": "3d04e3e3ca18e2a313be6ab4ed837e31d4e2587341835267717b7b93a0b8ccdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095462, "uuid": "93ec2fa3-13d1-43b0-a4e8-647b70395822", "comment": "Malware payload", "value": "2d4a132d1db15dd5d11a032527d741df043ea1c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095462, "uuid": "cc21438d-faf9-4b93-8de2-5e32231014e4", "comment": "Malware payload", "value": "4cf71694b4f564637a7a1d788962e95090b57de6915a5715e8fb4a646495d458880f1dc602d15968fd7cbe1d9f144146", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095462, "uuid": "6033325f-2ca0-4a16-a506-2d66d2a534f2", "value": "T197E4CFCAD16944F2DC093FFAD81427C39B294A325AB400583EAB7D494F771EAC05DEE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095462, "uuid": "6e411063-c629-4fcb-bbd5-0eadf27c0c25", "value": "d03492041b6703ca9bf1935561397b27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095462, "uuid": "30c114be-c855-4839-9c15-49b61e693236", "value": "12288:XezJzog+Dwgbonn2OoKC7aopAx6Y6F6sCrv+V7j1r:upoHBknnrCuWi6xF6sCrv+RjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696095462, "uuid": "a2875fe5-f76c-4068-9909-720a7997f145", "value": 669243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696095462, "uuid": "1cf4120f-4127-407f-99f8-679801a627ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095462, "uuid": "2f8a8d39-0e27-4406-929a-d85364629ea5", "value": "SecuriteInfo.com.Trojan.DownLoader5.5241.20690.21644", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81aae1e-5f72-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696065681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696065681, "uuid": "8775cdd4-83a9-44a4-8904-bcf008c9ec76", "comment": "Malware payload (Amadey)", "value": "cc877a6758666b7cc93b104f64fe10e6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696065681, "uuid": "c2dbd0b0-e5d4-4c8a-9616-d8be39f6ef2f", "comment": "Malware payload (Amadey)", "value": "3f05fa13fc8fa66ccce4360bd4579998b081cfb096faf148e7df1a84f487dad7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696065681, "uuid": "10e556b6-65d8-4f66-9523-9fec14d67129", "comment": "Malware payload (Amadey)", "value": "a3750bacf4316ce1a35ca0dc2939cf222eccbf1d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696065681, "uuid": "d772b977-4cd1-4712-aef3-ea7860b0410d", "comment": "Malware payload (Amadey)", "value": "ee30cf44a26b0cb1922ce41a86dc7bc098929b0ec4d851804e5dafbd90a9696693d8a9e01c081179f1a141555abe6ceb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696065681, "uuid": "bcfdb3bf-ee19-41e6-ba51-254e91330315", "value": "T13A352397AAD218B3DCAA23B54CF217870531BC4045B8C27F67D9E65E1CA39D4EA31327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696065681, "uuid": "02381e54-522c-431f-b834-b8c6cb4a1ded", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696065681, "uuid": "3dcc057c-e45a-402a-9a3c-4f335eb1548d", "value": "12288:9Mriy90DO2jm/aTCHWrGRRNHVc5MXvxfCx5sJwzih14ZwcWqFSVl2ZXZPLPKs+hU:by6jTfkRcWpax5qw2r4ScGVgvTmZF7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696065681, "uuid": "70f1ba4e-4ff6-43f9-b957-13228aed8fd4", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696065681, "uuid": "bbb2965f-903b-40ec-8351-79dba840c8e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696065681, "uuid": "a472a4b0-ac27-48ce-a816-139fa0d4b1b8", "value": "cc877a6758666b7cc93b104f64fe10e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2575d77-5fe3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696114204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696114204, "uuid": "2453e319-b5d3-4466-aa1b-3f319752083a", "comment": "Malware payload (Mirai)", "value": "675263115e33bfc579208cf24e2986cb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696114204, "uuid": "6127dc09-9155-48d9-b085-b007a3b70e3a", "comment": "Malware payload (Mirai)", "value": "3f94007551ced217a1e15b3497dab684db583d6bf8dd67b1fd68b05e143a1fc6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696114204, "uuid": "df6bc738-074e-4c39-ade9-70b272c78724", "comment": "Malware payload (Mirai)", "value": "2923d6596afe6fb84d979ec6f5d2cd79108acd97", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696114204, "uuid": "c24da97c-6d34-47a8-804a-b2b515c3e48c", "comment": "Malware payload (Mirai)", "value": "d7d27921225209c535520cc930ab6a7138ebf2f8751660b4e56dc997e4e0670b5d06d86a5c887427a52c42171bd8b51a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696114204, "uuid": "9c7c1096-b093-4e99-a572-aefd70446c8f", "value": "T1D3C33B46E6818B13C4D61775B6EF42453323A79593DB73069928AFF43F827AF0E23906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696114204, "uuid": "3a61dcdd-5db1-43d7-b1cb-80629a39c7c2", "value": "3072:AQO3WqALOKMoMuPGYlqqiaoH+EuNM/9cE:AQO3YXMoMuPzQqYH+E4M/9cE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696114204, "uuid": "21a47534-b11f-4c7b-bf76-fac50e8c0f8c", "value": 120446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696114204, "uuid": "f8020a97-a42c-48e8-83b7-46aa00765c51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696114204, "uuid": "a13ad48c-7d4d-46fe-a9c6-5bd65dd56afa", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3ae811-5fdd-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696111429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696111429, "uuid": "b56642e9-b8ac-47b3-b48b-911a6de64cb7", "comment": "Malware payload", "value": "de711448a9a7b3b633130c0b187ed5db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696111429, "uuid": "1fb7509b-3deb-4e1b-9afb-4dc16dc7c523", "comment": "Malware payload", "value": "40be2a6263dbc52ad61fa8a7704101479aa51ac1636215061b88876f5fcf34a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696111429, "uuid": "a34df01d-7808-49d0-8e7b-16f91a4f125f", "comment": "Malware payload", "value": "d9c079007f23f8a67934c015a6d399262d3e2419", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696111429, "uuid": "e444b26e-9f4c-4528-be06-7c6eb5b78321", "comment": "Malware payload", "value": "7a8ba36150d69cc2af95486cdc4a047d1f06b005d290fec282d7102a4936e508776c53ae5b453ddf18833b2b742dcd32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696111429, "uuid": "e04e7f9e-c329-444c-9524-ea8a3139aef4", "value": "T11D84E12362E07C74D5766F728E2EC6D87A2FF461DD58975A32181A2F29702E2C2E3741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696111429, "uuid": "91ed018f-2e20-46d0-ab68-7e4df02abeda", "value": "eb89aa3fcf43b156dad667e281a2675a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696111429, "uuid": "4a4f2d17-d44b-4af9-991c-88b995773962", "value": "6144:fI7wxBrG5+mK4iwHHvkwoxxbLBOn6oD2sAoH+JTYuo:fIELrGYmzHHsJxs6Y2siJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696111429, "uuid": "0d0375fd-7478-41d4-aec2-ddf42c520e99", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696111429, "uuid": "bafd2607-b148-4cd9-9ea3-ebede44e65da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696111429, "uuid": "a4eab62d-3da1-41e5-b319-ff8f691ddb09", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9caa6a8d-5fe1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696113309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696113309, "uuid": "af58806a-62ca-4c02-a72e-e45b8d0208ec", "comment": "Malware payload", "value": "957d853736cd6c27ab3fa4ed491d1a96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696113309, "uuid": "4e7654a7-d03a-44f5-8f93-a1aa984b8be1", "comment": "Malware payload", "value": "421f7e7128482d501fc4c7d44748061d9572f8a1b053bd07cb5fe16e9dcc4428", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696113309, "uuid": "ca136e33-8409-4db8-923b-adf62ef3d7dd", "comment": "Malware payload", "value": "db355f36fcda0a3fec9308bd532fc706b80deebe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696113309, "uuid": "a84fedd1-e9bf-445d-8ed2-f291f833436e", "comment": "Malware payload", "value": "e6c26c872ab37d6331b58632e72baa6aa9cc3d239d943f910259769d780bb553dd9ae7f6a38188c1a2cb7f1ca5fcb916", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696113309, "uuid": "28233a14-3913-49d1-ae11-308be290c067", "value": "T13A349F6361B0BC69E5676B718D2EC6E83A6EB413CE58675B32186B5F18312F2D233311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696113309, "uuid": "609c31ca-b319-4fe3-933b-632f15ed4a85", "value": "eb89aa3fcf43b156dad667e281a2675a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696113309, "uuid": "f831ec84-b5f8-4287-9021-b243f1c49b51", "value": "3072:53kEZR5xvQU2uQ/bY8YYlf63NX4OqS5/k16ATO3:5xverUf3KO5dAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696113309, "uuid": "ddff9744-de63-4030-a818-a17b93f6e732", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696113309, "uuid": "38f14408-09d7-43fa-8af9-fe38053e9f90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696113309, "uuid": "379cc065-eaa0-4233-b87b-64ea4640e8bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff22bc10-5f49-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696048191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696048191, "uuid": "146cfd3e-7f37-4e84-b90c-8bc902d78d7a", "comment": "Malware payload (Smoke Loader)", "value": "41c9c400b6f5d64bf97683de2f73ca02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696048191, "uuid": "d67466d0-75b9-4e2f-9dad-3d3056a5a8b8", "comment": "Malware payload (Smoke Loader)", "value": "424b91183f288fd473d93fb11f150fbc2575c615182121bbddcf82af6d496b80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696048191, "uuid": "78766919-385c-4314-9769-bde9c377a23b", "comment": "Malware payload (Smoke Loader)", "value": "35040ac37592f12a22dbf14ec4341a3fc82ff49c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696048191, "uuid": "0e859be0-7587-42e7-9494-bac0f39c73ce", "comment": "Malware payload (Smoke Loader)", "value": "356d58d366974b5d6eb2dc1eeb0d8cab78e6e36510550976fb60ddce7be36baa5f25c4c2e43cb3de322f27020faec189", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696048191, "uuid": "f2c5ca47-186c-4dd7-90b2-88842f48d5bb", "value": "T14E34AF11B4D2C072DC7215360AE4EBB9593DB8F00AA55AAF67E40F7E4F70381D632A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696048191, "uuid": "e86a20e7-2e66-4c72-ab6b-c8b661ddb034", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696048191, "uuid": "22087c57-06e2-416f-81f2-553334a28f66", "value": "6144:q107dHH5YhBWPGmoQz33/g/vZAO4moafs0BC+:dNZYhBWOQAx6mows0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696048191, "uuid": "69f4539d-f3c4-461d-971b-7461bad81dbd", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696048191, "uuid": "98b97cff-b571-48ef-8ee0-436ec7c8093e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696048191, "uuid": "6591718a-3cee-4f87-889c-3de05fd4dce9", "value": "SecuriteInfo.com.Trojan.Inject4.61512.13284.31394", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e623595c-5f9d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1696084227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084227, "uuid": "89cdab91-ec83-4c2f-b660-f5d0b483bc2d", "comment": "Malware payload (RaccoonStealer)", "value": "0d4ecdf785567fc93e61c9c2ec870d76", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084227, "uuid": "9e11e71c-ee78-4369-9f6a-6446f85f48c6", "comment": "Malware payload (RaccoonStealer)", "value": "42c62ee6b5b32c04cd61f538cb8b2d6c5fb4a8ad86fb799c85610e737f78b16b", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084227, "uuid": "5682ac9e-d8c6-43b1-ae96-fae8c10c08b2", "comment": "Malware payload (RaccoonStealer)", "value": "c8e448b5af44a6f0348cfd571f3bbec9f46f6362", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084227, "uuid": "e394628e-3655-4398-afc0-7bca8f5ebb4b", "comment": "Malware payload (RaccoonStealer)", "value": "d90976b0dcbe44810de89f2410c89d2624892f6ddcce996afe0b2af663bb5747ecedc068bb57c5be1604c818dbdf6295", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084227, "uuid": "cf4bda1e-fcbc-4390-af78-439454460bff", "value": "T139F68E70EE44125B1E83179FACA256D3A93CC51193022268E99E039D2B475DCD3BEFBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084227, "uuid": "80f0e3e4-367e-4543-b3bb-48755ea813ca", "value": "98304:EzMQxzZOpHqkJ212U6gumpbJOAN+ZFtNzdoy86giRH2uj+Qvy44:Ez3xzApOwBgumRJlN+Tdoy86N2gxv4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696084227, "uuid": "c821e5e5-e552-4846-97fd-240cd5634523", "value": 15496356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696084227, "uuid": "5a6e2d06-a677-44de-9655-28188ad4246f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084227, "uuid": "9c6864bf-5cae-46a8-a563-a45cc9c4a418", "value": "Certificate Renewal.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b5c9dde-5fc3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696100422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696100422, "uuid": "b424b99c-27d2-4b1f-a0b7-e8fa422bc46f", "comment": "Malware payload", "value": "32c763a684e47cef7297fd321d5afb49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696100422, "uuid": "3615c044-07a0-427d-8c5b-3c640d4b76d2", "comment": "Malware payload", "value": "4703842afc272da5313d52883fff8c573b23198b62328ea8b9633224a8c61d20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696100422, "uuid": "8b491ba3-72cd-41ff-96ca-182892ded643", "comment": "Malware payload", "value": "504d9c19067b6c180cb0789bf538d625adf817c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696100422, "uuid": "3225febb-d194-434d-bbd8-d7989d525d48", "comment": "Malware payload", "value": "1812f13822840a2ec22ce950c7924d11feb2caabc933434376aebeba6ac55ed1a02cbe9c01b78dc57a5d8f9916c0c159", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696100422, "uuid": "92e58bbb-405f-47ac-8376-6c26cd60960f", "value": "T1BFC33B0CEA54576BC1E227BBF69F428E33338744B79B331646285BF43BC67AA5E21405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696100422, "uuid": "1f1688d2-3555-414a-8232-e925ced3536a", "value": "1536:w1nydxqYu5lV5glq7sg91R5elFyX7ixVLYvGwnn3XUtbPzw/9d4rQNqf46:1xqnnglq7sgJZ4VcOa3ktLM/9kd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696100422, "uuid": "cac4cef0-5914-494c-8c08-60b6fdbd3a5a", "value": 118422, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696100422, "uuid": "0b682789-50db-416c-ac95-60923353710f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696100422, "uuid": "5d73ba7e-b656-4596-8bad-fc764a13ac5f", "value": "32c763a684e47cef7297fd321d5afb49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "604c93c9-5f39-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696041052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041052, "uuid": "4dc91309-54d7-47a2-bee7-da37797211f6", "comment": "Malware payload (Amadey)", "value": "bc6bccb27a33d41e0cfab18541ddc784", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041052, "uuid": "6ef3b0a9-63de-4678-b0a0-44d80b423cf2", "comment": "Malware payload (Amadey)", "value": "47eb130155b18afacfa9ed43606f57e08fabdba02af3d01ccce65522ab8d0ec8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041052, "uuid": "841b4077-26af-4cde-95f6-6b62cdaaca4f", "comment": "Malware payload (Amadey)", "value": "f48cba4a2386f86de453c2c7e6ca08815aa67c82", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041052, "uuid": "4d9cf40c-f028-40a5-b64b-2386a235c0fa", "comment": "Malware payload (Amadey)", "value": "9e1ba98c6857a7afffaba16a35335a59297fb08e5d1e24941a7295a1bf5a02a2734b8c058d12dae00680a0d7a8eba922", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041052, "uuid": "f646be6c-7a91-4662-8912-25572505ad7e", "value": "T1A92408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041052, "uuid": "bbc5e1ed-6fd9-4c8f-83e4-10172bd5fadd", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041052, "uuid": "90ac4fd1-5e5d-4b13-8a0b-234b4983f6dd", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696041052, "uuid": "612fa142-b2e9-4c38-87d1-89d50969a7e8", "value": 224275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696041052, "uuid": "b1507d52-5cd3-44e1-bf5b-c5eb2de8bdc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041052, "uuid": "e6db2c76-5fd5-4aa2-8c23-a1af37c55bb6", "value": "bc6bccb27a33d41e0cfab18541ddc784.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4dad054-5f5b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696055770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696055770, "uuid": "bc3cf95e-790b-4abc-8cf5-4d217c38a02e", "comment": "Malware payload (Amadey)", "value": "146945fe5b3082f50b332d37eb05c2bf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696055770, "uuid": "2579d6d5-0bac-4085-a637-669b4c110474", "comment": "Malware payload (Amadey)", "value": "484e717fa5010835e6621e2013f561f6f3245f0078b2ddc7971c65489b607bed", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696055770, "uuid": "59fa286f-62a7-446a-9cfc-090a5fb161e0", "comment": "Malware payload (Amadey)", "value": "e684b21576db8b4835b694e6dad3e7f0e2bbe2ad", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696055770, "uuid": "86cc6737-e2b4-4b43-b8c9-6519fea8026b", "comment": "Malware payload (Amadey)", "value": "00e93a16fc2f05e7f5767c5a2cb05214ae41e595f14bdbfcadca773d874cb142191617799e804a113e35bf5ec3bea65d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696055770, "uuid": "ab083aa8-16c1-4b2b-b113-d4d839a4480c", "value": "T1792408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696055770, "uuid": "61e2e27d-d40e-4c11-8ba6-869625c4b4b8", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696055770, "uuid": "7cdf8a9a-acb6-4cbc-91f7-5a6ff2891d71", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696055770, "uuid": "ec2b7bb6-bba4-41a1-bbd0-73c736ad0aa6", "value": 224408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696055770, "uuid": "82df578a-b5c6-4e77-9d79-86c060d86f6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696055770, "uuid": "1bfc2743-ab5c-469f-815d-7768501fb453", "value": "146945fe5b3082f50b332d37eb05c2bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588d9a57-5f52-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696051777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696051777, "uuid": "7bd0b430-f711-4c93-bfc4-5c48ff3a3930", "comment": "Malware payload", "value": "152b342fd75250233fc16e8e911d930a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696051777, "uuid": "8d28ae9f-0afc-4a8b-b8c7-86cd6f8cfd36", "comment": "Malware payload", "value": "49286f0e2951a1c5a10e0b3a124583d99785418ab64d54b2950144adf6e83e00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696051777, "uuid": "d5e9bacf-a257-4147-87b1-9de11a12e674", "comment": "Malware payload", "value": "52bf1ac2dec56f472de8f7b49f3fa712f1fe6cf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696051777, "uuid": "90b2d696-838b-4565-94f9-44e6a1a409b4", "comment": "Malware payload", "value": "dd89fc428cfb6c4b3313e73c4ac8b11b0adc1cd368c29ca6d92794d13b58b9ac3973797f1c43063b1f0a9a591abe6594", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696051777, "uuid": "ee70c664-e38c-4696-b9e9-fdcb8d3b7bb5", "value": "T1A9B533337BFA11FFD613353189189F7562AA939C46202CAB1320C90F2B3C5A1D7697B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696051777, "uuid": "59fbe7e0-f3a2-4fc4-af22-4d100954fba0", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696051777, "uuid": "3b6c2719-7a8c-476f-9bac-88327404d689", "value": "49152:mcBIX10t+zDHZvSy0wcxD+WDoms4WAjrHSROCuiloiBd:mlX10035vSdhlQmsd2HcOCuiloM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696051777, "uuid": "0b81f6fa-665f-4cf1-86a0-c4b970170c09", "value": 2297655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696051777, "uuid": "b788603b-ebca-4907-a0f4-0261c9d5909c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696051777, "uuid": "dc4b1f53-939d-486c-b65a-b1934441a9e8", "value": "SecuriteInfo.com.Win32.Evo-gen.3759.26923", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832fc671-5fb7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1696095227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095227, "uuid": "64b6d19d-1530-4538-914e-22f5cdf7b1fa", "comment": "Malware payload (CoinMiner)", "value": "df1140c4a0959c2e59e222f1138aa72e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095227, "uuid": "80482056-300b-46ec-b428-36ea498b3c72", "comment": "Malware payload (CoinMiner)", "value": "49b659d1ed9482d0f9ca08627135876fa15eafc8a5a7ba050202a587ea039955", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095227, "uuid": "13a67231-a28a-4cd5-bf61-752375fd8f4d", "comment": "Malware payload (CoinMiner)", "value": "31ef4f0ec497eeed08e241fa00f5a9d615b1558f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095227, "uuid": "bd8a2c40-4219-4265-9c1b-0a4e0df434e9", "comment": "Malware payload (CoinMiner)", "value": "7cad0504de2330745d5b77d064b9ad54101016cec3c3f850671b28a8f876489a21d543b5ee0b36329b51ea9ca4bd4ee9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095227, "uuid": "c81aad1e-9856-4de3-9791-de69ffd460e7", "value": "T1A3940216EBD48432DCB62BB05CF602C31A367CB15E78836B2751694A0CB3AC5B97573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095227, "uuid": "894c34c0-8a4c-46ce-9cf6-e91dc2a2e406", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095227, "uuid": "fbde330c-6dc9-4415-85d6-2e20a8c6477b", "value": "6144:Kly+bnr+Rp0yN90QEShyGmyLnL3+JI3amIEMVy0ps65dNDD2r8zgHMa3Wes0kPOT:zMrxy902mnW3TsXR5dNDS8zgcesPOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696095227, "uuid": "6a662165-0abf-4f16-97c8-7702efc71bfe", "value": 441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696095227, "uuid": "657c4a32-3415-4447-be1a-a36ca16c6aae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095227, "uuid": "96046c12-5fb9-4527-a390-85bdbee4147c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa27db9d-5f4d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696049766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696049766, "uuid": "f9956452-ecde-438d-ae5f-f4f5a71ad81d", "comment": "Malware payload (Amadey)", "value": "98a1b164a910b663aad4545826a5b25d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696049766, "uuid": "64fcd93d-6d3e-4f01-b079-920eb1eceb17", "comment": "Malware payload (Amadey)", "value": "49c3ad74e1be0eec0996896f06e3f0d92af612b24318a476b9e0bfdfc851d719", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696049766, "uuid": "153ccab3-e6fa-4ed5-9067-64ee5f878ae9", "comment": "Malware payload (Amadey)", "value": "71103c0494c1fcd5588845a0cb1912ad3c273464", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696049766, "uuid": "48704f1a-7879-4fba-a076-1c9a3440f510", "comment": "Malware payload (Amadey)", "value": "0fcceb963d076631758d2717ef89452950cd71d88e661f855ab7ba4b4bf5717d15f0f001f3eb64dbc7da69875c0967ef", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696049766, "uuid": "b6053565-95ef-4522-bae8-7f7236af3a9c", "value": "T1A834AE11B4D1C072DC7225360AE4EBB95A3DBB300D925AAFA7E40F7E4F34281D661E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696049766, "uuid": "e6d94255-827b-421a-99bf-19674fcfece4", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696049766, "uuid": "cf00d008-5dc9-4439-875a-ae53ae3138d5", "value": "6144:4fz4SHy5uoBMFGV5PEkIXEHvZAO0nwnRVs0BC+:ZCmuoBMUOMxO8Ts0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696049766, "uuid": "925d1aee-297a-4c62-93d7-84eec43a8878", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696049766, "uuid": "d2e393cd-aadd-42e3-9abd-613069c44b3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696049766, "uuid": "c34d4ef4-ee31-4ea4-8769-b48c6d5724fb", "value": "98a1b164a910b663aad4545826a5b25d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4781681-5fad-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696091042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091042, "uuid": "4c8597a7-f462-4591-9350-757f70bafed1", "comment": "Malware payload", "value": "70928f07076ca83678812570f1e9f05c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091042, "uuid": "d01475bc-6219-4c7c-9a9c-4d70550b8577", "comment": "Malware payload", "value": "4a20d88652a74ef776db2ace59a63815f3c446fb62f7d443145a97158ec19436", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091042, "uuid": "e5009080-2237-46c3-808a-0681e6bf06c2", "comment": "Malware payload", "value": "9900429544963a60441ee1ef841eed87eeebf69a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091042, "uuid": "cc6836f4-4bae-44b3-85e6-57e1281ff128", "comment": "Malware payload", "value": "658c0f76a88ed552b122e4e9472f53130fcf1a86a73d59b9d5fe123cfd15795ae13ca43c691cb2e5f73ff73721a86dec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091042, "uuid": "5b52e590-9bba-43be-8b99-73e42ffbe414", "value": "T1EEC6234ABCA14979C07D933158B769543B71BC444F3663CB2B90B6BD2BB6BC04936B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091042, "uuid": "bc145ecb-9e85-4eaa-8938-89cbc8cba730", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091042, "uuid": "0e8c61b5-c417-4bb5-ab10-70b863bb77cf", "value": "49152:fRBZj7amA9VSLGmJH77dPh89WU4OYDVD/ZnxMBStAkAqvlABXj6TKol4NWFg/Bbv:pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696091042, "uuid": "55c370ac-a7e0-4787-a240-39af1a71f9a3", "value": 11802112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696091042, "uuid": "8fd2f7fc-a6e1-4033-821e-d036ac2e21c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091042, "uuid": "ec7ee74c-90ff-4f1c-b08f-44565d44c213", "value": "70928f07076ca83678812570f1e9f05c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e9d1f5-5f88-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696074826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074826, "uuid": "d14cd0a3-1b1d-4c5c-86ef-ccf2aacda6af", "comment": "Malware payload (Mirai)", "value": "87ffd3e9f85c5f65e4da5b5b220b07bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074826, "uuid": "a67e1a9c-9efe-4746-a2ba-58176d5e1e68", "comment": "Malware payload (Mirai)", "value": "4b74699a5ebd6c0bd81858c9758f1aced37d5b18acee24dd8ca751235601b8a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074826, "uuid": "81b75ad6-d6e5-45f6-90f0-42178b39b228", "comment": "Malware payload (Mirai)", "value": "f86bd1fbeccb9398e587634936615bc519c8728c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074826, "uuid": "afbc6f99-5047-4676-88ec-00212ea49149", "comment": "Malware payload (Mirai)", "value": "b65d48026dfdf637572b0f026c71c8e622206fa323615e70cb127f27c3838401d4ef3755dd1084a6f2553faf82a00fc3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074826, "uuid": "992543ac-b961-466f-952d-4f2e5d61e709", "value": "T197434A97B5009E3CFD9BE67E80574A48F13422A025932F276377FCA75D722584E1BE82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074826, "uuid": "f74c79d8-d3b3-4ddb-a936-8dce726f47e8", "value": "1536:/JUPUSV+jZn6M1lzRZwOKrLX9BQbjy8uB:/+PUg41ZRCZrrQn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696074826, "uuid": "5d1ead3c-f9a8-4533-af71-91affc0ea920", "value": 55300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696074826, "uuid": "d04def84-d532-4e99-b3f3-f29041d55a8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074826, "uuid": "b864d8a5-c12a-48b7-830d-825590ceb067", "value": "87ffd3e9f85c5f65e4da5b5b220b07bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82018504-5fdc-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696111117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696111117, "uuid": "c7435d8f-f467-4589-bb0f-295654aa33a2", "comment": "Malware payload", "value": "e9c9fc6dfa81026b1edf84c310b15a19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696111117, "uuid": "9026316a-63be-4216-a04f-84d790ba8d52", "comment": "Malware payload", "value": "4b7b243ae528f6d33aa8c18c57d6b6f5e865c04b57885e94f4fec43524874730", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696111117, "uuid": "b2c233f2-9078-4516-a113-ba1c7aab9314", "comment": "Malware payload", "value": "5152f3eb858185ed55f2e4f3ce8279fc410c2d03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696111117, "uuid": "94b3e091-e48b-4197-9089-04f34092e87e", "comment": "Malware payload", "value": "e9da866df131047a18334c68d9626560dc71d99d2d029bc46cf13e384076b5d9cc060bdea2e92587a7af8c55f410b6a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696111117, "uuid": "86c2e0dd-352f-4f36-a7e9-5e3b0bfda9c0", "value": "T1AF248D2362F17C53E5EB66728E2E86E87A2FB451CF59575E3208562F08701F2D26331A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696111117, "uuid": "64af202b-8c3b-4f3b-bb0e-1216b34a5ed3", "value": "d323d1063364fcdde3ec2d7fc616011e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696111117, "uuid": "2c746eee-f567-4877-a48b-db23a4f09a2d", "value": "3072:SlaR+BHboO5vW4VKBvK+lBomxb/55/bamlG/g3:UsO0KKBvNomFrbamw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696111117, "uuid": "df086e7f-d287-473a-ad66-7dcfb0161b29", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696111117, "uuid": "22f61ea2-86b0-4a84-86a7-b270e7a06e21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696111117, "uuid": "2a48a257-b59e-4e1f-a119-ae03ce4094ec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "043e644a-5f6b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696062373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696062373, "uuid": "4f8e96e0-5a9d-473e-b220-d28f3d6f2959", "comment": "Malware payload (RedLineStealer)", "value": "2570641ce0a480459b56a4dd46697358", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696062373, "uuid": "5e49981c-1dc8-4c7f-90b6-420e53ddcfad", "comment": "Malware payload (RedLineStealer)", "value": "4d348c7e2b2006371efe5562a2747bb055441232d17de88803d0a600c106eb9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696062373, "uuid": "776c5330-b46b-4650-865d-b90db81df81d", "comment": "Malware payload (RedLineStealer)", "value": "e83a8ff70f0879636aa364a53cae0d27ec482005", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696062373, "uuid": "42bf7f16-934c-4bf3-a74f-1e801b518501", "comment": "Malware payload (RedLineStealer)", "value": "27b31c9ee4dfb851d96f5f45f53e409612b7caca88e068c6b78ad27e4eeb5e39c0acec86d48e5f505c51954d4f1af1a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696062373, "uuid": "952e638a-6261-4f79-9c29-8a9f1e208592", "value": "T1F4352303A7E884A6DCF9473088F91393273A7CE29C2483576646A45A5DF36C0BD717BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696062373, "uuid": "a1e339c1-a109-4c03-848a-8b2986c2733b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696062373, "uuid": "c42aef6c-6d25-4999-baaa-c683dea16b62", "value": "24576:gy5TGXlCznMRxKII4Blc74rROLGGDDHzA8EbOY:nNnr4Blc7oRAfDY8Eb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696062373, "uuid": "72cfdfff-9a48-41f9-9767-4151b21b48ad", "value": 1098240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696062373, "uuid": "6f9d79c8-9e4f-4066-ae88-11a497bfd14d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696062373, "uuid": "650d649d-dbb3-49e1-a54b-fbafade05f63", "value": "2570641ce0a480459b56a4dd46697358.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90eb7785-5f68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1696061320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696061320, "uuid": "4be214f7-dac8-4672-9137-26c1e4bfa2fd", "comment": "Malware payload (RaccoonStealer)", "value": "caaa0cc6534044fe071df3dc44c31c46", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696061320, "uuid": "71efe7bb-7435-455d-b2fe-08f586656f22", "comment": "Malware payload (RaccoonStealer)", "value": "4e8d30ff200dfb4312bb0b02f552728efbb83ce2991a2b70ddead5eecbf1a121", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696061320, "uuid": "0a60102f-8558-4cdf-b59b-494112d855cc", "comment": "Malware payload (RaccoonStealer)", "value": "d8e62f4cfddb65ae948c2dc007f23e64b08db9bb", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696061320, "uuid": "0ec1d676-afcd-4f03-a240-c61b4677f1de", "comment": "Malware payload (RaccoonStealer)", "value": "a322bd21874015615f91546075f2d4785d5f7a874581d44e9c0ce8fe38da35537d06a33d6fe61cb37faa5c08b6b15285", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696061320, "uuid": "78114d75-4cfc-438c-81b1-6dc4753b7ad2", "value": "T1DB6733C93153F545FC8D4C30E63B2CC2E156A6A1F109687025E9B784BB9BFE4E0972B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696061320, "uuid": "5a27753f-dd5a-4b8c-8333-fcdf9a2da395", "value": "786432:DJ9dbxD3OyaI9oZBk/XBGWNc+0AwjNs33hgKruvWCQQS:JFD+g9vGJ+0AwjNy3NuvWCQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696061320, "uuid": "537ef451-79db-4e4e-829d-d195e531d7f5", "value": 31588888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696061320, "uuid": "f986e96c-c755-4259-8fed-329857188635", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696061320, "uuid": "1121efd4-1c37-421f-86a0-339102606953", "value": "Chr\u043em\u0435S\u0435tu\u0440.appx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db0a9018-5fbc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696097522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696097522, "uuid": "c411417f-4de9-4fcc-9618-7c02bda48e26", "comment": "Malware payload (AgentTesla)", "value": "bb091281b7dd6c8b21c7bbd65db97491", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696097522, "uuid": "224feaad-e200-4d6d-8546-7f706ace95d6", "comment": "Malware payload (AgentTesla)", "value": "4fe2efffd5d2755a2f33aecf92d5291b3e433e9cd2d01b4d507a62ce8225374a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696097522, "uuid": "17eea1b7-9459-42e9-9333-6a4589b369d6", "comment": "Malware payload (AgentTesla)", "value": "048e948b7c326d037bf0ad6140ad177389b8c80e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696097522, "uuid": "fad04c86-6c64-45e3-84c3-107bb3e3e714", "comment": "Malware payload (AgentTesla)", "value": "d17f999bfd2446f045ef84f1f3c6208971624d1cfa639453336b09389b401a85f181a9adf3fd4ee854489aaaeffff884", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696097522, "uuid": "66bb28ec-1d40-49af-a302-3e121c0f48bb", "value": "T12824A40D67A44625E4FE77315460FB2B6370A4524B13EE0B4BF158A5DBE33408EDAEA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696097522, "uuid": "92d54b73-0819-40f5-bf36-b98d121bacee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696097522, "uuid": "ef5a0247-730c-4ecd-baab-4448bab31e6b", "value": "3072:3YJX84LUWNTkH+LGP34oCKerVUzeeDXbwa21Dv9ua/aHyvcnd2its:3YJs4LUUSbwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696097522, "uuid": "df8d2d4b-fd0a-4be1-9f1c-151b4159b0cb", "value": 209408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696097522, "uuid": "1a1785e2-f228-43e8-a33d-65e11ac1fd45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696097522, "uuid": "bdad4051-3924-44e0-83ff-1454aa87ddfa", "value": "MullvadVPN-2023.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d5b8a7f-5f47-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696047060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696047060, "uuid": "d68ffaec-6b63-4562-be27-9568034775ec", "comment": "Malware payload (Amadey)", "value": "32d6a8fbfd4b362c8281c3caf0dfebaa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696047060, "uuid": "25f0849e-187f-4bd4-9404-2fac89a071c2", "comment": "Malware payload (Amadey)", "value": "505fe3cf697c698f75b5135389463f40af5c90b576cd1d637db3400fe2701bcb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696047060, "uuid": "6b66943b-4bce-4e28-9a6d-2e7561178f78", "comment": "Malware payload (Amadey)", "value": "c7a119c8f5731d280b65394cdfdc3ff665dc989d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696047060, "uuid": "e03942ec-743e-4d82-8896-9a7dcf433904", "comment": "Malware payload (Amadey)", "value": "cadcd4b32335a2623f044e1ea47a612cb33a696f3afafa4a06b576e31fda613982628e243e3ebf1382be70ecc56775e1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696047060, "uuid": "e3a98b6f-e9d8-4e1f-a5fc-a4099b4d4e73", "value": "T10F3523275BE04232E9B2277089F907471F33BDE28C75879A1789AA570C7328655327BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696047060, "uuid": "0ddc818d-0589-4915-ba77-1b65d558ddfa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696047060, "uuid": "21d4f706-9080-4ec2-ac06-38d9243d2a25", "value": "24576:CyNGXsSg4D8nP/xmtAuBqR0ZZEZ9MrRKKuo8FzUjTMiyT6:pwg4Dk/xmtAdiZmg0KuajTqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696047060, "uuid": "147c5a5c-bca0-42a0-ae0f-419bd2fa7cc8", "value": 1099264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696047060, "uuid": "c708d74e-8e8f-4b7c-bde4-0f83af542837", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696047060, "uuid": "3cb90114-5d9c-47ef-8495-68532e991f15", "value": "32d6a8fbfd4b362c8281c3caf0dfebaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8b62ab-5f76-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696067192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696067192, "uuid": "b22817b0-172a-41e5-a119-93fb05528b83", "comment": "Malware payload (Amadey)", "value": "c413381ecff2f6da1db7b9b1dc041994", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696067192, "uuid": "6691c5ea-4e17-45f9-8e62-830e4625f768", "comment": "Malware payload (Amadey)", "value": "512900666f599bd727072f640e50f7105f1df7bed019cbe9f07d0acd98ea0111", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696067192, "uuid": "f3bfca9b-8177-4998-b18b-328e0a6f0280", "comment": "Malware payload (Amadey)", "value": "0d20d571d7d783f3e9f992031a7493193b77f6b6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696067192, "uuid": "3ae46b4d-c3fd-4d83-a877-bb582e24a318", "comment": "Malware payload (Amadey)", "value": "4311639f51616f2972aa0aff5d0a52433e23abc08cba165cda87534c5abb02eb7a16f4961e0e2dea9dcb30a1f364fb17", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696067192, "uuid": "699b11d1-9624-450d-b464-89a48b0d9c17", "value": "T12E2408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696067192, "uuid": "ef9faee8-1322-49ec-92ad-812ef38f337f", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696067192, "uuid": "c323fc97-6ef5-416b-809e-c7e8cad5047a", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696067192, "uuid": "1229b8e9-cb4a-4770-b87e-1dc31fe84c21", "value": 224640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696067192, "uuid": "429a98bc-1a78-4d74-ab13-c7aeb4dfe617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696067192, "uuid": "e928f27f-d4ca-4a7c-9107-9f40ae7ef0dc", "value": "c413381ecff2f6da1db7b9b1dc041994.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95afe36-5f8e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696077816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696077816, "uuid": "80e109e2-807a-4bf6-b3f5-2b686b27c5d8", "comment": "Malware payload (AgentTesla)", "value": "e7f45ab5a86aacb56ee659d46118a932", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696077816, "uuid": "3f6bc2d1-e4d5-4e0f-89bd-e1f78a6a2f7f", "comment": "Malware payload (AgentTesla)", "value": "52c04c41fc17f8f05d233e2b9403fcebc3ccb8fb1b4e7d776a9b7db78d4fa980", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696077816, "uuid": "3d7a5185-1ea9-465c-9e74-814e1e394505", "comment": "Malware payload (AgentTesla)", "value": "b9c197cd08f27fcf5336f3ac56be6c8f90bc5abc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696077816, "uuid": "e844c5d5-5696-4749-ab8d-bc4115e95a55", "comment": "Malware payload (AgentTesla)", "value": "b606de0024daa12b38fc8515b7880a351a24125e3d2df62778072413a1b2a3a00a5977813bf7ff3fa54f97c7b5baa01c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696077816, "uuid": "c0289007-c023-4b90-9617-a4e150ddfd8e", "value": "T15FD41206A7E00001E5BA67B2A97A413147776A60D83DDF2D0ECC604D5FE779ABA41FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696077816, "uuid": "51f7168c-fb75-4f0f-a40a-8acb97cf611f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696077816, "uuid": "b2205c2b-0679-4f30-9d9b-ac7c54a17460", "value": "12288:FQsjslAckjIKmvT5SBhljNUwSZRcDhjfhAqAfK7F4M2rCC:Yk0KcT5QhjUVZR8LOqIK7FLPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696077816, "uuid": "3a97a168-a0ce-4996-904e-fc580201f526", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696077816, "uuid": "9afd5ff4-d2fb-4528-ad4e-09d3390d29f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696077816, "uuid": "6c0e4588-2d08-4252-92d4-9e2a8166c560", "value": "PAYMENT COPY.pdf_________________________________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "104dfa5c-5fe3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696113933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696113933, "uuid": "56c2fd1f-45be-4d06-976b-36e96af10742", "comment": "Malware payload (RedLineStealer)", "value": "193a2e6e6017c8b38849d63a48a4a4b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696113933, "uuid": "ae458207-d9f1-4e0e-818e-e49de2e17c9a", "comment": "Malware payload (RedLineStealer)", "value": "53356fdaf17b519e9511d2e9e66f01f41b6a102216b730a39ceeece96b0c7caf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696113933, "uuid": "5429d5d9-37b2-4563-9d19-58cf9fa2d6eb", "comment": "Malware payload (RedLineStealer)", "value": "3cab44e9434265a8b09a8a6bd12c0f23c2548221", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696113933, "uuid": "ef82835b-370a-495e-a95f-1eb6b7d797aa", "comment": "Malware payload (RedLineStealer)", "value": "77653bbd8ca80a6101d96c9715695e454c7a9d39c507dfc2e681c859c6a27b25f00e90f1e1efa752f9c1848a44f50202", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696113933, "uuid": "69c90d08-f4d3-406d-9dc4-11f9a24c56d5", "value": "T13F84D06362A0BC61E9679A324E3EC2E87A2EB411DE756F5B32187F5F14711F2D263301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696113933, "uuid": "6d1135e6-eabf-42ae-9404-6b8b50f4f309", "value": "eb89aa3fcf43b156dad667e281a2675a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696113933, "uuid": "3994555a-29b7-4b73-90b1-7340248892d9", "value": "6144:5mDJ28/XyaMmIs6pd9CueKx2aGkZiOaWn2ngj9x2IAT:5mDJ1PyaMawd9CueKx8aRaWNj9xU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696113933, "uuid": "1f63dcdb-a0b9-4814-b6c6-343e1ec4aa8c", "value": 396288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696113933, "uuid": "c15a6916-4a74-4f97-9103-95a3d8d23741", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696113933, "uuid": "e2b1638a-e393-41c0-b687-5751ee899229", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf88a2c-5fe1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696113388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696113388, "uuid": "d1597851-f1e7-478c-8017-253409c175eb", "comment": "Malware payload", "value": "5f466f27838db5c15b5de9ada0520f97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696113388, "uuid": "a6e7070f-9e9b-47a5-9a4f-befc87f2c328", "comment": "Malware payload", "value": "5344cc76afc8f58370fc8b0060d3b0a6ee4e623678cc0a9ccd3240e7c26e3371", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696113388, "uuid": "55f39070-f481-4b40-ae6e-249626e84762", "comment": "Malware payload", "value": "0376b4bab9a7757f01250779fabecb0f76072ae4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696113388, "uuid": "7ddf0c3d-35ba-47e3-9da6-97f959d99274", "comment": "Malware payload", "value": "0dfba808cbd818818cec86387a0fb4545e91e9b15dfca73b36b6459979fcf65eee2e835b9ccdc91027861c92a1921c3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696113388, "uuid": "332165a7-b014-475e-b2fa-78541c5d5633", "value": "T111B533427BD394FEC0910970FC962B7A54BB878E0A1158E7237C9F5D1E38C85817A6AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696113388, "uuid": "108fe2b4-c564-4799-87fb-4165b0ff6045", "value": "1d0e3506c01cb61e9312cbea4911e92e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696113388, "uuid": "5e9db668-42e2-4dc8-9e0e-e5290af640da", "value": "49152:Wfwlwrv/oGph+I/dZXr5hcERQIoaVIAS6ZADUW07A+59SybgYZy:W33oaPZ7z7ZEcSU/8+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696113388, "uuid": "514b4ee7-d486-4e7a-b946-6bc99c99c466", "value": 2344329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696113388, "uuid": "4ebe4c7d-a996-444c-bfad-bf6279df1d67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696113388, "uuid": "92fcb9fc-6711-496e-9809-bc5550f90134", "value": "SecuriteInfo.com.Win32.TrojanX-gen.25754.2660", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff58097-5f39-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696041052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041052, "uuid": "6794bf8e-230e-4d99-a3df-785c24d88bca", "comment": "Malware payload (Mirai)", "value": "4bea2ad84352bb62b35477713b56bc0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041052, "uuid": "13cb0190-5103-4ce9-aa16-5b56308d1a3f", "comment": "Malware payload (Mirai)", "value": "53617f108532e8877b2c9ea149d57e607b9b5b75b56da5b45325bf9dadc99828", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041052, "uuid": "281d3ed8-e718-430e-8f37-44d69005c9b6", "comment": "Malware payload (Mirai)", "value": "e2f7b482a32c5b09c09b6276726f92380eb81e01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041052, "uuid": "6100ad29-77d4-463e-8dc0-d8b3a73b3e45", "comment": "Malware payload (Mirai)", "value": "7077231fc7a5206a9e9f20959ff68e1b15024f2f5a5d9b94c15982cb6d09a50a9a1d61ef63d6057fc86713ec2ed58f96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041052, "uuid": "e040e9b5-e56d-4d50-9eb0-aeb246d28943", "value": "T104430655BC918A12C5E062B7FB5E418C332523F8D2EF7203ED222F55779A81F0EAB651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041052, "uuid": "3ac60054-8d1c-448f-8754-ac9cd2efeb54", "value": "1536:H7fbhm4eK8oI/icIuPhl+t5Ts2t+rJ7w:bfbhy57P6bTsDrJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696041052, "uuid": "d1016402-6e5c-42d7-bbca-a1080b621d7c", "value": 57076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696041052, "uuid": "0b283e9e-87f3-4fd1-a047-b142399e0784", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041052, "uuid": "f3f1df34-3463-45b8-8150-73eb4b6ede15", "value": "4bea2ad84352bb62b35477713b56bc0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9731095a-5fd9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696109864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696109864, "uuid": "3ff3e739-57bf-4247-b74d-82717ed4e5ba", "comment": "Malware payload", "value": "ee38bc691a0f1e604961b5a7377c91c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696109864, "uuid": "8c2e638c-428b-40cc-aed3-959a5de70508", "comment": "Malware payload", "value": "541a6dd0d681646d8fb14d1e50f15ba49a30ea0dba612101dc43a79fe6571860", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696109864, "uuid": "b13de1a1-1232-4f77-9a0b-e77cdc5ecf5f", "comment": "Malware payload", "value": "3fe8e907711300d04d05ed5a3b2bf96db82beb0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696109864, "uuid": "0a4080e1-d123-4837-a1f7-a279549d4a02", "comment": "Malware payload", "value": "f0d37f6af2ecfb3af310610dbaea91e49e6ab85bc947b5ed7a38650abf07188a5105390c81525e896b2b7df2930f4e7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696109864, "uuid": "9e196a97-7f8d-4231-adc7-d478607e5bc4", "value": "T198B533213FF5807ED6A15130D7586DBAB2F8C32997118CEB33658F0D1A3D6C68B36698", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696109864, "uuid": "b05ad9db-c4b5-4acc-a8c4-7dab2e95761e", "value": "1d0e3506c01cb61e9312cbea4911e92e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696109864, "uuid": "345fafd3-5250-40b9-803d-4e7d2d331535", "value": "49152:UJGiRIv8iSro2EQsvvFcpGkcb446Ow/3PEWbfY2lh5L7H4Mu/hhk92hq+ncqsr9:UIiSv8iSrYQsvvAGkced3Pg2lh5nshGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696109864, "uuid": "3deb2b89-af1c-4868-9ba7-aad342a39c45", "value": 2324337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696109864, "uuid": "cd3b10b5-e5ae-4e07-9ef9-9f2b055cdaac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696109864, "uuid": "dd4d6bfc-9491-4792-a314-64d0cfb2523c", "value": "SecuriteInfo.com.Win32.Evo-gen.6028.5932", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bdddeb3-5fd9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696109711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696109711, "uuid": "469d90f0-a253-4460-a861-589e7f6ee402", "comment": "Malware payload", "value": "d5f08e65353a81b2a5b6b33491e0e770", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696109711, "uuid": "37278eb1-a3cf-43e6-ab2d-9d5b72bca281", "comment": "Malware payload", "value": "559d95ba35257617d331197fbe5271f64ba494deb7db518ce01c8f910a6bfab6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696109711, "uuid": "311c10cb-14d4-4c47-90ba-9aa6319c12b3", "comment": "Malware payload", "value": "ca93b8791e23ccaf423112150e4e200e205f0b60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696109711, "uuid": "97fb64c9-11a5-4a42-be84-9c66a42c2943", "comment": "Malware payload", "value": "9c21d5a1e9d94e1b97c0baf5f1c72f63e2336084efa95f3a554990d53700083bd7339829d7536e17dff5595846c22970", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696109711, "uuid": "9902d2b8-c0fc-47d7-87ef-33037eb31152", "value": "T1C4248D3362A1BC51E56777728E2FC6AC7A2FB461CF54676A3218566F08702F2C277312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696109711, "uuid": "5d552ad3-7188-4b3e-8786-d1febfdc39e4", "value": "d323d1063364fcdde3ec2d7fc616011e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696109711, "uuid": "eb3bcf4b-f04a-4d7c-858e-f51417a65d46", "value": "3072:nZ3R9T1FtuCFO4dlCM6lMoUawMNObQa5dShFUWxw55/uRf/g3:JlXIZqlawZF5dbdu5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696109711, "uuid": "a78c0dde-bb9b-4241-9b41-15a09b76d014", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696109711, "uuid": "02bc4658-7fa1-47ce-9bdd-871e20922b35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696109711, "uuid": "406468b8-d7f3-44fe-980f-01986ae4edba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960228d8-5f49-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696048014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696048014, "uuid": "19899a96-c8f9-4e94-9cca-b5ce94a92c19", "comment": "Malware payload (MysticStealer)", "value": "09eacb3ac897d62a25f631d0fe1726c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696048014, "uuid": "7e69b3cb-f990-46fc-8fe2-ef2b043fb47b", "comment": "Malware payload (MysticStealer)", "value": "55bfc957527e5d8f2e4fed7fd01a73fbc7ebe93a0854a24e42b888a03f77bdf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696048014, "uuid": "5918480d-3796-452a-b79c-c7aec8ab9652", "comment": "Malware payload (MysticStealer)", "value": "867d79ea84f48384ac5c65ac911c4100a6c49792", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696048014, "uuid": "c54d1a67-c642-4d52-8ffb-ae3b6becbced", "comment": "Malware payload (MysticStealer)", "value": "c22a02efbd1a76405233fbb46e01b2b83a4432917b71e89df193803589b5580c079f765e152bb1e58ea56ae57b295638", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696048014, "uuid": "7385e21c-0bae-4aa0-9292-b269fc4b9cc9", "value": "T133749F107C9284B2DB721D350BD4CBF89A3E789C0BFA59BB67F0DE6D4E20690D316526", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696048014, "uuid": "5046e22b-cb5a-4e73-8d9c-1873b51540a7", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696048014, "uuid": "25128819-74ac-4e00-bc38-cd3893e64550", "value": "6144:HcTeW/s5GqrO5aXnfEGIXWPvZAOJySIoFK3XSbyLnt3SFTdrWkMx1LNVs0BC+:5mcGqrOk86xk3XSbint3SFprW3LPs0Bl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696048014, "uuid": "5c05b3a9-b695-44ed-972f-1403b0b5805b", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696048014, "uuid": "fa6e23c2-ca3a-453f-9290-d247d4281dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696048014, "uuid": "815ae1cb-332f-4c0d-a06e-e608fbd26a38", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "495de998-5fb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696092124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092124, "uuid": "2714638d-fff7-4cc9-87fb-63a9de6a494b", "comment": "Malware payload (Mirai)", "value": "98c47d8382607912be0342145394aef0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092124, "uuid": "b442ca77-3a21-4308-979e-2a2a036ffdd2", "comment": "Malware payload (Mirai)", "value": "55df7c633b26dce9abcb66a47a03e8035c449367d9309b4bbb7dde92c8b1c83c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092124, "uuid": "ed618a8a-b706-4310-b640-c88486014530", "comment": "Malware payload (Mirai)", "value": "4c99a387c0f42c1a9897d2a458a1ff801a981963", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092124, "uuid": "43afce45-90b5-4ccc-910f-3c8cec96d19f", "comment": "Malware payload (Mirai)", "value": "5ce8384173a078cb6b9d9ff042cb01f304a3c9551576dc2269a5f7f28d271b69f58ffea4ad4a918ccc718593b5a881ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092124, "uuid": "a85dd62c-0f11-4000-a6d9-ef79dbbb120e", "value": "T1B0330955B8C29A27C2D012BBF66E979D376063F8D2CF7227DC204B147A8611F1DA3E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092124, "uuid": "546965a4-eb98-4984-8d34-800daf139a78", "value": "1536:uULQbwOTg2TYNIqPMvN3Yp8el0MMpiMQ:uULQbjTcMVITrMpiMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696092124, "uuid": "e083eddc-7466-41e6-8ac8-ccfe68a3e73d", "value": 52280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696092124, "uuid": "36d54155-ff60-474b-b77f-86551af74db6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092124, "uuid": "280d8acc-b192-4dab-a4de-6935253ffdc9", "value": "98c47d8382607912be0342145394aef0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aaf876a-5f98-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696081899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696081899, "uuid": "777c55c8-e445-4f53-a6aa-d484728f6d02", "comment": "Malware payload (Amadey)", "value": "ccd3df826d56c920cf6b2ad141f40fe4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696081899, "uuid": "12b2435c-90b3-447b-8bb6-7e72b49fa9cb", "comment": "Malware payload (Amadey)", "value": "579c9b132797cf62711b9ef9b3302b8986b1f3ab3167570b56997439fd420a20", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696081899, "uuid": "7e37c506-805a-4d1f-8d97-8fc8a340dc6d", "comment": "Malware payload (Amadey)", "value": "508b81ebaf27aafad30ad0008007f96d24b88384", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696081899, "uuid": "c8a02081-2af7-4ff2-b49c-debbd1167991", "comment": "Malware payload (Amadey)", "value": "800cf54fe6e5abdb4a0052c30610a3f9c852745ab214bc693ac9c09d127ab235831266576171232d20b64149a5936e04", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696081899, "uuid": "15af3f52-9dee-4900-9067-d1b1b05a9d99", "value": "T1BC252316EBE52132DCB5277018F703C31E397DA1ADB8D62F2B44845A6C726E46A72337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696081899, "uuid": "cf166203-4a38-4b24-b0ab-e6869b10a12e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696081899, "uuid": "1836f8be-2ebc-4d79-83b9-aa6387101dd2", "value": "24576:7ybnQmlwVJpQgAtGMlqRd9cFIVPPdBe7U:ubfCjpQTtGtOIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696081899, "uuid": "3340a556-e479-4d71-ba5a-62a9cb991816", "value": 990208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696081899, "uuid": "3f6fbb54-5d28-42d7-abd1-99f5c7469bdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696081899, "uuid": "dfea9d22-5f4e-4b27-b8ae-385950095ba7", "value": "ccd3df826d56c920cf6b2ad141f40fe4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7196449-5f3e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696043453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696043453, "uuid": "5c4c0995-2b06-488e-bd17-52260ec09cdd", "comment": "Malware payload (Amadey)", "value": "b8b7d6508d6804d54eca2c45fa32c9fe", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696043453, "uuid": "682c01ed-361f-4008-907a-2ff6e89b1762", "comment": "Malware payload (Amadey)", "value": "583ec5444f933ec5e6eebdb024c513182fe52a1f9af338aeaa153429d0736744", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696043453, "uuid": "fbf6396f-c772-4411-b031-093e16195ca9", "comment": "Malware payload (Amadey)", "value": "5ea2b11654806366de797d5257d6d6851d581007", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696043453, "uuid": "2e01b589-7eec-46af-a807-7b6584b12624", "comment": "Malware payload (Amadey)", "value": "6ea8fccb2e4f7aefddd6498860212cd4079682fa944acbf4e4a23241dd7f0010f8bdf627e47b98f4d1a23d11c04fbc31", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696043453, "uuid": "7388f18b-e4d4-4d56-89df-24a92bff0d00", "value": "T1352408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696043453, "uuid": "3d7d9701-0528-43ae-8fa8-7858ff877d4c", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696043453, "uuid": "59e43b93-d4ca-49d2-a438-81fae3c996f6", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696043453, "uuid": "c9850806-dffb-4197-896c-58f897613285", "value": 224295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696043453, "uuid": "71a8c034-b1eb-46b1-8b5f-6811b33cac5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696043453, "uuid": "2ee63ae5-4377-47d9-9023-437ec8129df8", "value": "b8b7d6508d6804d54eca2c45fa32c9fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43970500-5f3e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696043152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696043152, "uuid": "7c670005-d8e2-43a2-992c-088ae780fab3", "comment": "Malware payload (RedLineStealer)", "value": "8d0daa1926b66ff2dea082fbadfd7a4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696043152, "uuid": "4def031b-f7f8-487f-8a94-ce9beecbaac0", "comment": "Malware payload (RedLineStealer)", "value": "58efd77b7b8d766209d68f623264ec84fc9019f6ab4ef1f775de0242cf34bb3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696043152, "uuid": "46c56d11-14df-4005-bc9b-89b2b3120248", "comment": "Malware payload (RedLineStealer)", "value": "88fe6abbd2da9ee10125572ddd3381c28eb75734", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696043152, "uuid": "4ee7c4e9-79b9-4494-985a-1b11616856f0", "comment": "Malware payload (RedLineStealer)", "value": "faf9b608df1fd75648aa81d2f8bbb6546f254e0d78e114ea726acb424d15adb3766d6ddd184c276049cd3b7a0189e920", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696043152, "uuid": "a4e35036-3378-4ff7-a386-7d40a05e7f13", "value": "T19E352312EDE896A7D9B657B018F702530E34BDA29DBC467336C5FC9A1C62680E432737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696043152, "uuid": "d816dc21-221a-4b8f-88b8-464c95c022f0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696043152, "uuid": "3303084f-4ae7-4aaa-b62b-ab9bb944f1fc", "value": "24576:8yHttFirLHfk5YGaOnXgF54VZi7eqS/JIPEyB:rNtFYL/kRhwT4bi7eePn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696043152, "uuid": "6e306704-89e0-485c-935b-a66882b80109", "value": 1093120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696043152, "uuid": "bb979336-75fe-495b-beec-7e5fa004ec1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696043152, "uuid": "742ef1a7-366c-4629-ad34-65ec47b44bb1", "value": "8d0daa1926b66ff2dea082fbadfd7a4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a82d488b-5fa6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696087988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087988, "uuid": "6890dd85-4aaf-4403-90d8-a71f27c34fd1", "comment": "Malware payload (Smoke Loader)", "value": "ab87d176e9172be3c2b7995c5fa9b582", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087988, "uuid": "93a53a5d-2cf3-47e7-88a9-5d87259ee561", "comment": "Malware payload (Smoke Loader)", "value": "59d7cc687f5427347e3c5b357b06af9cc4aeef00af7c78919817a7ae0d3f2727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087988, "uuid": "6f8ca414-1094-41a4-adeb-f08a0f1335bd", "comment": "Malware payload (Smoke Loader)", "value": "8dec5e69e7bfc80c6ba57cb9e5b64387e4e87089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087988, "uuid": "39ef85c6-6bea-4e88-b9a9-b125ac8b63c7", "comment": "Malware payload (Smoke Loader)", "value": "3be4515094ce60d5c5493b5ce33de6d074eedfc97c67242aa4b1c1b72078c479169268aefb013f5fb67c6b76820bf610", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087988, "uuid": "a66876c8-4d3d-43e5-9a3b-841e13ac8094", "value": "T153F3BF1575C0C072ED661D3509A0DBBD4A3EFCF40FA49E8F67880A797EA02D0D6369A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087988, "uuid": "bdb0ffe2-4d69-45c0-b947-492bd02e9398", "value": "5b961e24b82512d2a00ac6c970dad1c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087988, "uuid": "a73371ac-7835-4025-a257-41302b981d7d", "value": "3072:Wh7Uo8owo7h0BEYmbuw16GVuiIPMoC1T8xNq/4Zch9Hidfzj:WhYViOBEBbx6GbMN0Wc+rj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696087988, "uuid": "55cfb550-5c5b-45a6-a320-a0973dc79464", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696087988, "uuid": "855c494e-165e-48bb-966e-843031d00bd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087988, "uuid": "efa04ea2-cc19-495d-b74e-e47825d33989", "value": "SecuriteInfo.com.Win32.PWSX-gen.28723.3438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46960b5-5fb2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696093136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696093136, "uuid": "cec9d167-f4d1-4086-80cf-08bccea62080", "comment": "Malware payload (AgentTesla)", "value": "2403072d939599e88431e5d0ed0e2b1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696093136, "uuid": "f792413e-6ef2-4dcf-82df-4b7827f49b3c", "comment": "Malware payload (AgentTesla)", "value": "5ad0285de999973d1a665bcfe5d7040494f64c113d8ef8664d3bda3ae66b8d67", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696093136, "uuid": "34cf33cc-88a0-49c9-a49c-e5b4a13bbe72", "comment": "Malware payload (AgentTesla)", "value": "507d6e48c7d74af7651a1af5e1d0844f45f9c263", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696093136, "uuid": "38bd4afe-9864-4459-adce-33ef415704fd", "comment": "Malware payload (AgentTesla)", "value": "331b1fd8a6c345d3dff0a2821ce7c3748b070f792ca5be20f6cd8ef46b2102f2de63139cbdd4e9738032f0f917727392", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696093136, "uuid": "b5d4018f-ab54-4c90-b694-6bcd7cd48036", "value": "T12A14D5CB73A45B35F4BE6F720C7D08062370AC52351FE7198BC574A71A33780B95AAA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696093136, "uuid": "0f60ba63-b96f-4fbb-b5ab-a561c057ed64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696093136, "uuid": "10354165-2478-42c7-8815-cbd90d73fd69", "value": "3072:K73LYJiZfUO7JAkH+wWtaiYGlIQZboLRi9ua/aHyvh1d2itL:K77gIfU2T7ZGlVbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696093136, "uuid": "897930b1-dcac-4b5b-be1f-e074cb65411d", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696093136, "uuid": "2a5c33d7-e90c-4e2f-9ae7-57a4f583c7f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696093136, "uuid": "9078adb5-d16e-49a7-8a09-fe1165c60521", "value": "avira_en_vpnb0_19374396-127457345__pvpnws-spotlightvpnadw-test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f7d223-5f2a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1696034453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696034453, "uuid": "a1666116-a811-4084-87a2-9df51d51383d", "comment": "Malware payload (DCRat)", "value": "b067ce756638b4266dc38d81abb68af2", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696034453, "uuid": "5fbf7c35-23c1-4691-ae89-f59fbe152f7b", "comment": "Malware payload (DCRat)", "value": "5c445f99c3c151573f373b65e070381d96df9260169433a01e7a7fab04ad88fe", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696034453, "uuid": "b4844149-33db-4b93-9eaa-8bfadab77c4b", "comment": "Malware payload (DCRat)", "value": "a5dfa0b07ddc85b5bf3ab0a1027bb6fef3470f37", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696034453, "uuid": "57dcb968-fe0d-4fe6-b651-38b750c4a46d", "comment": "Malware payload (DCRat)", "value": "e93cea848b552488a1283ef0a581b5b25150889ce33bdbbada87542d8be6059bbd65abe5c8b71dd18605743acb838c19", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696034453, "uuid": "ac8cb92e-3b0f-41f1-bd39-3598797039e8", "value": "T118952316B9C48071D5230A3915E6DB767B7CBD204B328FDB9B882EAF8F315D05A39613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696034453, "uuid": "016dd7c1-c33c-4328-95a1-562cb461a36a", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696034453, "uuid": "bccb14c4-3d15-4ab3-8f45-041c54bc9e50", "value": "49152:qcbzAoVVRaWf4aEqGaU5XBkvRdLtkdbW0qmxKghiX:qcbx9dtxu5arZkdX1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696034453, "uuid": "f9c40263-8fb1-4cf0-ab8a-a7acad3ed851", "value": 2001716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696034453, "uuid": "66c17486-0a37-42f4-b4a5-fe8bd3116cfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696034453, "uuid": "2338165a-344e-4c64-a47c-1a56ab0e7a49", "value": "b067ce756638b4266dc38d81abb68af2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210a5b96-5f66-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696060274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060274, "uuid": "e87bb2d5-57a1-4faa-8d23-252b5d21b5b6", "comment": "Malware payload (Amadey)", "value": "12b31d284a961735d2772c6ba978b765", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060274, "uuid": "f842a617-9b3d-45b9-9751-b90741cb2202", "comment": "Malware payload (Amadey)", "value": "5c50f06d0b2060a5bf324d859f29aa53acd42ff499c0be30e717f0f36bd9f181", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060274, "uuid": "2095f171-ee2b-49b7-bdf4-0a3d7f771ae7", "comment": "Malware payload (Amadey)", "value": "23ba357d518f3416fee3a310b0feef7f7995dbbb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060274, "uuid": "11e2ae3e-1cdf-4520-8bad-59b1b2606442", "comment": "Malware payload (Amadey)", "value": "1fbbc9c58356778e5384c763ebf8370e49c97511cc38b851e894ecb8e59e91aa7e80a7506f206f8e9194801615dad3bd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696060274, "uuid": "bad30754-8608-42c2-8d37-d9ef189434e2", "value": "T15E2408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696060274, "uuid": "08ad1bcd-91b9-4f0f-853b-0297235e31b1", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696060274, "uuid": "9534053e-9994-4524-a56e-6f113511bc78", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696060274, "uuid": "82efb2a3-77a8-4e17-81f2-8356503e379d", "value": 224468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696060274, "uuid": "a1725708-e0e3-4d4f-8675-59d03a2f2cda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696060274, "uuid": "b0922766-feea-413e-b7fa-f4a0c2d931c9", "value": "12b31d284a961735d2772c6ba978b765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04cff78c-5f72-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696065380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696065380, "uuid": "19fd63c9-ee19-4424-8144-1e3da59c0ea4", "comment": "Malware payload (RedLineStealer)", "value": "4038c9edc69dd63a5c0f9b8237c0464f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696065380, "uuid": "e41fd7ff-ad07-470c-ac05-620d7e8805d6", "comment": "Malware payload (RedLineStealer)", "value": "5c6f2d5e5c48bb6f6558a2dda5364d48a7527ea69111e54d800d833abf793d21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696065380, "uuid": "9c08a016-71f5-433b-acb7-040cb26ba60e", "comment": "Malware payload (RedLineStealer)", "value": "a8806d608e03b62d9b8274c50d05276bf5b219ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696065380, "uuid": "71cee210-454e-4a68-baf7-9e8bef913dcc", "comment": "Malware payload (RedLineStealer)", "value": "4a428915000de73c80805fa32695a9f5d17bd9095b8953b69984a7d9ca28f06b170d2b05e84117a7460fb12e0ad512d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696065380, "uuid": "ec125c13-762f-490a-8939-84d7cf355f16", "value": "T17D352313F6ED8573C87403B61DFA0393073DBC944D349A6B3249A68F18F2691B87676A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696065380, "uuid": "79d823ac-bc2e-44a8-abed-059a8cd5d502", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696065380, "uuid": "0df61bb6-1e95-4f2d-9077-e7c6d98e3744", "value": "24576:yyqYi1m7TKmj1TlUZgxZxPXWoThBV+YtRfFXbrJrW2:Zqp1mH91TlUYxPXWChB0YtrXbrhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696065380, "uuid": "a36a821a-5ef5-4055-9698-8fca7f9a5d6a", "value": 1096704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696065380, "uuid": "47c843ad-fe5b-465a-b14c-3804c952f2c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696065380, "uuid": "dd6b9c0c-7af3-4d61-9ae1-b6dba9cd6133", "value": "4038c9edc69dd63a5c0f9b8237c0464f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b6b7b0-5f39-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Meterpreter)", "timestamp": 1696041243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041243, "uuid": "f005f3d3-0090-4d14-9f8d-2ed25a94f4a2", "comment": "Malware payload (Meterpreter)", "value": "2ebb1334d38fcede7eaea77a7b816842", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "msfvenom", "colour": "#1A541B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041243, "uuid": "2966524d-09dd-4243-8ff0-bd1a00665362", "comment": "Malware payload (Meterpreter)", "value": "5d1b0eb4fe5d011c4867b01b7a218e87e41cb6e39bc8c2a3470dec2115e482e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "msfvenom", "colour": "#1A541B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041243, "uuid": "b06015bc-bb2c-46c7-97c6-0edf0df5b93e", "comment": "Malware payload (Meterpreter)", "value": "797fa39adec13bec9c68f212e37e7f1f85788b8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "msfvenom", "colour": "#1A541B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041243, "uuid": "380f482b-ca95-4b69-a448-a1f8eaaea716", "comment": "Malware payload (Meterpreter)", "value": "eacfb570fd77548b6862ce9bc9e21d2e587f53d7101a410d97625cc5a0d2d90a5966ada07d24c49594ef7840a981be14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "msfvenom", "colour": "#1A541B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041243, "uuid": "570f93cc-4612-47d6-801b-d51ce6f28dca", "value": "T17273CF42E8C44425C1A2117D27B83AF5A9B1F5FA3715C1DA764CCDE1EFD28F0A22A3C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041243, "uuid": "f0df51cd-548b-48f8-beaf-e3bc893dbbad", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041243, "uuid": "9e4633fa-d1b5-4b99-bcfb-bcb614ed31aa", "value": "1536:ItJtLeV887Bb2w4lu10FBzypimndMb+KR0Nc8QsJq39:kJyX2wHkKi8e0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696041243, "uuid": "37fff8fa-7e3d-44ed-a7a8-3239acc9e18d", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696041243, "uuid": "cfc49009-4b16-4ea4-9c92-669c7d7ea336", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041243, "uuid": "afab05aa-f28f-4456-b1e3-935ecb176784", "value": "mw1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c2b106-5faf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696091816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091816, "uuid": "c06fcd3d-7ed6-407f-a25c-b829cf3f0d21", "comment": "Malware payload", "value": "60d26ad4c596d7c95ea548ac5cdc0f13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091816, "uuid": "c4202696-27a1-4a5c-9de2-a07f2ebd0aa1", "comment": "Malware payload", "value": "5da0e9654b321dbbf3fcddafb175f360658d859b9ee5e166b017818349e416ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091816, "uuid": "bffa1032-13a2-42ac-9f02-07a4da2dfe2d", "comment": "Malware payload", "value": "5b0464f1a6b4c7aa8983d5c0e5048c5423ab021a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091816, "uuid": "768102c1-4f25-40b8-b330-4d5483db23b4", "comment": "Malware payload", "value": "ec3cd92dc21892ed6e6e348e0e677599bc5e73b295f9ac88665d9f514143f3f6ae241a06178bb46d2d4888f69c19940e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091816, "uuid": "b2c2b133-8a67-4fad-9144-700ad3d467b1", "value": "T102B533103BEF86B8C701063353A4BBE1716AE7252F524ED367489E091B59401E6FE6EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091816, "uuid": "e6e407af-8c5d-4d1d-9d6f-8f3367c2d78f", "value": "1d0e3506c01cb61e9312cbea4911e92e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091816, "uuid": "116aa4ab-e8e8-4b8e-9a70-880d1d0b80ef", "value": "49152:WfHeETM/73+xOzZ0LukOGHqkRCEcj+UawAG0m0nyB2PBPL559oVq:WfeEI/x0akNH2jBaTuQC25DLcq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696091816, "uuid": "f5521653-2d43-4cee-9f96-296365486c65", "value": 2296485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696091816, "uuid": "6db7d5d4-3e39-4516-8a9a-1c1a67b36e78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091816, "uuid": "7ecf9636-0c70-400f-86b8-7ad6a0bb6c19", "value": "SecuriteInfo.com.Win32.TrojanX-gen.4137.21565", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09acc6bf-5fb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696095453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095453, "uuid": "44a5ceff-a8db-41bf-9d66-b14a0002879e", "comment": "Malware payload", "value": "795275fb9c41ebd5b9fe7ab19108c52b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095453, "uuid": "82d2e40b-38e8-4212-b372-fb9b518c992f", "comment": "Malware payload", "value": "5dd633f81c210a144771a830d2dccd33ce12055c8f19338d8031a2d7f3d67cbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095453, "uuid": "d0e03fca-9581-4144-8cdb-0ff7c6326ac9", "comment": "Malware payload", "value": "f2a529d5add07b626da1986d67548af31a1155b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095453, "uuid": "3c76293a-8687-41fa-ab61-a7ada511773f", "comment": "Malware payload", "value": "5b0f3c9a6d3db60961528baace3db00ed02927691bf29358669875ca441de9a8aa7471de5dc752a0131ae80aaa5a3d93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095453, "uuid": "b058a1ab-6df7-4bab-b954-bc2931fc3569", "value": "T15192B580E283C93AD7D3617697FA07ACA43B9988E7987317A1ECD234656433C6735F08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095453, "uuid": "d67241ea-3332-4401-8657-ae0419519035", "value": "384:vSF+nG0fIEb4G13+LEkcTXwVhMqlVCxA5PNIWWSSNV:vSd0fIwn13+LIsEOVCxATIfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696095453, "uuid": "66325212-6dd3-41dc-8809-6e62209cafbe", "value": 21215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696095453, "uuid": "7644b3ac-c679-41f5-b688-60a78c318c1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095453, "uuid": "76da4303-df2c-4bc4-8e66-deb363c3a22f", "value": "SecuriteInfo.com.ELF.Lootor-AN.7386.8324", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01108d1b-5f31-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696037457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696037457, "uuid": "d3bbcdc8-980a-4a44-84d8-57a0c3513224", "comment": "Malware payload (MysticStealer)", "value": "17f75f87612c9972e82ed3a929d7c821", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696037457, "uuid": "477fefe1-99b0-4316-94e5-1bc700dcd5e6", "comment": "Malware payload (MysticStealer)", "value": "5f77b4c34e226f638312a92a191f8a5e2563eb2b9618cd771b64cbe95574135c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696037457, "uuid": "e2022e7b-5b2b-4068-83d4-c015a0c122bf", "comment": "Malware payload (MysticStealer)", "value": "248fdb8618ba9a52f7bd11126ddc4b40076bf245", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696037457, "uuid": "2fde95e3-478c-4f80-bd02-a2a73826bcb8", "comment": "Malware payload (MysticStealer)", "value": "135a46bbeb2bbfd4e0bf03875e6588a10c1797b64b167515be31d2c177ad442bcd4d263b0ff433d7e103714831651a26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696037457, "uuid": "96fb0198-79cf-44d7-8dd4-446b47a1ae78", "value": "T17174BE0672D1F272C8722E3206F4EB695DBC746449861DAF5B580E6E4EE02F3B1B2537", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696037457, "uuid": "f57ea049-95e6-4439-87ca-30a1f778fdf3", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696037457, "uuid": "df4b3773-41fe-48f1-a030-cda8f7de41be", "value": "6144:qDTeW/s5GqrO5aXnfEGIXWPvZAO7yNKex+XYkFJ1tuAmehwAUxVs0BC+:RmcGqrOk86xKKexyhFJ6A1wAes0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696037457, "uuid": "fe3fa5d6-c2fb-4383-be24-d0da6169a30f", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696037457, "uuid": "67a028e5-3169-4c0f-8c83-9966ac8c776e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696037457, "uuid": "8b4d8cbf-a032-43aa-abcd-93108af015e0", "value": "SecuriteInfo.com.Trojan.Inject4.61510.15915.27794", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfee1788-5f70-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696064889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064889, "uuid": "4bcb5695-95a1-45d7-9bad-a841ee3cab9d", "comment": "Malware payload (RedLineStealer)", "value": "1b185949d880e92195e233fb4298831f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064889, "uuid": "00d5ed0d-6a44-4bb2-97f2-1bc92795f7d8", "comment": "Malware payload (RedLineStealer)", "value": "5fc5e961e2adc131d04cfb81d63320befe3165222505062f03d2d706b627f1a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064889, "uuid": "2473e153-0ec0-4646-b528-c7db27fee82b", "comment": "Malware payload (RedLineStealer)", "value": "ada4490d399237f31a1f7ca4b21df9436d99c9aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064889, "uuid": "856e282a-459a-4909-a1b1-f6e88a07b0b1", "comment": "Malware payload (RedLineStealer)", "value": "1e157e5d0296712a8ad3c4408e3dde53dd60cb28c7b357e5f6888f0b52949fd9cd99b303778e46d1e1d77a946d0ef8a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064889, "uuid": "8d1c896e-2172-4fbf-843c-73a4c00f8105", "value": "T1F1658CE1F8C2416DDDE613B602ECF931F66DE1E40B2605C75AC456EE9F906C22A325CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064889, "uuid": "1898f627-b955-4eb3-9a66-323f2f27825f", "value": "500aa68029ae375a898af1edb3f40b87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064889, "uuid": "dd171174-2324-487e-a8c9-098b16e0d7b0", "value": "24576:0gyzyicBpqoZTgVifptq6PQMHPOsMrb9h:0EBpqoZTgY1PdvCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696064889, "uuid": "131b84f7-af77-4de6-9ea2-5395880918d3", "value": 1498432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696064889, "uuid": "541950bf-939b-4046-bab2-ae079eed55a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064889, "uuid": "30d7d324-1d5a-4094-b790-66bfa52d644b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9870789-5f2e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696036558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696036558, "uuid": "56c4bf07-dd5c-4fba-b0a8-cdea3c48f0ff", "comment": "Malware payload (Amadey)", "value": "a87a642531553dc63467b188e7630b87", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696036558, "uuid": "f2e3c6c6-d974-440e-b629-5f53c6548632", "comment": "Malware payload (Amadey)", "value": "5fd477d86003aeb6c4797790b53b477bde6d9b51b3bad6d10be8fc524142991f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696036558, "uuid": "f4e50c4d-2e16-4f02-809c-9ababd3f7d92", "comment": "Malware payload (Amadey)", "value": "f418fe0bbab6fb438ab6161ff48bf8a1b6e658d0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696036558, "uuid": "ffa3a3cf-1945-44bf-ae55-e8c2e33f3834", "comment": "Malware payload (Amadey)", "value": "e93d374093851c06e6482b7e13bfd32148d89ec059b7fb64361be343f5d0970af829dcb906a7dce9d24d9555fa809f35", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696036558, "uuid": "c1a99d42-30c4-4f19-ba4a-248237ecdb99", "value": "T1EA152313A7D98177C6B64B7044FB064B2F327DE2193547AA63526C8E0C735C8EA7633A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696036558, "uuid": "313a6410-15c0-450f-a979-b1e177b56609", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696036558, "uuid": "e637216b-966e-4549-9e4b-08c497defb81", "value": "24576:XyXb3ZBbDTQvAvSFItVQCsBGZNeIGl1yM:ilBLzLtVHsBGjXWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696036558, "uuid": "53600b96-5a1f-46b2-9868-e0b4fa688b2a", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696036558, "uuid": "55566cf0-583d-4913-b1be-161022976031", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696036558, "uuid": "5fb59e52-6bad-4cfb-9d4f-8241ca5125ea", "value": "a87a642531553dc63467b188e7630b87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8384e5e-5f9d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696084203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084203, "uuid": "3f7e26b4-9061-4c88-8bc6-98e837c22aac", "comment": "Malware payload", "value": "cfe528f7dc8ba4c4595f2198c5c00275", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084203, "uuid": "8667726f-4d38-4a16-85ed-d9ca33924fd0", "comment": "Malware payload", "value": "60d03b11f7e06c9b3b2bed8c0d2336098b581988f597dc90e0149254d40a7f4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084203, "uuid": "71957d89-fd13-48bd-968a-a67a4665ca62", "comment": "Malware payload", "value": "d09bef716209c4c32596bf3644d3e6ff2e4f8c8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084203, "uuid": "a162160d-a972-44da-a903-19808c589c61", "comment": "Malware payload", "value": "0521e64ed1eadb26ed8eca3bc4eb0bce8daa9ebbf1c19c3839fd79982229b512da61f8443fcee58338e07fe72397f5d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084203, "uuid": "2593ec3a-b1c6-400b-83d2-d7d629f5f60f", "value": "T1A6B533217DE292B6C50220744959B7B2E0B7D3A40F1359DB67244D3FFC3958BE13CAAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084203, "uuid": "53832e80-5206-444c-ab31-30286aa475c5", "value": "1d0e3506c01cb61e9312cbea4911e92e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084203, "uuid": "6e0d5d49-b675-4eb3-85fc-355ef63b806d", "value": "49152:Wf0uOckMkvhcdfB7gBv90liJzB6XNm+sLpRIM6iDIsD9FrBX:WsuTL1yhGsoX5i6zinJBBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696084203, "uuid": "451efcdd-8cfd-42f2-8bc2-2e32de04f9e6", "value": 2296779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696084203, "uuid": "bde01e2c-a2e2-42a1-aebf-1695859aed2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084203, "uuid": "477f0a04-7a73-4215-9320-d25b0c0cd104", "value": "SecuriteInfo.com.Win32.TrojanX-gen.14635.21399", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14942f6c-5fb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696095471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095471, "uuid": "32476941-6d81-41b3-8026-2423eec293d3", "comment": "Malware payload", "value": "4ab8dec3d3f90c28c4e29ff143e3c782", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095471, "uuid": "2a1d25b4-2511-4182-9b38-c92cf7bb0f6d", "comment": "Malware payload", "value": "60e5718ebb409d45bea79f35bd0d93a01fe4b9dd5ec31e1a82a50ca56de6e3cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095471, "uuid": "69970634-7ca6-4802-9d6d-8b3424541f39", "comment": "Malware payload", "value": "7587165d31c6d0387dac80530110878234a7cc08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095471, "uuid": "dc36435b-7a9f-47a8-af46-023577a7822e", "comment": "Malware payload", "value": "191222b19248582d0ae5cbff52f615694311deec6184d44746a628283265b4ac7b03469549e240fd1714de5690637e38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095471, "uuid": "81a233c5-41fb-4892-84b5-1a26c1c4edaf", "value": "T10835BF49B5A240F2C54515300D7AA77EFA348A458A25CFCBF3A5EE3D38335A16D3B329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095471, "uuid": "bfe981ca-be6d-4166-9b41-22adaec8a226", "value": "476af21d310b2b2ddcd942388292487c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095471, "uuid": "3693abe2-59ed-4d1f-845e-c8a7bb09252f", "value": "24576:YVYsT137EyTMPM3UkVPxK3u46Z/Eal3k9UOAjQ3//E:2VEyl3UUJGj6ZMpvvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696095471, "uuid": "251215de-d28e-4c06-9b19-2047c604737e", "value": 1150976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696095471, "uuid": "6cc583f3-0a08-4e21-80d8-cfbbee8a5c20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095471, "uuid": "61fd9d58-888f-4ae4-a372-1e21197f37f0", "value": "SecuriteInfo.com.Trojan.DownLoader8.15426.18960.13978", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4750674-5f27-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696033543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033543, "uuid": "19d55dde-52a7-41d1-bffa-ddae889f5b8d", "comment": "Malware payload (RedLineStealer)", "value": "8015a689dedb82e08a271eb3c73dae25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033543, "uuid": "a36553c3-08b2-4065-aa60-66790fb9f383", "comment": "Malware payload (RedLineStealer)", "value": "61221be0c1a1a39191550be28e12be6c7892ef4a8879ef2b931a08f528e61bef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033543, "uuid": "6e7b6fc8-d4aa-41d9-9b27-4ff897cada49", "comment": "Malware payload (RedLineStealer)", "value": "da49e81d8483cf6862eeb3a941dc7be823386be6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033543, "uuid": "55c9dd9d-098f-42d2-bfd5-173ef4546bdc", "comment": "Malware payload (RedLineStealer)", "value": "d7af9e6b1c5c25fb0c4452c12a7f4895b1a55b1a5f04fc40f90e75cf9d710de05a95aa8e4d8432c622493724a55ddb63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696033543, "uuid": "8fae2d11-e1cd-4deb-9356-1b4c883eaa39", "value": "T1F5152357ABED9072CDB427701CFE23930B32BCE1597C83171749688E6C72695693236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696033543, "uuid": "07f7fae7-e14c-4619-844f-3025835f3d21", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696033543, "uuid": "076b3a61-657a-4747-973c-06776a9b91e6", "value": "12288:MMrDy90nCCkjcjnFIHumsozVhv2In9gaTx4sZ4bSfBu48vBdosH9hD8riSt5Rlwl:/yJjcZcfXvgS4aZu/so9hDGiS1lwoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696033543, "uuid": "ee221ab4-1ca3-43d7-b002-87a5a2b1f8a0", "value": 878592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696033543, "uuid": "5583c99b-ff56-43b2-aaad-2781b3187d88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696033543, "uuid": "8f8f4fcf-1648-4077-b854-321fe5bfbeed", "value": "8015a689dedb82e08a271eb3c73dae25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f9990e-5f73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696066156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066156, "uuid": "86dbdccd-d3a7-4ed2-b6da-1b276b36a991", "comment": "Malware payload (MysticStealer)", "value": "451abd78791d8649af7b8ad87efc24e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066156, "uuid": "1df7d7b6-3f8a-4f27-84f0-2a143b1370a8", "comment": "Malware payload (MysticStealer)", "value": "61871ccf2e6d250863a6c8ba35541e9440700a7b2db0cb9e7e7ccd5c5214ae06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066156, "uuid": "470128ce-63e9-4b0e-b267-fee787bacf45", "comment": "Malware payload (MysticStealer)", "value": "5a53c36aca90c953dfae31c9e982cf68b5810033", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066156, "uuid": "3873dea1-ac2b-424e-9b14-5677fa1761f0", "comment": "Malware payload (MysticStealer)", "value": "d2f2354b15a76352d821219e0a260ec4f62341b14d9ab0bd3b952f7223550b9507761026920712208b9433ccd09af098", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066156, "uuid": "4c2a227e-93dd-4ed6-a6fc-dd56325171d7", "value": "T10A74BF40B5D5C472FCB3143605E0EAB7DE7E76205A060B2F63B40A5E4FA7641DB2A1EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066156, "uuid": "beb95a12-83ec-4ad3-b3ea-272f22637f1a", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066156, "uuid": "28e91e5b-dfdb-40a1-a4f0-4c16726bfea8", "value": "6144:mmyTeW/s5GqrO5aXnfEGIXWPvZAOgyAy6D8WQ+kuabVs0BC+:PmcGqrOk86xt9WQ5s0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696066156, "uuid": "f81ab4b1-02d7-482a-9566-f56951dbe8bc", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696066156, "uuid": "aa39cb26-5764-4e84-9188-4544c6b51208", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066156, "uuid": "dbade7da-c880-48ad-acb0-bb01912cbacb", "value": "SecuriteInfo.com.Trojan.Inject4.61510.5374.27215", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39c8e4f-5fe3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696114207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696114207, "uuid": "99f668e2-8c38-4917-9a75-0afd0bd13939", "comment": "Malware payload", "value": "cd9dc909c7bc9dcda697f52a533ed6ba", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696114207, "uuid": "a4817bfc-4c20-4698-82f9-0861a8adae1a", "comment": "Malware payload", "value": "624ed3c4bbbb3a8d31e39746b3865582c7afcbbc4658d7dde910b69f3e865458", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696114207, "uuid": "6b602975-689a-4933-9946-5645a944b724", "comment": "Malware payload", "value": "1c8712357eb7a2f5e1d51c30d77019652c528ca3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696114207, "uuid": "12dc91ca-698e-4b97-9214-cfc49cdae1cd", "comment": "Malware payload", "value": "eac2c3561b8f92563215dfb8f27aa74ebb2738bcf7d0e39e61947aa4b2cf97d5aad313371030e72c1cf0a11e986b711e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696114207, "uuid": "b4880e54-c56f-4618-aec8-c12b503e2a33", "value": "T1AA1318C4F553D9F0EC5A06703076EB365E36F1FA222CE553D3A5DA32BC82602E60699C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696114207, "uuid": "962485b9-536c-4b6a-8c16-99b5958512e4", "value": "768:xMlB2zs8ssGfrRI6aQ2nEenzDq8uDOycN95VlVs:YYzs8ssGfrRI6aVnEePWOrNrVla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696114207, "uuid": "c81af522-7111-47ba-a90a-eb6f6db849cc", "value": 41776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696114207, "uuid": "a0e6096b-c665-4501-8cc3-b7c9c22d34a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696114207, "uuid": "5a21b29f-4619-4822-924f-6ef3355ff0a9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc221c37-5fdb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696110812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696110812, "uuid": "b2c1b393-ec62-4cf7-86ea-b39fa836115a", "comment": "Malware payload (Stealc)", "value": "53c76e746b61a5ce059a4eb94360e4dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696110812, "uuid": "ef6a58d5-63dc-411c-ac5c-04215ec45265", "comment": "Malware payload (Stealc)", "value": "6349697e85a6be18e181d169e03777ec0c39d4da866a049fc5607cb7d536fcaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696110812, "uuid": "3f66152f-c0a0-431b-9f34-a77f89117802", "comment": "Malware payload (Stealc)", "value": "22b985a4f12629d6c2622837157ea82b1653a7c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696110812, "uuid": "ddae87b2-e55c-4e9b-87ce-bb6fb31ef258", "comment": "Malware payload (Stealc)", "value": "54f023a12136867a584bd5d0eb660b9ae8a0494fc6e7128582d5ddd667365fd00fd01f5747c3d1c5ce81716b2331e682", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696110812, "uuid": "0df6a83a-23b3-4314-8e60-95c73a8f5a9e", "value": "T174248EB362E16C63E567AB728E2EC6F87A2EF413DE54675E3214465F09701E2C263312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696110812, "uuid": "69558e77-6be0-406b-94d7-36d2932d2659", "value": "d323d1063364fcdde3ec2d7fc616011e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696110812, "uuid": "6a2c715c-4b53-42ea-9289-20ecd07530c2", "value": "3072:UQMBRMj1P+jpOIA6URVQfjOXy0I/GPXU776vj55/E8Gg3:UAhdR6URKE2GwWvXE8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696110812, "uuid": "f270cb67-74f5-48f2-9c13-20f0a7972a15", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696110812, "uuid": "2922cc63-2860-46e3-96e4-25c9329b3c26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696110812, "uuid": "4b66fb87-1c2f-47ec-a4cb-2134a341a335", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5a5cbe-5f72-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696065524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696065524, "uuid": "574e6f38-1073-41c1-b61b-c4d362b0f0e4", "comment": "Malware payload (MysticStealer)", "value": "af3ccc1da10ec12c5243855d536e89a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696065524, "uuid": "b4a864ab-aadb-4fc7-b11a-ab922d140a41", "comment": "Malware payload (MysticStealer)", "value": "63d300c494d2c8c93edc158b9edfbadf66f7df3f9f41b33bb6eab1da23e07eae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696065524, "uuid": "f0278af9-17b7-41a7-8cbc-e9421034ad74", "comment": "Malware payload (MysticStealer)", "value": "90d85b2fbdc369a6869a0e2be44d302a6ea3d07f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696065524, "uuid": "e1c37d48-324a-4150-a497-978599942ae1", "comment": "Malware payload (MysticStealer)", "value": "9e5e2de0369f4bcebc0e47bb7f9bef717ee1c32f895a8af91d02c4715d0f292f6d410ebc325b76d6d3e30b93061eab95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696065524, "uuid": "7c966b89-f852-4258-9917-8c796c66be6f", "value": "T15674CE1131D1E03DD8B215381EA0F3B95A2EBD2189455D5FBBF04ABF8E70A8092D6ED7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696065524, "uuid": "a396feee-2e83-498f-8d02-a70515dcdae1", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696065524, "uuid": "03f6cc86-42f8-4ab1-b6b6-e6c0c174888c", "value": "6144:l+GTeW/s5GqrO5aXnfEGIXWPvZAOCy+SRdFuBtQM9lW0UeEwqk9+GYVs0BC+:umcGqrOk86xlRdIBtQqA01T9lEs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696065524, "uuid": "d0b06e59-72b4-494b-a7da-12f2a3d837eb", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696065524, "uuid": "727058eb-a787-4b43-95c2-1cc954a48966", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696065524, "uuid": "d9e9002c-9cac-4f0e-aa25-1e4b972e3cda", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943f9367-5f41-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696044575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044575, "uuid": "4f586388-6703-4247-9a1f-2086911ef37c", "comment": "Malware payload", "value": "129b84fb7ad6599bc881360d512e827d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044575, "uuid": "938d49d4-3d88-487f-9cbf-3f147d39dd1f", "comment": "Malware payload", "value": "64119e925a2c5fe96481a18acdab674856490be0a3051e5e4508ac20a83ad42e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044575, "uuid": "408ff259-4d46-48db-9396-751b537b8b45", "comment": "Malware payload", "value": "169f4d51483e450281dc198e9d9b3b20e3896063", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044575, "uuid": "939a5108-c925-4a23-a80b-e8d93445db5d", "comment": "Malware payload", "value": "8b5e6e51358966ee0ca6e8aac5ab9ad28990df8bb278cbc0056f52cf1f460459d1cbe92d8070c090229f8c3b8aa385e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044575, "uuid": "613a6a9f-5f51-41ff-a879-9c1e2eb59ceb", "value": "T1FFB533517BA6C0FFD1816438CE297BB9A1FDC7C84B39C157A3644B2E6F64758C22092E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044575, "uuid": "6835484e-236e-4ed5-86ff-06455709785a", "value": "4ba3ea0d6362a841ec66a1fc0a1b874f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044575, "uuid": "c8eed73b-e94d-404a-97eb-cd3d68d4dcaf", "value": "49152:ufdrf4AJ8DGUehMBNBSHnbaG4XWEucbfntpvSCD7EJ9Q:OrZ2GBhoNBscXducbfbZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696044575, "uuid": "5e7f584a-8401-4a9c-8426-7446cebf9d5e", "value": 2323691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696044575, "uuid": "49be1103-16b7-4a27-acae-37265588eeda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044575, "uuid": "f739420e-bda2-48aa-a66a-9741ca5e7a60", "value": "SecuriteInfo.com.Win32.Evo-gen.2912.6588", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9085d3-5f99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696082196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696082196, "uuid": "be0bb66e-782e-488a-8437-b6420d084b9c", "comment": "Malware payload (Amadey)", "value": "d767518c8e3ebeec8da4c467783d0abc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696082196, "uuid": "36945307-7a06-4514-ba4e-429fc42da990", "comment": "Malware payload (Amadey)", "value": "649ac055bd38afccc57c2adeecc033c6ac1e845c51296b05e861cbe10c6e2999", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696082196, "uuid": "03c7c428-5e50-4086-80f4-5546968ddd68", "comment": "Malware payload (Amadey)", "value": "16651997553c08dcf53ee88b4b8ddc2a96077d6b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696082196, "uuid": "9332cad3-d38d-49c0-b5dc-ee905c0645c1", "comment": "Malware payload (Amadey)", "value": "3aac3a8ee04d645ff4588e2fe2655321e3a86034f96303091dcb4253e1a4f3a80a9f209e84ae9bddb0e9342178e5e95e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696082196, "uuid": "cee5b84b-9cea-48e9-ab69-9c16b2518b80", "value": "T103252302BAD98936D8B277709CF302530E36BC555EB4879E3381A96F09733A5F03675A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696082196, "uuid": "5f53fc72-2c5d-4508-af3f-59be25092e48", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696082196, "uuid": "8711179b-71a6-4064-aa6f-1dfead3e2409", "value": "24576:xyCvfZQgCiIKckEDFN1KR1JAfA2/0uGXeNIvhzfN51Og+H:kQfZXCiIKG71OJAo2/+XeNgtvkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696082196, "uuid": "bf01b63e-2764-495b-ab99-97c4d36e41ae", "value": 1017856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696082196, "uuid": "b5a80e1a-4d5f-4c51-b117-00f28af7fd06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696082196, "uuid": "0c0c675c-ceec-4e2f-b933-c63c5a42cd83", "value": "d767518c8e3ebeec8da4c467783d0abc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "333bfb54-5f5a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1696055150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696055150, "uuid": "f5447e7a-fbf1-4a1a-95a6-d8c8cc8c24a8", "comment": "Malware payload (AsyncRAT)", "value": "6cfc8a19911d2a4401c1c362587e83ce", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696055150, "uuid": "62d8ec73-6cd9-4406-9117-efe49226062a", "comment": "Malware payload (AsyncRAT)", "value": "6543c547b83be07c11742aebcba0264026667005c7d4b90ca9ee8da62ad06984", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696055150, "uuid": "da7c0dd0-a176-47f6-af94-7783c18534eb", "comment": "Malware payload (AsyncRAT)", "value": "757f656302382738175a6a73ed7e412bba55011c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696055150, "uuid": "ad632abf-7531-48a2-8052-9d74f29b5d11", "comment": "Malware payload (AsyncRAT)", "value": "a9ce0158141814ed05c559472e622bc20ef4b05ef29bdcd366da6e78f98c28e1940812b1c13714748a0f67adf890c249", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696055150, "uuid": "5434538d-d7db-490f-8178-0ba590fc5943", "value": "T121B628C7F99140E4C1AED37486669252BA703C885B3027D72A60FEB42F37BE46E79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696055150, "uuid": "ed66170e-869c-4e85-950f-56ceafe31e5c", "value": "e6efb84c997b145566619aa9dc9a7eef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696055150, "uuid": "7d71f07a-9e81-4f91-b2a0-916ed0b04535", "value": "98304:01+qfbaSe1um0WohRcxAqV6EiTEEhG8VdjDEJgkKQ:nGWM0x7VdiAfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696055150, "uuid": "57065062-67e3-4c6a-845b-46f91e1c8614", "value": 10668544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696055150, "uuid": "dbc18391-bdf8-4fcb-89fe-7d16cde019f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696055150, "uuid": "a538a594-daf0-431b-b6a2-6cae8bc376d1", "value": "6cfc8a19911d2a4401c1c362587e83ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7dc4956-5fd7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696109060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696109060, "uuid": "871026a6-148c-4359-bd4d-f07c6a9ed376", "comment": "Malware payload (RedLineStealer)", "value": "761e0ad1c1cfa050de85172180f276d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696109060, "uuid": "9d33d25a-7ca2-4ae5-8aa5-27885bacb168", "comment": "Malware payload (RedLineStealer)", "value": "6566e4617f2b4a89c9d74943c195606280c471cc6a36242c209b831fb7a5db94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696109060, "uuid": "94951d32-c685-45ad-bf85-f15d1fbb2f01", "comment": "Malware payload (RedLineStealer)", "value": "26c8e982da837a9372b986a0bd09d54defe8601c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696109060, "uuid": "943bc3a5-f99d-41ae-b9f2-9d31f687662e", "comment": "Malware payload (RedLineStealer)", "value": "3bf2cf173853c4133d3860f74f2464b9dd02a45391e219c46877e5d608dc7071905f25850084656615c4bf860ef0129c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696109060, "uuid": "67949464-9fb6-4887-8aac-9f887ad41de4", "value": "T1E2657D7139C18971EFD2107645ACAA2786EFE5B00B2605C76EC45EEE972C7C12F32792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696109060, "uuid": "15e70af6-ce92-4754-84a6-1d6a535735ca", "value": "500aa68029ae375a898af1edb3f40b87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696109060, "uuid": "0a8bbb19-56f9-45c7-9a3d-acdc433d95ac", "value": "24576:egyzyicBpqoZTgVKfptq6PQMR7y8rr6r9RerrCrrwrrhrErCYb91:eEBpqoZTg41Pd+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696109060, "uuid": "9f0a3f0b-efcf-4d80-a714-b856e8c35d7e", "value": 1498432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696109060, "uuid": "a943a2e3-8cbc-4443-ad90-99b3556b4da7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696109060, "uuid": "5cb393fb-0330-49cf-9564-637c43ec18f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53f9762-5f8c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696076950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696076950, "uuid": "17413a36-73c0-4df6-8c21-09c1672431d5", "comment": "Malware payload", "value": "deee84c40a180ea7a52aa09f240263b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696076950, "uuid": "31331b14-f5e6-4e55-a68d-ae14fe804f09", "comment": "Malware payload", "value": "657ce9b72278bcbc3d100ea8a012381ceee3402bcb19977befb69f4d7459275b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696076950, "uuid": "00e4671e-2c5d-4f06-bf63-2244cbb64560", "comment": "Malware payload", "value": "3136c29e0019939a91e63611db1cfd34030286f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696076950, "uuid": "ec453d12-9eec-49be-9b55-a7c974a90fe0", "comment": "Malware payload", "value": "d65007fac0215c75ed5253e27c7b35646d40e60d57081dea31b009840f08f94b57bb4aaf56d656ed9ebf9809d5f76529", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696076950, "uuid": "6386b496-562a-4e46-b03e-f6e73f9a54f4", "value": "T19AB533533EF889FFE1100774DA5CDFB952F4C3AA0F189CE34785871A6A3E1929324669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696076950, "uuid": "57cbb9d6-c01b-42cf-a2bc-64efac6d212a", "value": "4ba3ea0d6362a841ec66a1fc0a1b874f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696076950, "uuid": "00d1d882-3af9-4f90-a0b8-b56d0a0c709d", "value": "49152:uf14S1LNzSp9C/iVUfcN3c1Ry55HoBmq9wYPJ3uIFAxu0fnaJKdpWIWB:wrzSLCHfcJ5gbgIyRfaJm4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696076950, "uuid": "1970a9a7-1167-434a-a994-36b2f74dd68d", "value": 2295760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696076950, "uuid": "ed986888-1212-4601-9f08-3f54b8124600", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696076950, "uuid": "085cc425-dce5-4500-87c8-7af02f69319e", "value": "SecuriteInfo.com.Win32.Evo-gen.12168.5292", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959f7d8c-5f39-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696041142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041142, "uuid": "fc8ebf2e-f7ca-4ad5-890e-29877e05cadb", "comment": "Malware payload (MysticStealer)", "value": "9225ed5757fbcff8bc9831681b1fe829", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041142, "uuid": "4352bc0a-5f14-40e9-87aa-59564fab1340", "comment": "Malware payload (MysticStealer)", "value": "6583d162dc7a9d7fc5213e8637e827645daba3425b974433c511f1b8f136f6b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041142, "uuid": "88b4373c-3295-4bd4-b6b2-d22a46b76baa", "comment": "Malware payload (MysticStealer)", "value": "fd9b85faaab3a51a579a95c865309202996adddb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041142, "uuid": "3295024f-ac71-4f8e-a0bf-9a848ff17047", "comment": "Malware payload (MysticStealer)", "value": "6c24b1060cddcc92ad8eb9943c601d2ace0154d0bc0a96f69aa214a1afc00b2d7bb7edc264abd8618e09fec3807f6e9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041142, "uuid": "e7c88e03-d3d8-4b7d-8f89-0a8f4ef78fa1", "value": "T19E74BF1070D0DC31ED7112364AE0E774B83EED340AA24D9F77A26BADDF7C641A62D4A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041142, "uuid": "d2728c5b-02a4-49c5-920c-87dcd84735f0", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041142, "uuid": "48fa94a7-93e7-4920-8fd0-2966153489de", "value": "6144:gBTeW/s5GqrO5aXnfEGIXWPvZAOvycBeCtwDlyGT0qQvaC1KbVs0BC+:RmcGqrOk86xLiJy8QCC1+s0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696041142, "uuid": "a3d5519b-373c-4598-b4be-700ae9a272f0", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696041142, "uuid": "c17cdd4f-bd5f-4ceb-bf2a-c67af66f6733", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041142, "uuid": "a43de37f-f1fd-428d-b8b5-def3f3b61bf5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c2c73d-5f28-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696033841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033841, "uuid": "fb935152-37a2-4d70-99b3-0705690dc956", "comment": "Malware payload (MysticStealer)", "value": "1e91894c797d1258d4f38fdcf6ff9cd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033841, "uuid": "de11e5cc-8d30-4117-b609-909f6d4fac26", "comment": "Malware payload (MysticStealer)", "value": "65a38f26a7400a6604084173b599898f4089904598b2437329a84464408a01e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033841, "uuid": "181adb72-6d42-4314-8216-0bbd3e8629ab", "comment": "Malware payload (MysticStealer)", "value": "1f07452c96e7d03d212c7b5bd53233d26be1ba84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033841, "uuid": "f6bcd7a1-ce53-415d-873f-87ecda40b317", "comment": "Malware payload (MysticStealer)", "value": "02a6e020ecb49942c050c870f9f338a636f62ed163dfc6d9cf4eff4439efd3a8b5acf45e18e200ddc15ecb3e57c583da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696033841, "uuid": "32416d09-74a5-4453-9bbb-a3fedd92f4f7", "value": "T1A774BFE032D2B03FDD22513A01E29BB6857C2964CD91566FA3A5CABE5E30580CDFE573", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696033841, "uuid": "a5123691-2415-478a-b479-d307b5557c1f", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696033841, "uuid": "c92e8982-6156-4e57-ab26-baa5b5b6f642", "value": "6144:IwTeW/s5GqrO5aXnfEGIXWPvZAOSyYXCMse+gfMSyt6Nyq1W1Vs0BC+:4mcGqrOk86xE0gFyto4s0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696033841, "uuid": "90f03430-06e0-478e-8883-7648548895e3", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696033841, "uuid": "effbcf95-043a-405b-86dc-b33f81f43b2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696033841, "uuid": "127c2322-c574-4a17-ab5c-d230393d172c", "value": "SecuriteInfo.com.Trojan.Inject4.61510.23544.7624", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b01164-5f2c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696035673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696035673, "uuid": "befd7d95-3d28-4f65-a74e-83f41ba6391f", "comment": "Malware payload (Amadey)", "value": "a10787b88fd256998dc0c00b807d05f1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696035673, "uuid": "aa9da671-3721-46df-b631-1f085c2632ac", "comment": "Malware payload (Amadey)", "value": "6674451579a7f19b0bd1bfb2e976eb8e66a3f5dda7c6abc3e097bd5674443eb5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696035673, "uuid": "2e6bc7ec-9dac-4d69-872c-23734bb8b807", "comment": "Malware payload (Amadey)", "value": "07ac914b48d3984becc58a1b8718b90e06e12af9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696035673, "uuid": "e7e71cc8-2efc-488a-a2dc-f0b2a4ba2949", "comment": "Malware payload (Amadey)", "value": "e27982cdb41a4795daceae6ff0ea3c2a0bf8bad6a9c5091b7f642c8ac9e79213c198155c51fb25132c3dc8cc2bedc094", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696035673, "uuid": "15c65194-88a2-4fbd-a3d5-acc9bac568e9", "value": "T197152352E6D49470C9F527B4C8FB0B871B32BD918F70876A3259685B0C72694BA3273F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696035673, "uuid": "70fc187d-16c0-4984-b282-b0ad163ebe4c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696035673, "uuid": "2f3aa649-e3a3-4fd3-9d36-456957af7bbe", "value": "12288:BMrQy900/v52FG0DwKrIsLnBH0hWvgzAX++ptqvgmVpPxQAYb006Me6yIjpcMa1:ZyFXjYnBUh+qAXHtpYaAYw06My0Pa1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696035673, "uuid": "2dc86d62-115c-41ac-9ec5-8b0f19fe7489", "value": 886784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696035673, "uuid": "cf992d6b-0d9d-4603-af46-8ad3d4decfdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696035673, "uuid": "5bf29182-6e40-40a4-85a4-13259088ef9e", "value": "a10787b88fd256998dc0c00b807d05f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50961c33-5fb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696092136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092136, "uuid": "19594d41-4c33-4262-8297-908d30243547", "comment": "Malware payload (Mirai)", "value": "dd3aef579e946de01d3841ce2a1504d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092136, "uuid": "f7a72f05-ae7d-4a0d-9eb5-5ea7a49b9d55", "comment": "Malware payload (Mirai)", "value": "667b0396e09858b80408b278c887da5a70366aad69e4dd1987c7ef76a08c6b07", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092136, "uuid": "35dd518a-1dae-4b6b-923c-a07ab4ee1ddb", "comment": "Malware payload (Mirai)", "value": "1afffabef80c27b4176b4ffdd71dd3d211f03eac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092136, "uuid": "e6ad0435-984f-4260-943a-d1ce4eeec20f", "comment": "Malware payload (Mirai)", "value": "490a6554f4c865bcb4b77893d86890c9449da4fc469746af10ddcd7518f91d12666ca8e73ae5cf78d34d7b77d3401f2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092136, "uuid": "57be2af4-a072-47f3-9fb1-602e539ef7c4", "value": "T1BE235C1635793A07C0E2A57A05BA4B1275667FC82294C24FBD732E4BFE233505827EF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092136, "uuid": "56e9092a-9ac6-40de-ad2e-96517470d5a2", "value": "768:l/cGoodgwtYeRWxnjo2WngB3ZZ5Qwzb5zCDdDLKC/qkbtmWwwcP:tcGxOgYeRWxnj/WgB31RzVzgJt2wcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696092136, "uuid": "8cb202f0-75c2-4e64-8d5c-a9a9375fa067", "value": 49456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696092136, "uuid": "41c41dc3-3f3f-42b7-ad44-3678641f250a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092136, "uuid": "92cb905d-f3de-4517-ab82-7aa14bf869e5", "value": "dd3aef579e946de01d3841ce2a1504d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "601a38c8-5f95-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696080566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080566, "uuid": "ce296715-ab75-494f-9bfb-c21b86cba4d7", "comment": "Malware payload (MysticStealer)", "value": "07ff88e40b384508ceb763ac6cb03b42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080566, "uuid": "46603d50-7854-441a-a37b-c3a86afe090e", "comment": "Malware payload (MysticStealer)", "value": "66c130bac5a4641ee4975154fc4b2a0d750bcd7002000f5630371dd48ac5e395", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080566, "uuid": "04bab293-29db-47bb-8934-2678b468c005", "comment": "Malware payload (MysticStealer)", "value": "eebf24c589c93fa7aa334bff603d5cdc9ce62b90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080566, "uuid": "70f4b856-3b28-4ad2-baf7-f7e7f6bb667c", "comment": "Malware payload (MysticStealer)", "value": "5c84994a85220b6a5685d801b5990ea8081d9dcc02f762bcc6341c38708f391da64915290064d3b5c99d2ed345167aa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080566, "uuid": "3519d8d9-a223-4ec6-9758-069f73f2bf25", "value": "T1D974AE1134E04835D4E3763466F4E777FA7EA9200B798EDB37A40F7D0A202D5EA31A5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080566, "uuid": "b035b0e0-71d8-47b7-8b7c-6655670cec88", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080566, "uuid": "5ef5fce2-3cd3-45ee-8a63-9aeb8ee71b6d", "value": "6144:AoTeW/s5GqrO5aXnfEGIXWPvZAOXyxM+mAZUHwvo4IIuzarwOnnnMzX6DVs0BC+:0mcGqrOk86xV+mAZAwg4IIuzOnnne6B9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696080566, "uuid": "bfd6fb73-c46a-412e-b39b-8a02e8ffc1fd", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696080566, "uuid": "60855f18-3903-4a30-8747-972c6670b381", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080566, "uuid": "e36949a4-a7b5-4d6b-b0a9-b7539b8360f8", "value": "SecuriteInfo.com.Trojan.Inject4.61510.5581.9729", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667e46ab-5f81-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696071987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696071987, "uuid": "6a87e7cc-c47c-462e-a387-c9fa55ecb495", "comment": "Malware payload (RedLineStealer)", "value": "2e7e4daa05986464589f3d6249cda832", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696071987, "uuid": "29febb10-0fef-4a6f-8f20-cdc0543bd438", "comment": "Malware payload (RedLineStealer)", "value": "671abec3ec73f8d41b78a7129c9312ddab524dad22c0509f16c3ab4fc02d6ce7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696071987, "uuid": "113d4210-ffca-40b4-bbcf-f8728782ca54", "comment": "Malware payload (RedLineStealer)", "value": "0023e38c52d3075dfc57aafd2dac57bb18b5c59a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696071987, "uuid": "39dd7b0e-d117-4c5f-bf7d-36ea2e134c1a", "comment": "Malware payload (RedLineStealer)", "value": "9e2b9fb35cd2da2001953c38367e3f12bc9a669cceb3ffbeba6671ca9300cbe6f250610f1bda1cd4576a28e26499aac1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696071987, "uuid": "baafa428-3d19-440b-9308-07cb64bb2170", "value": "T164352393A6E84067DCB11B705CF24B830F36BDA86D78971716C46A9F4833690A47277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696071987, "uuid": "93f7ebbe-77b1-441b-918e-592d765f5cd3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696071987, "uuid": "b7805914-63b8-48d3-8f4a-18c7e672a042", "value": "24576:Ty3zLkzQgUVH5k0XC2M+LyGPwMlepMI0AvaCPlt:m3z7gkH5NC2MoyKwMl83aCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696071987, "uuid": "0476b8b6-6a16-4d29-8051-818a4cf72438", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696071987, "uuid": "dada4e9b-a7eb-4b5e-91dc-4786d2aa9172", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696071987, "uuid": "c8554f18-67f0-4cc8-affe-a20e0b7984e8", "value": "2e7e4daa05986464589f3d6249cda832.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d57feca-5fbd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696097634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696097634, "uuid": "e814f5f6-df48-4e31-a1eb-a1f6b3c6df81", "comment": "Malware payload (AgentTesla)", "value": "a76f9e7966810e99844c981fcff28cb1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696097634, "uuid": "f398cf7d-0549-400f-98a0-51de96341621", "comment": "Malware payload (AgentTesla)", "value": "680142a2cafcc943b14a2b6984f7186e37bcb0bee2a19ef3d878d1213b93f756", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696097634, "uuid": "b7744df5-0bb1-4d9c-9a81-93dd3da26e7c", "comment": "Malware payload (AgentTesla)", "value": "5957033481c2bfd05f45d13cc5f9a0d44dd60535", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696097634, "uuid": "1523330a-36ce-4ae9-a0b6-da65f3bf70b7", "comment": "Malware payload (AgentTesla)", "value": "528530bea4f3c38cd6878d94544bdd9ccedd50ec6ec47c42e19d29032060044876890744803e93c9106eb2c1a6594cf2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696097634, "uuid": "0c0c2c7d-d86b-404c-9148-8df7f66ffaff", "value": "T1E9142A49B7F44906F9BE6B3248714C496370E8925923EB0D4FC264A95F33780CD9BBA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696097634, "uuid": "3877ad5b-e322-46a8-b0d5-7259ad36094c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696097634, "uuid": "835504a4-88fa-455b-b152-c16a739e57e3", "value": "3072:qY5X8ALUWNTkH+LGP34oCKerVUzeeDXbwa21Dv9ua/aHyvAld2igyk2:qY5sALUUSbwv/yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696097634, "uuid": "ad73b9e4-953d-4807-af22-c47d54dc0854", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696097634, "uuid": "3927a9ea-8b05-4526-bf9b-d27b4a024877", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696097634, "uuid": "5e395c42-c23f-4f80-95d0-4ae9da757bf3", "value": "ProtonVPN_v3.2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea4c5a9-5f87-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696074604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074604, "uuid": "117959ed-a3d1-4921-b8be-92e41dd0af61", "comment": "Malware payload", "value": "997f35de7455a0d45e7fa2b3868e468e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074604, "uuid": "b37b4484-853b-4c61-b3bc-736cb9eb8f86", "comment": "Malware payload", "value": "68141b9dfbfa67582aed133e3dfe99434425e0f20d9bcd589fb8ac6dcb879c54", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074604, "uuid": "59673169-c91d-4c6a-b828-9b2564a64474", "comment": "Malware payload", "value": "b8f20e12093228d2d9a7ec3e692172f20507b93f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074604, "uuid": "5a898dc6-c127-4547-9dd0-8d5f9315c0e2", "comment": "Malware payload", "value": "efecfbda7c452c1302fe48e75a22efe3646c8d2519725bf20297a91f6d62fe9c65b97ff19617168360fda488353c66d1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074604, "uuid": "ef8819c1-2a0a-4228-944d-08797feab0b1", "value": "T17AD2E11C37012436DD52067B44CE6B642FF50F93711A5842EAE889A9FBC638579EBDF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074604, "uuid": "2978e86c-afe2-4f31-9ec7-a152417dc808", "value": "768:Hg0emYF8XeHdSFCPg62VLqnKIQqgqsJgGlzDpUYsu:Hg1HSFCPrpyEkVqYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696074604, "uuid": "1e1bf9fd-13e6-47a4-adad-7b2ab9b1c9d1", "value": 30280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696074604, "uuid": "ff944e51-9283-47c0-b1ef-dbb1851a9dc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074604, "uuid": "63600aa8-ec5a-47b2-ab08-f299b9386933", "value": "devx.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f21031e-5f5e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696056969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696056969, "uuid": "e9975de5-947d-44bf-8b85-d6e23e6d7165", "comment": "Malware payload (RedLineStealer)", "value": "30fd88f39f02f41c5630bc3cb5118ffb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696056969, "uuid": "cf6d42ee-886d-4eab-abe5-08ba588f6d62", "comment": "Malware payload (RedLineStealer)", "value": "68a124a413a17ca571b1b3f98788afdb4b79d730c52f7a342012d0295cad9810", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696056969, "uuid": "94e72c92-6fe4-47a9-9640-369b6592c4c6", "comment": "Malware payload (RedLineStealer)", "value": "6f28c09134b33177bc2a0f2d30a810bd6a907bf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696056969, "uuid": "0a292015-d269-4c8f-82e4-1f14e0b931ed", "comment": "Malware payload (RedLineStealer)", "value": "b8b5d421f2c6ed879fc9c490194d66eb509e63d4e08ac5eab0c95d4158c9b2a3b3d544a290679c723f3cbef57d8b0440", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696056969, "uuid": "287deb42-4c22-46b3-a03b-5fbcd4279327", "value": "T1B9352363DFE89032E6F22B7028F70B831A383DE0CE60C12A6648579D4D72655A5757BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696056969, "uuid": "807a4da6-de4b-4c1c-8362-a91026d298f0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696056969, "uuid": "1d8286ae-a8e5-4975-ac36-4104318ba9cb", "value": "24576:ByWoZMS5I7ahhU3FlBp33mqY0WzaSt7W0+sCroaxSuIE:01BI7ahhIbBpn+BOStisgocSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696056969, "uuid": "48d1f2c8-270b-4525-9b91-f863fac8e56b", "value": 1094144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696056969, "uuid": "3c495071-251f-4908-8654-6de12748b82b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696056969, "uuid": "3415671a-d664-4ddf-ba3b-544d255ba31c", "value": "30fd88f39f02f41c5630bc3cb5118ffb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81eb2a82-5fa6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696087924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087924, "uuid": "655439f8-172f-4efb-9918-5ca2fcdb4ff8", "comment": "Malware payload (Amadey)", "value": "a1fc5762906cf8412a80bf673a4502be", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087924, "uuid": "3149466c-a8be-4613-ae88-5374bb3c12c2", "comment": "Malware payload (Amadey)", "value": "68dd900449984b916d3837f3e066e2515d258d3866d9e0cf500d6f731b73c3c5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087924, "uuid": "4be0604a-7546-430a-bd66-952561d365b1", "comment": "Malware payload (Amadey)", "value": "368b8bc1ec67c73412b32933010d1b0d9ddca298", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087924, "uuid": "1bd58b9a-79fd-4ca5-8a3f-8d14b609e7ad", "comment": "Malware payload (Amadey)", "value": "6123bd1e2a6ad7d4d0636c6aeb9243feafa631ae27b8567a2c74ab8a1cdcaec1aa69e7026dea6058a65e203c7659876e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087924, "uuid": "037663e7-14a6-419d-947a-bae3f3b9ff36", "value": "T15B25236BE7E44236DE7C23B41CFA02C71D31BD218974C5662A99A81B2DF22E4747533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087924, "uuid": "f6cdb1c1-a7a5-4ed2-8f79-81b9dc0fd47c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087924, "uuid": "13f41c83-627f-4429-8037-a48eba98e106", "value": "24576:+y3W5ZvXdMBynJJhUqrUxd9PbKaHZlpatb9KjCja:N3W5Zf+qXnUxzbJHZlpopKjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696087924, "uuid": "78a27cb8-8d3a-45b5-b69d-7a8949d7eb1a", "value": 1015296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696087924, "uuid": "3bc1b73c-9e45-41f6-a426-36585e8ceab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087924, "uuid": "83ed4d6a-aea2-4fbb-83e4-97db6c4f869e", "value": "a1fc5762906cf8412a80bf673a4502be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f782ee-5f6d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696063280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696063280, "uuid": "6017254d-690d-4ee9-ba20-6b5f4e28ef3e", "comment": "Malware payload (Amadey)", "value": "a307e7f94ef6b15bf86730ef7b68b3cc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696063280, "uuid": "09182c87-5e5a-41ab-af3a-be64aed83005", "comment": "Malware payload (Amadey)", "value": "6b2aa2329a2a660bbae59ecb26d9b15607c4b553b5d855b253bf48cfb783d100", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696063280, "uuid": "ecbf57bc-0274-406c-943f-39b337e522af", "comment": "Malware payload (Amadey)", "value": "ddb643fa2beb89944d96ad72649584f2b1473748", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696063280, "uuid": "27fcb0fe-c241-4a17-9220-9680c9bc4a27", "comment": "Malware payload (Amadey)", "value": "13c9e24089259a8f2ed163400b26eb8dbe44dc91b0a54324900ecd99cc5e7edbcfa51dda7b3d3f431ac31dc6fd959e27", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696063280, "uuid": "c2a81235-2473-45bc-ae2a-9c3e4e343a8b", "value": "T1002408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696063280, "uuid": "a23d8d4c-27ee-4d00-8b89-108daed13ca6", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696063280, "uuid": "ee239d47-00f0-4ab6-a679-cba45fd0b8e0", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696063280, "uuid": "450bb20c-9db8-4620-a13f-eac06714a95f", "value": 224593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696063280, "uuid": "c3ddb052-a9fb-453e-8dc2-dd04c0d13223", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696063280, "uuid": "eabefa13-4f0a-458b-b41d-0bf076971d2a", "value": "a307e7f94ef6b15bf86730ef7b68b3cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7533dce-5fa6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696087987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087987, "uuid": "4425ac01-0985-429b-9b9b-428887d440bc", "comment": "Malware payload (MysticStealer)", "value": "83e8b21e72ce54d5e780a85d95e4fc66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087987, "uuid": "96af2a3b-2d84-445a-88ef-3e661ca84ac9", "comment": "Malware payload (MysticStealer)", "value": "6be9f0b4ecd23cf9cebf99a3448a34333ecd25e850f17c7569d673ff9474b241", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087987, "uuid": "ac091c52-c538-47ea-b8c2-35574e25aa94", "comment": "Malware payload (MysticStealer)", "value": "6c8042d6549c199fba16a5aff4647b9fd1c3cb9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087987, "uuid": "76d7ef73-4838-418f-8de4-c91cedf1c0e7", "comment": "Malware payload (MysticStealer)", "value": "b1ed5ac633add08c5343a6286ee1483d2d9ad44904c8271b2e4a0d16e2220b1ae269573bbfc0745684b51d74b5496be0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087987, "uuid": "2d1d36c8-94da-49bb-8216-afd9dc6f88c8", "value": "T16E54BF8A39D0F126E934183A0631E716872FDDF55B50BAA73348173DEEC05C2EB64A5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087987, "uuid": "3c353f19-37da-48a9-977d-af99d65fd8a2", "value": "5b961e24b82512d2a00ac6c970dad1c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087987, "uuid": "329a49a4-2a9a-4329-8835-4d737662c5c0", "value": "3072:WhDUoGoyi7Re9jWW4Vu6106vOiIPMoCG7YjEDEY7bdAqqEEWjA2WfquCum7BzqXv:Whg3KajWpVP06acjO7bWEEWJmmYZ9rj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696087987, "uuid": "1e1f2809-4689-42f9-8acf-5d4346e29d6e", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696087987, "uuid": "305e3e99-bd0a-437a-bfa0-f77118773d3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087987, "uuid": "da251b6f-b067-4e56-b81a-7ea5947f2d36", "value": "SecuriteInfo.com.Win32.PWSX-gen.9908.10449", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec446d3e-5f68-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696061474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696061474, "uuid": "057672ae-5466-42dd-94a4-bf5bbc05666b", "comment": "Malware payload (RedLineStealer)", "value": "7712234da225ca90f4aa3a90808aa13b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696061474, "uuid": "fbc564b7-915d-4d12-b839-0ff2c692f787", "comment": "Malware payload (RedLineStealer)", "value": "6bf243e75ee6f0daf90f66fadd0aa7c74358e2700c00543f82f64c5a4a998085", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696061474, "uuid": "b7c4aef0-5ff5-467a-b57e-15d6b4924a73", "comment": "Malware payload (RedLineStealer)", "value": "86d3b4173a480355e56a8ce0a34e332544ea30b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696061474, "uuid": "5cb5600f-d385-4a96-b3ac-d0bb50a5fd3f", "comment": "Malware payload (RedLineStealer)", "value": "775b1d0f996a7376d1851e4906a770614da955ecfe46e3759799944bde1b34d3e7bb91020563dd1f3c52866db61b5f3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696061474, "uuid": "dfffc286-af35-4fd2-9501-c86d96d5973d", "value": "T1AE3523416FC49123DCF1273498FB03C70E35BE758A749B6623A9A9468CB3695E932337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696061474, "uuid": "f01b82ec-7585-4a13-9deb-6de19299131e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696061474, "uuid": "dae4f650-b09a-4c30-a9b2-81dfb957077f", "value": "24576:wy2/CdnVV74P0zCHwQLy1Ly7cErBJ9HeulN69:3Ndrg7sy7hthN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696061474, "uuid": "af648b6f-d3aa-4fb6-87ca-c86946a8b357", "value": 1099264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696061474, "uuid": "9c1f4792-ad01-4e24-b46b-3e3d2d3161f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696061474, "uuid": "9fd81326-515d-4054-bdac-d7c44ef7916f", "value": "7712234da225ca90f4aa3a90808aa13b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8bb43b5-5f2d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1696036047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696036047, "uuid": "0e90b5a5-c05f-4e99-a8d5-6f2c80209e2b", "comment": "Malware payload (AsyncRAT)", "value": "47f036f9996df7d9d5809b698fd41f75", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696036047, "uuid": "09f15ae2-9a88-4d50-9fdc-d942b48bcafb", "comment": "Malware payload (AsyncRAT)", "value": "6c5fd2c3ea7ab79e05f224db020cb5dac63b3aa2a81f691753c7020e0c6159f2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696036047, "uuid": "73b325c0-5335-4302-9221-a42cf18d6a4f", "comment": "Malware payload (AsyncRAT)", "value": "de5a3ddd6f1fe193e5b4479a1be4f3c3c3f9ca8f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696036047, "uuid": "ec28b364-dc77-4bef-a3d2-b1b5bd25316a", "comment": "Malware payload (AsyncRAT)", "value": "cef14343528786cfec5b5234e18695e70359ac9023ee3795f720623ff244e9bcc760c87ba706ee4f03ba8cda8d3da0d8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696036047, "uuid": "f1bc8f3e-0eb4-4949-a666-46e6c13522c9", "value": "T1E3236D403B98C136E2BD4BB4ADF39245C675D3276903CA596CC824EA2F13BC596136FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696036047, "uuid": "1c41dc17-d7b8-45b9-9a6c-2a858d751671", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696036047, "uuid": "f5f7ce0e-bff9-457f-863b-22c5d3532233", "value": "768:gq+s3pUtDILNCCa+Di9q+WisE8YbBgeQgwvEgK/JHZVc6KN:gq+AGtQO9q+zbu3ZnkJHZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696036047, "uuid": "e214697b-18b6-4ead-a42d-7983aa6a6129", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696036047, "uuid": "348d765d-6c3b-41a8-91bf-2dd439323bb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696036047, "uuid": "3bd479b7-d25b-4558-a3fa-63238a1d1fc4", "value": "bQoY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6c7f1d-5f70-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696064779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064779, "uuid": "f5b51f23-7c7e-41f7-a1ce-6d1e3b242620", "comment": "Malware payload (RedLineStealer)", "value": "463ee139ace4af87b87b815bd3d5df8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064779, "uuid": "ec46a224-eaf3-4b27-a019-2278d048deb2", "comment": "Malware payload (RedLineStealer)", "value": "6e053efaafd44585f10e99ae9c0f71fb6ab84964fe1a23c30dcbb8423e83a549", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064779, "uuid": "943d5674-eee8-4405-8587-ba9224c033e8", "comment": "Malware payload (RedLineStealer)", "value": "18d99061c2c497adc728209891d196b3b1b4b1e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064779, "uuid": "781e7d87-b016-47e8-9831-2fe34fa02d80", "comment": "Malware payload (RedLineStealer)", "value": "0988da92bbf484530b7dce9d46dea73ce2ea07106577354a6cb8ad8ad3160a1691a01f225edafdff55c96044c00ae033", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064779, "uuid": "32455145-0993-45fa-8bbf-836d8813ee7d", "value": "T190352302F3DCA432D9B537F058F642930E3BBD508A7887AA379618590DB33A895357B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064779, "uuid": "4d063f13-b9e4-41f9-a1e8-310e58b9eaf7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064779, "uuid": "95b1f1f4-7983-4af9-ae90-c142cd774c18", "value": "24576:iyaVdEAg/o+/HN5uF1YpI0T36qJ4yuDWBQKqHKslsQ3TZC:Ja7BgR/HrOept36qbqqgsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696064779, "uuid": "8b832302-782c-4a90-b28d-492a6d763b64", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696064779, "uuid": "2be7c2e0-cf6c-414c-a475-3873214d2c01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064779, "uuid": "27ca49d4-1e9b-473e-b07d-06c728e4510c", "value": "463ee139ace4af87b87b815bd3d5df8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15378bc0-5fb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696095472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095472, "uuid": "2bf639e9-d8e0-4e48-b3fc-3e3939ae2411", "comment": "Malware payload", "value": "0fe163c79f70d836bd8ebecfe9e67686", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095472, "uuid": "50a19bc1-81f7-46c2-942b-679cc82ed2f5", "comment": "Malware payload", "value": "6e645e1961ff828d8c27e9e9bebba31a0afcc90546ad1da2044494b0b164bd0c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095472, "uuid": "3b719131-9a17-4ac4-9c0e-836994d837f1", "comment": "Malware payload", "value": "3a32b8baffe0bb82b58da3146a732f9a2c9e4bbd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095472, "uuid": "4f644c8d-dccd-4a55-9575-5cc76b519ab2", "comment": "Malware payload", "value": "f8b00623a154a42d1ac971a39ae93ef8d1034e756077551b103d5bfd760cca45ef02783462929f48ef1de271576e15b0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095472, "uuid": "34b3deba-8a5e-4041-b54e-117a37b8b2b0", "value": "T19AB4CF983D53C552F1C406F43CAE97E1D122AE325E03C693ABA75A5D2C7BC73486AD32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095472, "uuid": "a52349c4-ccdf-4121-abc2-4de849deac71", "value": "babdaf880192de0bbb5e210bc32b9f7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095472, "uuid": "e2dfd747-6da1-41cb-acfb-1aceab985ca7", "value": "6144:RhHs0K7ZFNswOU9YVdVkKyt2Fdqd6+TKiWbNba30dE1zhhi8uu+sj:DGswOUFBt2Fwd6+peNbJq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696095472, "uuid": "c5c840fb-c23b-4fe8-b806-de5146bfb746", "value": 505050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696095472, "uuid": "4c1e222c-4c08-468f-9b19-53b1898d504a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095472, "uuid": "8e324821-9c49-4baf-bc24-09a8a84381a4", "value": "SecuriteInfo.com.Trojan.Siggen4.8064.9743.20565", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80aafd42-5f87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696074607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074607, "uuid": "c1bf3759-e04f-4acd-bf1e-abaa4efbc861", "comment": "Malware payload (Mirai)", "value": "8f6f3849507e36dd8222db26b84d96a0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074607, "uuid": "1fcda10c-2630-4392-9eda-0dbb5283d1a3", "comment": "Malware payload (Mirai)", "value": "6ec73ee10c633c6f3b176cece86fce9339ad086acec8401d551248323102a10e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074607, "uuid": "99f9c6a7-bcb9-4cd6-b705-51e93c8f0b9c", "comment": "Malware payload (Mirai)", "value": "ae73775eff4359a5f3d8a2b8f311721693a86459", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074607, "uuid": "83795ad5-f7c2-48fd-8d3b-30806706fc7d", "comment": "Malware payload (Mirai)", "value": "5bb1f1d817e459f0766da5276a2b8c1db855eb24b233f5cd476498f8df6eb93f2fe0a2b79a04e993a44ff11da139426c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074607, "uuid": "065164e3-3b15-4803-aad3-75773ac9f868", "value": "T1C7E2D06D996A3CDAEBBC0E3E12A90369F941A7E471440FCD87004C516A79887BD9D0BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074607, "uuid": "487328ff-d89f-42e0-a5f5-d4df1a7dc501", "value": "768:hn6LvbGHL4abY5t8ngv9a/chcPfB1VSWMl:hn6LvbAjbY38nO0kiPdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696074607, "uuid": "0b8af2e8-60f0-4acf-8c46-79f2b2189949", "value": 31364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696074607, "uuid": "2d56a5c0-8f41-425a-a203-592f843d4b71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074607, "uuid": "021e0d43-3398-47cd-9a15-fbd501cd1e61", "value": "devx.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336d4a7e-5f35-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696039259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696039259, "uuid": "941553bb-3d14-4562-93e5-c892ae8d1112", "comment": "Malware payload (Amadey)", "value": "73dcfc5b28078a400242be8bf257b2cb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696039259, "uuid": "73c53c25-2d41-41b4-902f-fc1427c7ec3a", "comment": "Malware payload (Amadey)", "value": "6f56e3bcd8c203b399ee233155308de42b08add7fcd62a1e1bb78bcf1258a2bb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696039259, "uuid": "92e6bd70-3e45-4846-9531-6badee88a48b", "comment": "Malware payload (Amadey)", "value": "09e00b9c120e4e0b5bf412e1b93a4275a2e1a9a9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696039259, "uuid": "a31c7f96-b764-4469-b763-7d2879fca2d0", "comment": "Malware payload (Amadey)", "value": "32122f5b6ea56e1baa533286e075a4427d2299e06f28dd405a61bb5711092879e647d6afc4917dbb5c019fc17e8c2d70", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696039259, "uuid": "930ea156-2600-4ceb-a096-b067ff6fed04", "value": "T1CE2408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696039259, "uuid": "ddcbb23a-b38e-4fe9-a0e5-7c77b78dcd4e", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696039259, "uuid": "9ccfd1c3-4a94-4329-b5b7-6501515eb444", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696039259, "uuid": "00a9e467-636b-4c4f-ba9d-d841aa12fe65", "value": 224262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696039259, "uuid": "01c29781-efbb-40db-b7e3-88f8729df10e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696039259, "uuid": "cce48754-f091-404c-a557-789501de6d9d", "value": "73dcfc5b28078a400242be8bf257b2cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd94980-5f9d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696083995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696083995, "uuid": "ea0a2206-5f5a-4805-bca3-7af72b14274d", "comment": "Malware payload (Amadey)", "value": "072c80437d6882314c6fa9922487e022", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696083995, "uuid": "da221b61-e4a1-4673-af03-40aa7b9da6d8", "comment": "Malware payload (Amadey)", "value": "70e27190f42b3b53bf126d5676eeb66fdf5fa4400a21e9c77843a00860586ac4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696083995, "uuid": "1d357642-8aa7-40db-a92d-055278bb1660", "comment": "Malware payload (Amadey)", "value": "a93ae0f13058562565352bd7ae69c83de47a2fa7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696083995, "uuid": "7645422c-9195-4f09-a551-994797d216e7", "comment": "Malware payload (Amadey)", "value": "e967de27cbd6658fb2a2bcecec2c2a3f5c99cd651328a9308b0aec010b0b27c71a8a188e19592461a9d336e10a89d16f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696083995, "uuid": "58a36652-9c71-4f6b-914d-76a329bcf238", "value": "T12F2408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696083995, "uuid": "a0b46938-ccd9-46f6-a7b6-28ce5241d77e", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696083995, "uuid": "ebbd9c0b-bc59-49b7-b4d9-35e8d418538c", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696083995, "uuid": "9ef3d7bc-1973-433c-aa8d-1d91a3bbbf07", "value": 224327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696083995, "uuid": "ef416538-a494-4a3a-bf81-48ee2810d1b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696083995, "uuid": "a9fa6b01-1747-4976-9abb-050a97fe63c2", "value": "072c80437d6882314c6fa9922487e022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689c2c7a-5fb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696092176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092176, "uuid": "a1eef4dd-5b49-456a-abc5-4f820b1365c0", "comment": "Malware payload (Mirai)", "value": "398d4d16ff51d39ab3ea5559f2ea8ace", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092176, "uuid": "39b57933-1dac-4581-8d42-7ef2b72ac68b", "comment": "Malware payload (Mirai)", "value": "71009a7b32e4d0232ebdbec0f2bfa80ce7651bf5e4e311850d46d467b49e67ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092176, "uuid": "5d635e2f-7659-42c5-9e21-49baf915729c", "comment": "Malware payload (Mirai)", "value": "de6d43a44b975c1afa443d70d1b50be1c4a243b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092176, "uuid": "2ab9a848-22e5-47f6-a43f-e8fbe54ebb91", "comment": "Malware payload (Mirai)", "value": "0862a6c60f82dbf7fbe47605807f27fe70ce7f0cbf2188f59e7cd925b4153434ea0cac5a6339c39c02c1ad7acbac4731", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092176, "uuid": "812a3600-2a43-485c-8338-4ccc8b367961", "value": "T116E34C86FA408A03C5C61B76FAAF524A33229B55E3DB73068D185FF43F87A5D4E13606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092176, "uuid": "e7bf5f25-7dbf-4d65-8cfc-dddcc17bb986", "value": "3072:Pib6EdR0WkESrJYqNo56juvMuK/U6YQXiaXWZ2M/9c/r:WnRpkESxhuvMuK//YTaX9M/9c/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696092176, "uuid": "2f277811-13e6-449c-8d51-e2c03e38f8b9", "value": 144087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696092176, "uuid": "06e9b071-d217-487c-93f8-18851c957528", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092176, "uuid": "8c08f120-ac21-4379-bc9c-bb722cc0ab6f", "value": "398d4d16ff51d39ab3ea5559f2ea8ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b300aef4-5fa5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696087577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087577, "uuid": "e40c2935-c1e1-4406-8b45-a09db34bce5a", "comment": "Malware payload (IRATA)", "value": "42cf2514518a7f13ff28010b1d62a68e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087577, "uuid": "41133c68-4d71-43d0-b88e-2a6a9bf37180", "comment": "Malware payload (IRATA)", "value": "71302109254d58aea58f417206361188ba5f7754e17821de23aeab4ce137125d", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087577, "uuid": "9947f0be-f2fb-4ff2-99a6-15f656f6accd", "comment": "Malware payload (IRATA)", "value": "db9c884368f5acbd47413dd67736c971448290fd", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087577, "uuid": "e630a725-2c57-41e6-ba79-272a3b33199c", "comment": "Malware payload (IRATA)", "value": "0544590783d9135449225175b443380b09a0dc42b194458bcd70a22ca9aea3471ae0761c2359be9e3c71ea87a3151644", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087577, "uuid": "ae252893-874b-49f3-a39e-97622e861841", "value": "T13BE5BED7F7E8592FC87750B2886E52B162574D028E879F876D083B1C287B6D81F49BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087577, "uuid": "c4c4000f-f194-4099-a7c1-c4041e45c0ad", "value": "98304:BtPpx+Q2hNAnE/6mj8rNU9fOr7gLCrgnwd8:BgHAnEbjFa+a8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696087577, "uuid": "00bff5ba-e80b-454c-a537-61c8cdbdd612", "value": 3274856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696087577, "uuid": "a4235066-51c4-41c3-9eff-808afe6fea74", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087577, "uuid": "e2a3356e-2256-47ab-89f2-7bbe62b0c1b5", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278ceb52-5f7c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696069733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696069733, "uuid": "b58e1b5b-7a18-46ac-b95c-0e0ccdbad1f3", "comment": "Malware payload", "value": "5fce2088e406f322b36166486d4bae1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696069733, "uuid": "b3d85579-f89a-4299-a121-7f101894897a", "comment": "Malware payload", "value": "71ba25a8276d119cdf3249f4f5427a2b2b07ba291434ede3d0d84bed4143cc63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696069733, "uuid": "aea5be67-f4ba-4c83-9299-7441c20df94c", "comment": "Malware payload", "value": "cafffc5ef83243bbdac343cb8615bae8e1216257", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696069733, "uuid": "4cfc1ee5-642e-4614-9387-46889bc54689", "comment": "Malware payload", "value": "7786cedc81c30102626c6de66ce2ca27faef3126e803eb01ed1c4273b8b323b90b5d6d82be88c693508ef70a1aeb6f22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696069733, "uuid": "f0329606-2fa0-4850-9c34-504f5df5ce18", "value": "T181B53331BBF7C4FAE901183A9E79B7B726F5D14A0E484E9773049B4E28755DBE324180", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696069733, "uuid": "2ae1e3e3-a7eb-4ef8-b715-e07f924ad6b4", "value": "4ba3ea0d6362a841ec66a1fc0a1b874f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696069733, "uuid": "868de23a-6e72-4cc1-8cbd-1570d57258ef", "value": "49152:ufgPwPWkAjZNRAvJPrMBJ3VgAvj10E/jyru9LZ:ePFKYIReAJ0E/eMLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696069733, "uuid": "a9037e5b-4d59-4896-9da6-dedb9e99617c", "value": 2297063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696069733, "uuid": "2a625d93-d0cc-4236-b43b-299404367b80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696069733, "uuid": "0dfc455a-c02c-4aa2-b577-1146e0d64c2c", "value": "SecuriteInfo.com.Win32.Evo-gen.28151.16919", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4700899-5f73-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696066158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066158, "uuid": "04bf58e3-c28c-409b-a79d-699ba98c0bb9", "comment": "Malware payload", "value": "fc76925967a29aaf080d93b11902fddc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066158, "uuid": "46024e9e-37cb-4269-ace6-4088875dca1c", "comment": "Malware payload", "value": "71cee2ccfe6e1198949c920b69503a096154b67c04569669f4597837d3ef1e69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066158, "uuid": "f58cbf01-da75-4650-90d7-f2718b3cea85", "comment": "Malware payload", "value": "926cadbed7914d18002f9d95dc12298931c107ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066158, "uuid": "e6ab3170-50ed-42e4-b3d7-17d70f84ea97", "comment": "Malware payload", "value": "bfe64a90e2e110883c55c0c196d4f571b022796c9a60f52b1066245e936a1799ea64662bc04193f4b203e9a820a91f70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066158, "uuid": "4a52d676-390b-4a9a-abfa-1d739e840701", "value": "T188B5331134E7D0B8E1501135AD052FF293E4F3678F08DCE76B2CCEAD1AA4DD695392AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066158, "uuid": "d97d490d-7572-4cfb-b34e-1dc01114201b", "value": "1d0e3506c01cb61e9312cbea4911e92e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066158, "uuid": "be016901-da17-433a-881c-760b3189b2e5", "value": "49152:WfnQi26jv7gPlYSK0rnp+/dUUD11KSPN/pBEKs9V6Laq29c:WvQ9PlYrYDUxs2/0LC29c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696066158, "uuid": "964be729-ba6e-462f-8196-d07915176ffe", "value": 2297426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696066158, "uuid": "77cdd424-0b42-483a-9c93-73137dcb8dd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066158, "uuid": "41b930ad-4c78-49f7-b5f1-a0acd110e55b", "value": "SecuriteInfo.com.Win32.TrojanX-gen.25130.19169", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa3150b-5fb6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696094899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696094899, "uuid": "ba958556-d7a5-4335-9896-12b41c5a7175", "comment": "Malware payload (RedLineStealer)", "value": "b0d33d51950d93bd885b5eef414c71df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696094899, "uuid": "d43e1eed-04c5-4b6b-bb1f-1a3e52000191", "comment": "Malware payload (RedLineStealer)", "value": "764c3bec68a2dc02c167b1bb133076053af7ba1123be89fc4c2a48dd3b15d479", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696094899, "uuid": "c334069a-e733-4f02-a0cd-7880b11d4df5", "comment": "Malware payload (RedLineStealer)", "value": "ab8f3632abb72ae7b146b0b1f3dee7b10a75032a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696094899, "uuid": "51aaa88c-8d67-46a5-b60e-a7ac25d11074", "comment": "Malware payload (RedLineStealer)", "value": "cbbdbcaddd50225a094e0f8b6d2e2b2f406666e162a00f0b4de5a99b5dec59a6c9a68f9854d501764bc2efd9ab783da6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696094899, "uuid": "6d47cf93-0b78-4194-b6b9-25c9a8f2d047", "value": "T18984E12362E07C51E566A772CE2EC6E87B2EF151DF39675A33148A8F18701F2D663312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696094899, "uuid": "82397041-e83b-4e83-b813-0b9eefa4344d", "value": "d323d1063364fcdde3ec2d7fc616011e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696094899, "uuid": "bbe859f0-fcbb-47f1-bd9e-b1c9145119b5", "value": "6144:xMQBljiQM99i+CVLEeOyZnN1KD2vXiKNh:xMmMmLYdDaXi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696094899, "uuid": "e13efa30-6f22-4af4-9429-dd74c9b31052", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696094899, "uuid": "78e6786a-4466-47a8-b55b-a29866b4e675", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696094899, "uuid": "44e50b8a-d585-45e8-aaac-b2378da5e1a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a0af0e-5fb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696095549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095549, "uuid": "444254cc-f88d-4b90-8ad2-fa33569150ba", "comment": "Malware payload", "value": "b188fc56a024df446a1184f9d7d772cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095549, "uuid": "613404b9-859c-4185-8c16-b5d4f6c88015", "comment": "Malware payload", "value": "7651cf93cfe0a017596b25c56cd8f61148f69268824fe9fc38152f2521490073", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095549, "uuid": "71414f1d-2316-430d-bcc3-c0f52d2840c1", "comment": "Malware payload", "value": "b741602a4d8c1381892c50efb0625ced77cd4901", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095549, "uuid": "fcfdf95e-9dc4-4f2b-9052-2292c6a11ec7", "comment": "Malware payload", "value": "29e1bf9b42789889ba932bac5f04917d54f58679fcc2a5151c244af71be8340408a622aba8af760063e615713a40b952", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095549, "uuid": "8cd07a5e-f690-4e7f-82b0-72216cf4de69", "value": "T18C249E6361F07C51E5E76B324E2EC6E87A2FB451DF54A75A32180A1F29702F2D26B313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095549, "uuid": "480630df-e151-40b4-a94a-75cfcccbaa9a", "value": "d323d1063364fcdde3ec2d7fc616011e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095549, "uuid": "f29d029f-c1fe-4083-b808-d60fb5879a3e", "value": "3072:+WuR1NKsspHrrOfP7Y0pg72hZMbDO8ENwFht55/hKnYJ:6K73eP0Ag7s6u8ENwNC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696095549, "uuid": "ba07b703-245e-4e63-ab8b-7fcce6034d86", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696095549, "uuid": "7dc1d81f-c88c-4fde-8885-eb32f7b082e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095549, "uuid": "5acf2228-16a4-4d60-aa71-2341007e81fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a7a94b-5f27-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696033330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033330, "uuid": "191eb140-bc2e-4252-992b-0cf320265485", "comment": "Malware payload", "value": "de2456b94b4d4019ad591379205ebd6e", "object_relation": "md5", "Tag": [ { "name": "BinanceSmartChain", "colour": "#A43486", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033330, "uuid": "7efcbdcf-273c-4962-baa9-b74a20685fef", "comment": "Malware payload", "value": "788567d3cc693dd5d0dada9f4e1421755c1d74257544ba12b502f085a620585e", "object_relation": "sha256", "Tag": [ { "name": "BinanceSmartChain", "colour": "#A43486", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033330, "uuid": "0cc22c71-ddb5-4af2-ae1f-4a4ac3ba9054", "comment": "Malware payload", "value": "7f98a888fb52ed5627d7b374439ca14616f68d33", "object_relation": "sha1", "Tag": [ { "name": "BinanceSmartChain", "colour": "#A43486", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033330, "uuid": "f2812d79-333c-4a12-a563-3c4ce7ab9626", "comment": "Malware payload", "value": "0efe7941ca07367d1eb9f2b767bceb199b2f718de1506afaa022f926ef578e1094b341a8f306aae0ad90e7f567789659", "object_relation": "sha3-384", "Tag": [ { "name": "BinanceSmartChain", "colour": "#A43486", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696033330, "uuid": "adbd9c66-83ff-49e0-bf8d-2c4dc8977903", "value": "T1BC0633C038C29819C6CDBD7451368B893A3D4196A9F07B5AC64BC839B9B3497CFCD762", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696033330, "uuid": "9ced5799-f25b-4347-a16b-05e345e27089", "value": "98304:dfic5es3aimY7NhbJpcdYyeuASKnRcfw9X:dKc5emmYvdM5euASKnRcfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696033330, "uuid": "de6b5b17-b478-43c9-9914-99b24d4e712c", "value": 3765178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696033330, "uuid": "85a7d067-e4af-4e61-9bd8-a8e97188e60a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696033330, "uuid": "7f9a51e1-261b-4547-8057-a89134e89d45", "value": "Ml\u0441r\u043es\u043eft\u0415dg\u0435S\u0435tup.appx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea8caff-5fd1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1696106253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696106253, "uuid": "b7ef5168-436c-41f5-8c59-88ec2e4b2c8f", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "333e96b6624631248c7d874b3b19560c", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696106253, "uuid": "bafc335e-b95b-43f8-9915-e008170ad814", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "7944f0abb4c869b6d23312ac230d900720e5fc2461b3dfe0c18f7d5905b09d7f", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696106253, "uuid": "07077266-df37-4818-98fa-ae6854b4822e", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "d3b99af5b821b63338fdeb1d8680310d6d2c5711", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696106253, "uuid": "9094d632-6c35-4ceb-ad51-d76ea44e155c", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "06fa7218cf7fb22d9eb7eefbe2b6b09c5b8d484528cbad37df502181d8a493db05e6dbfcb84f1f8d5ec971f797aa91d6", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696106253, "uuid": "d2c58e99-f17f-4d69-b451-0e6fb1b76b0d", "value": "T131F3BE16B5C0C072FD76D93509B0EBA3997EFC340F909E8F67880B796EA02D08635967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696106253, "uuid": "7cca88ab-c5ed-413e-aae7-f273b1dbd638", "value": "5b961e24b82512d2a00ac6c970dad1c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696106253, "uuid": "c8c0c27e-7153-4969-9fc3-cc87a86af108", "value": "3072:WhuUoRum3n7A5BEAyquQ1BGw+8IPMoCGGk46Zn2SdAzj:WhZL0+BENqZBG7z2AKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696106253, "uuid": "9c6bdeaa-5eaa-459e-8da0-b71f9e98be25", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696106253, "uuid": "c2c169a8-ab43-49a4-8cf6-c8216a84ad96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696106253, "uuid": "354d70d9-3cc2-4d29-9fb6-d01aa9c0ab1b", "value": "SecuriteInfo.com.Win32.PWSX-gen.24632.28701", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f9454e0-5f48-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696047359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696047359, "uuid": "30c0f8c4-fc00-4bf1-9006-d0d405b0696b", "comment": "Malware payload (Amadey)", "value": "828182fb162d7fa8f888fc95dd72d685", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696047359, "uuid": "4d4e4e16-80db-41eb-9034-1d69b9650193", "comment": "Malware payload (Amadey)", "value": "79509c10f12ac3c43568a72e2729aaad4e34494c89ffff498c2f510196c7001f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696047359, "uuid": "8b46f1e1-fb7f-4d53-b78f-97b22cf8047e", "comment": "Malware payload (Amadey)", "value": "13e0f29931f9bcf0d26d8d8c99b6a1c26941bf39", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696047359, "uuid": "e8188403-795e-45ff-a003-779223056fdf", "comment": "Malware payload (Amadey)", "value": "b62d257019544b98883b8fb55a3a753354516a5d70757e39bb97f733a0986f8301c28ce6814136259edcdec8d42b8820", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696047359, "uuid": "18cf27d7-0770-4c85-b578-ccb874f6c5c9", "value": "T11D34AF1174D2C472DC7225360AE4FBB95A3DB93009915EAF6FE40F7E4F30281D662A6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696047359, "uuid": "00cc3599-7d5b-4af4-b2e8-774cf9722a3e", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696047359, "uuid": "6a6a926b-7000-4c7d-b75b-1f22b451a899", "value": "6144:H5z4SHy5uoBMFGV5PEkIXEHvZAOl3Crzf9Vs0BC+:uCmuoBMUOMxjCfs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696047359, "uuid": "52977aaa-d1e7-48ef-9a42-0528133678ca", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696047359, "uuid": "95ee409f-7109-41ca-bd8b-4832fb544254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696047359, "uuid": "8e4c16b7-a157-4926-8089-7e242da27fcb", "value": "828182fb162d7fa8f888fc95dd72d685.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e99bbf-5f92-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696079493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696079493, "uuid": "af5554fe-e4a0-4de0-a049-b5e96e05dff2", "comment": "Malware payload (Amadey)", "value": "5a8443c3ab73551173039212bbffb5c4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696079493, "uuid": "9b396ac9-e235-43ff-8686-e8d41ef7d7bd", "comment": "Malware payload (Amadey)", "value": "79561cbf51e95506570ae9ca905cbaf9ed78d80c0394dab064efd8e713509af1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696079493, "uuid": "b56221f0-df4e-4f48-8d10-6eeefe6ce6ae", "comment": "Malware payload (Amadey)", "value": "bfc34af3f9aeabc34a3f9588a17f3c876b015d2e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696079493, "uuid": "c7db071a-1833-464b-a066-07219f32c1f2", "comment": "Malware payload (Amadey)", "value": "d98a7dddbc6d8470ba328468e32307ac897ca3f72b017e6371806f8e3ba68990c0096b919e1c06fc8e699c4dd0ded083", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696079493, "uuid": "007f6421-5538-4b69-a797-9d33b56380c3", "value": "T123252313F6D84837E8F027B068F309970B743DD6687887976792E45A0C72684B476BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696079493, "uuid": "f8ed4953-3234-4fbf-8709-6093cd1d4cec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696079493, "uuid": "5fac5b6b-18cc-49f3-9fed-7cea53d9ccd8", "value": "24576:vyuWNvzSQnMJCToFEQ1ojLkfWNrPO4Br:61dsREMqLkfCO4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696079493, "uuid": "42c4fa7e-cbee-482d-9c47-27b19183b6e2", "value": 1010176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696079493, "uuid": "47858ff5-5187-4590-8af6-ff1935a796cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696079493, "uuid": "88b35e34-879f-4370-8f44-1d6b77007746", "value": "5a8443c3ab73551173039212bbffb5c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe9eb7f-5f66-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696060272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060272, "uuid": "2fe634f4-25d2-4b7b-9fd1-8d26c1771383", "comment": "Malware payload (Amadey)", "value": "e8cea45dae182c583d6a8ea95e1172a2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060272, "uuid": "3ba2b332-78e1-4197-a8e2-da549fa94577", "comment": "Malware payload (Amadey)", "value": "79ea5f31d0e603751d398b4a2cc57bf07b6439ced0f35e91b5a5ffc7ab8e62c2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060272, "uuid": "2faecc93-2147-4211-b872-4b1e86a41c9d", "comment": "Malware payload (Amadey)", "value": "35aeff1d5e62decdbadeedffca6b8093ca7a4190", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060272, "uuid": "bb680eca-d6cc-46f6-ac13-5723b565a1c3", "comment": "Malware payload (Amadey)", "value": "18b3cd4d09216a4f4cfd223facdcdd2bcc28b7f1365442f06da3dacd8c52247f07901decc1a4e4de84485b4d8cc3561d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696060272, "uuid": "12ef29f1-eb61-48c3-b381-52ebd8cf9692", "value": "T1C334BF11B5F1C072DC7215360AE4DBB95A3EB93029A15EAF63E40F7E4F34E80D621A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696060272, "uuid": "a56ddbeb-5161-4f53-a23f-45134fe9313f", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696060272, "uuid": "bacc3066-5edb-4981-9598-f6c92573cd48", "value": "6144:t9z4SHy5uoBMFGV5PEkIXEHvZAOBhoZVs0BC+:cCmuoBMUOMx1as0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696060272, "uuid": "4177241e-fa79-478b-b64a-ae6aa81cbdc4", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696060272, "uuid": "6afe81bc-9f50-4aff-8e86-03d9d127bb38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696060272, "uuid": "72134d47-7344-4fd6-93ae-05df4c559bd4", "value": "e8cea45dae182c583d6a8ea95e1172a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee981a7-5fad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696091113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091113, "uuid": "44386c1a-34da-4704-bc2b-114b930be661", "comment": "Malware payload (RedLineStealer)", "value": "a83452e88046600b86455b016869744b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091113, "uuid": "c5b38d85-dbad-46df-987f-879c07637632", "comment": "Malware payload (RedLineStealer)", "value": "7a79cf6ab813112071252ed1e256467023499c58f501a6404d7fd7e3ddd3bc22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091113, "uuid": "8ff8bb82-d0bb-4379-b4f8-7f75c38e51d8", "comment": "Malware payload (RedLineStealer)", "value": "ad5c7883b1f45938a65ef7a437c1207dba6685ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091113, "uuid": "8724df17-1574-4f0d-8f23-8787a005e101", "comment": "Malware payload (RedLineStealer)", "value": "b7e53e754f22435ccaf41a5507560d5cee4d323fcd552e27e403fbfcb183b674975e6866ecedc97c28327fab842cb1c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091113, "uuid": "476fdd7b-8219-470d-b8b3-9a70c73ce3f7", "value": "T15215F14823E9EB01D17E13799438925023F5FD5B9A12E7591CC5B2FA3F32F504A8AB27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091113, "uuid": "ceaf20ec-d05b-4996-8ee8-bcf4dbdffc18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091113, "uuid": "a1dfc5a7-e52f-4901-af07-1cb53ae4b65e", "value": "12288:6nnIDGW3i1vQeuhPnkrhunYUoHi/cr3yyz0qontjBj3Xe8RPpL:6nS/yVCPnC8/oHim3yyoqonxJXnRPpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696091113, "uuid": "851182ef-558a-48c5-a62f-17e335e7f621", "value": 894288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696091113, "uuid": "fec52c8b-38a8-44ab-87fb-896b0655f34c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091113, "uuid": "bb7f0dc0-528d-4380-8491-330ed03ff287", "value": "a83452e88046600b86455b016869744b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642cdd0c-5f39-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696041059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041059, "uuid": "931e1631-d827-4fad-bd51-9ebfaf4382c6", "comment": "Malware payload (RedLineStealer)", "value": "81a1bbbe2df86eeef3acd1eea65e4231", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041059, "uuid": "371561d8-2e54-4ad7-ab08-cca8f5a94eeb", "comment": "Malware payload (RedLineStealer)", "value": "7abae3bb6c6e0c3d7c3c50bffc8c4245b342d1b35e42760349ef1a3e438d87a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041059, "uuid": "4abf429c-5487-4c91-a583-cfdf7282f596", "comment": "Malware payload (RedLineStealer)", "value": "32fc2932e156d6ddca6d6dd9754ddd054742c7fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041059, "uuid": "a6f9f916-41c4-44b0-ad63-64135eab0cb2", "comment": "Malware payload (RedLineStealer)", "value": "b895aceba4322b792f811c4de09abf1bd0dff4cd388c1863432e0377193c9dd8176e0fa6f986c90de2783eb7e2fbc173", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041059, "uuid": "561cb226-8e1e-405c-94bd-920f18418172", "value": "T12F84E00A62F2EC60D5664A318D2DDBE07B3FB4629D756F6B33161F6F18302A2D653702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041059, "uuid": "49ebb0a5-8681-4472-bc39-b96a4dc77121", "value": "a59b93a815ea9713a41e16c8d0248e4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041059, "uuid": "be0a7d3d-1e30-4356-954a-8f38dd96eba1", "value": "6144:Kin/NXp/npRt+B3YSmW/Rx2HiMw3wv0J5/mr5iXpMg0Tw6YTp:Ki1Xp/nF2hRxgrw3wv0JhOaMW6Ip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696041059, "uuid": "a3819f2e-e6ec-406a-99be-b0fc09eff9bc", "value": 406528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696041059, "uuid": "c0e1d741-fa03-41b9-a8c2-5f52bfc375b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041059, "uuid": "29c2704e-4364-4a45-8f45-8141358fae5b", "value": "81a1bbbe2df86eeef3acd1eea65e4231", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb98287a-5f8d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696077391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696077391, "uuid": "305cccba-e996-4d00-8bb9-38fb1ed9e0dc", "comment": "Malware payload (Amadey)", "value": "e0826d1a39cb4f47ed518014dc698b69", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696077391, "uuid": "e8189656-3ce1-4c6c-aa38-4646d91ecfe6", "comment": "Malware payload (Amadey)", "value": "7cb01016999849441abca4e084af74755a5fae1bbbfdaf8bcb9203917b777a72", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696077391, "uuid": "ebecfcc4-4f2c-4420-9e99-41f97498bacb", "comment": "Malware payload (Amadey)", "value": "b80dd56eedb92a037c70fb14a88d69a26ab849e5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696077391, "uuid": "5c10833b-0164-4c86-9067-9569e03047a8", "comment": "Malware payload (Amadey)", "value": "ee7511b96f985042f9285ab61f6d1552b54ee6e8570461929a950a113d52b4f00b5165ac423eeb6e836834307074a940", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696077391, "uuid": "bd1075df-b3dd-4fd3-92df-67c1057f66e5", "value": "T11B2523A396E58422E1B9037064F306C31F73FDA5AD71977A23816D5E8D722C0A2B2777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696077391, "uuid": "7934f670-191a-4f14-9c3f-ab68a0fc0206", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696077391, "uuid": "cae6eb34-a041-4e54-8bde-2def6ec0c79a", "value": "24576:oBy8vVs/xaT2BN9a5ZkzmQOWsLVGz9ofCFcff:t8Vs/IT2BN895Gz9yMcf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696077391, "uuid": "f4993297-fcfc-49d9-9e18-f59851e6476a", "value": 1017856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696077391, "uuid": "9565be94-d0ab-4beb-99e1-3b2e04ae1483", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696077391, "uuid": "7645fbe1-9e87-4f9e-9746-8a662d7ed08e", "value": "e0826d1a39cb4f47ed518014dc698b69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7980d6b3-5f98-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696081897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696081897, "uuid": "c6fe2aef-61d2-4d00-b4c3-97d85a451abc", "comment": "Malware payload (Amadey)", "value": "b3936fc5367347624b44c3ec99adfa22", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696081897, "uuid": "68a40d15-9366-4723-9df2-fe3d8f4e90f5", "comment": "Malware payload (Amadey)", "value": "7d63ed6bad0f5e177ddd42ba995fce6c598abfaf3595cc89e948e3a7ec9c9d8f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696081897, "uuid": "948be3ce-efb7-49c9-a819-858ac41be2f7", "comment": "Malware payload (Amadey)", "value": "a6b6b4d2205104753067b1186a0ad6b31728fdde", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696081897, "uuid": "ceb634aa-ee0e-4493-af0c-a14273cf1262", "comment": "Malware payload (Amadey)", "value": "ec342f466ba6ca7a8497c67f1bd4e0775b1689757da7a168811b782863ce8329dec5407043c1037acaee6d581fc12ec5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696081897, "uuid": "a8569aae-1593-4ce8-89ac-b1fa0d9d4f37", "value": "T1AA2408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696081897, "uuid": "f8c46959-578d-4959-ad76-b82f192b7239", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696081897, "uuid": "2b9f2c1f-0436-4cb6-a74a-d022951c97eb", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696081897, "uuid": "0cd67e7c-e13f-42c2-be25-e72f31912ec9", "value": 224296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696081897, "uuid": "8b54bf41-d824-40a4-b563-dacd18ee52fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696081897, "uuid": "782af149-1be0-41f5-bb85-3d4a80e4a8a0", "value": "b3936fc5367347624b44c3ec99adfa22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87aa8f73-5fdf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696112415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696112415, "uuid": "5efff3be-eee3-479a-984f-ccb3776d7db2", "comment": "Malware payload (Smoke Loader)", "value": "45a93cabd25ee2ea6988dc0b88dbbb62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696112415, "uuid": "446c5d25-4239-4d53-b7a1-184d4534fa67", "comment": "Malware payload (Smoke Loader)", "value": "7d9d7c212fd9abba35e546d74732283a3bab58f1d2c93d55bd496b1970e307b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696112415, "uuid": "2f5e66c8-3db5-49d7-b052-01be0a270590", "comment": "Malware payload (Smoke Loader)", "value": "c45594efb4e98f9ea44d9a8f6e935cd4f172c09c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696112415, "uuid": "27373ba0-eaa6-41bf-9815-d6c2c1b4e44f", "comment": "Malware payload (Smoke Loader)", "value": "2e6bb1b97b2224cc8aa8b373e6e9cb5330886f0e94ead2e0793ac64ef9b48e49de99d765a6f93d79d3cde9093e94514a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696112415, "uuid": "901c1e6d-6345-4d4f-bb27-5b941927c5a8", "value": "T182248D23A6E17C50E5676F728E2EC6E87A2FB451DF596B5A3234C62F04711E2C273312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696112415, "uuid": "fa538f50-b3b0-4ec9-8a12-a34b14165320", "value": "eb89aa3fcf43b156dad667e281a2675a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696112415, "uuid": "5c163ac4-475e-4230-8c18-bce5f4a7a96a", "value": "3072:eWlRAOejz27qJak26wpp7FG/UwKBwWd2O0kVACS5/x6BZg3:tu7Jak26jIBwVO0kihw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696112415, "uuid": "89684379-7b68-4473-86de-0b840446dd9d", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696112415, "uuid": "9fc9fd92-8271-416c-8ffd-b1eb07cfa481", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696112415, "uuid": "8fa5f62e-6b96-4c49-99b7-32ed0de7c066", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5088759c-5f3a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696041455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041455, "uuid": "3475d9b9-5e20-4f21-963d-5f52c60c7785", "comment": "Malware payload (Tofsee)", "value": "f023769573e084a1a0aa48dab8693129", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041455, "uuid": "f8bf7663-c076-43bc-b3cf-cf5ed8fddc5c", "comment": "Malware payload (Tofsee)", "value": "7db866599ec9d72e0c32c99a97e14f7780e17b85cdc51780b97d435a87b1940e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041455, "uuid": "c157267c-a09e-4afb-8bd9-769433721a4f", "comment": "Malware payload (Tofsee)", "value": "3bd541268680ea336e5cb5a7b27c66486783eaaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041455, "uuid": "fcda04a1-403c-41cc-bbf9-cc3a36c8978d", "comment": "Malware payload (Tofsee)", "value": "fac8744dfc397d05bf8cdf325a1c73183c776b04c3559b91dd5bbd2d63b9f697a3b5a13f48ca8aceaca6671c4ef8fe78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041455, "uuid": "ee7594ba-1059-4e45-8ec7-c0e1997b5eba", "value": "T1B7349F0A66E1ACA0D9A789324D2ED7E47B3FB4628F792F5B33146F5F18701A2D163701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041455, "uuid": "bd9f8f41-f4b8-4874-be75-f9b1bed7b4f0", "value": "a59b93a815ea9713a41e16c8d0248e4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041455, "uuid": "5472333f-2333-4a4c-ad52-da47cd1e07b7", "value": "3072:6Xr0Y35f0Mj9P6JB6YmbmW2MH/rzJHyg1bX/kJ6528CxbYT8p:a4Mf99P6JBTyhfrsg1uHbYT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696041455, "uuid": "3821a453-9573-4d97-8259-07544b2ce3f2", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696041455, "uuid": "c985b330-cd0e-448e-a071-6b4872b308c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041455, "uuid": "3a12fdc1-10ba-4496-939f-bd77aeaa0b6a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6388a23d-5fb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696092168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092168, "uuid": "ebcc9135-76de-4b10-bbdd-e96a425bb280", "comment": "Malware payload (Mirai)", "value": "09c070f2a7ae37ebbea47704c32aecb9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092168, "uuid": "9dfc4d9e-9ef3-40ac-a31a-21c33221ab02", "comment": "Malware payload (Mirai)", "value": "7dd7c5bf15681a10a7c42b03e541dc48b42336d37ee022ac21aeace160778471", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092168, "uuid": "ffb31399-fd1f-49f4-a815-ce5d0389b320", "comment": "Malware payload (Mirai)", "value": "6d32bfb5b0d82289b757ad68c2d55f72edcf6cf0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092168, "uuid": "d3653300-aa5e-4fbe-9bf4-082f35cfcb2a", "comment": "Malware payload (Mirai)", "value": "f346d76cc7884b220e603d058de9779d86e0d12a30a8da9aaa945b77854d46caccba7bc9e7144b75f619571ffc0f906e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092168, "uuid": "cadf372e-7f9f-450f-9cc5-bf1b3494302f", "value": "T130537C66D0B85DA4D49849B07618CDF89747A404AAD37FF1C683CF694807AECF109BFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092168, "uuid": "3c93fd8c-577e-4752-a1a5-4742abc10408", "value": "768:q/BAQypMgaePdiqOwBkRmJoHzFI/fYsDiPV44g5N2tS7uztDL5QnWv0QD6in3kxY:q/2HmgaeAW2R8fLESyD8YUMnOxsC4F1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696092168, "uuid": "3102b674-bb5c-4357-942a-b62408c31006", "value": 63848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696092168, "uuid": "d12fc566-6afb-47de-b1a7-f4dd8617a78d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092168, "uuid": "1d449c92-fae1-4c47-baa3-7167d89cc9f8", "value": "09c070f2a7ae37ebbea47704c32aecb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67d2c70-5f90-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696078590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696078590, "uuid": "596afc76-512e-46c7-ba40-765b6f5d4433", "comment": "Malware payload (RedLineStealer)", "value": "ea88c359faaa4fd8219c7bcaad838749", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696078590, "uuid": "653d7b4b-b9db-4b8d-a2d4-25aa09d826e7", "comment": "Malware payload (RedLineStealer)", "value": "7e0814e74e3bb08c84e19168154add2f70fc2bc486b337fcb2b8fd9d19105ad7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696078590, "uuid": "8106be3b-fb75-4b89-83cb-bc81234be93c", "comment": "Malware payload (RedLineStealer)", "value": "4ba3527b280719563bc7d61f49617a50d507b8f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696078590, "uuid": "eef38232-62c3-461a-b752-e1dd11677d25", "comment": "Malware payload (RedLineStealer)", "value": "af8593a6c4eb5dd160ab66b6f50b036fddad0c099a59f02269c170c40d8226374b33a33f9b248697924dc52159f6eee1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696078590, "uuid": "3ff97d38-b803-4365-bdfd-59ee5e2751d4", "value": "T1D0252322A9DC80B2D8B0A77418FB0B931A31BCA15C79A32B5706495F19B3781777277F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696078590, "uuid": "d4ce0786-062a-4676-8b5b-462afc013817", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696078590, "uuid": "b18df5dd-1b93-4de3-82e9-611de127186e", "value": "12288:vMr2y90QfLCxbfINNmuWlHih5mSLFl9GJe4ltbwSQHmiNST24zYUUz8QGkpWQVec:lyND6EQP8AimPCz8xkQke+RLtuUOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696078590, "uuid": "74f035a8-dc7d-4b0e-bb55-9c003ee53627", "value": 1016320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696078590, "uuid": "3754f005-8bdd-4942-83bc-ae832df8703b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696078590, "uuid": "33a0db61-268e-441c-9224-a7942272208c", "value": "ea88c359faaa4fd8219c7bcaad838749.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9542ae02-5fa4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696087097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087097, "uuid": "d816c621-2932-4d92-99a5-02afcc2feb59", "comment": "Malware payload (IRATA)", "value": "3d37015a7929562b54993d406e720bae", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087097, "uuid": "eca27c08-a9c2-49d5-8f7e-78fa9cbdb0ce", "comment": "Malware payload (IRATA)", "value": "7e867a85cbf47370f0130ad7f22f848fd32d398ee0966341ad7f72924d88782b", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087097, "uuid": "5b0c7a20-3068-4cfd-b2e4-2a2f08f7f0eb", "comment": "Malware payload (IRATA)", "value": "1e58a57756a51da823ee46b2dcea3060840a6b4d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087097, "uuid": "dd02ffc7-ef1c-4c3c-b5c3-940913749e1c", "comment": "Malware payload (IRATA)", "value": "e790f5e80e1ecc429c37505b88534430c38b1e797016c63a6312457cfaa26d53ddfc4f1a7c4fa61df272d0f260d4af25", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087097, "uuid": "3c4edffd-d749-47ba-b025-524b4b30fb36", "value": "T1C1E59D97F395686BC4F39372817613A5514B4C228F83EFC76D68763C28BB9C41E49AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087097, "uuid": "cdc022da-db55-4fcb-8d09-aa152afcfacf", "value": "49152:UT33kWJCTOgLCrgP+vSeXTuHOne8tf/S7h5luA2g9lKDusc:UT33k6gLCrgPiSeaHOnzoh5kA2MKysc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696087097, "uuid": "5d640b75-3294-437f-80b7-482ffe818e14", "value": 3144583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696087097, "uuid": "085724cc-6f90-44c9-9c2f-845375a34cf1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087097, "uuid": "9976fa7b-3b96-41d8-a727-9271567d7c62", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5866f7e5-5fb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696092149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092149, "uuid": "b5bf3c96-c136-4539-95fd-07a040760431", "comment": "Malware payload (Mirai)", "value": "57629af7af5c129e81eb53820308625b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092149, "uuid": "0f8481f8-216c-488c-8d09-b94b5ea727d2", "comment": "Malware payload (Mirai)", "value": "7e901f77ce613aa87fd227add544fe26105e90483805a99710bd51e88c01250f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092149, "uuid": "fa199be1-ddcd-4d77-ad72-9110902c2b78", "comment": "Malware payload (Mirai)", "value": "5ad849a5057272988e7e7e890c2a708110ceb1cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092149, "uuid": "3f600033-9e4b-4d88-808f-6f249917206e", "comment": "Malware payload (Mirai)", "value": "6e631d3ea49e09a15f46ee23f82e27de3d21921d1fd569bd66f5cafeb8065feb8c1e33a242465092c67ca4a5962e2e0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092149, "uuid": "196bcd55-a3d0-4453-a6fd-37f4817646bc", "value": "T15093741AAFA05EF7E8AFDC3346A91B4524CE5416258CBF75BD30D918F20A24F15E38B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092149, "uuid": "4109afa8-f9be-46a9-b0bd-1e89678e5092", "value": "1536:GRWuNskH9ZBLPtSfRop6/hWOqCx5E8FjBwFudSZCLHSh:iWuNskH9fPtkap6DrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696092149, "uuid": "c9dd5bf4-d0c0-4466-8028-54c2f4d19d25", "value": 92268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696092149, "uuid": "a17a04f3-674a-47fa-a1dd-fdc1750b6066", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092149, "uuid": "a7ff4ce0-bb57-47c2-891d-497379380cba", "value": "57629af7af5c129e81eb53820308625b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22f85673-5fde-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696111816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696111816, "uuid": "e725d594-af75-455f-8437-dbab96cb2d27", "comment": "Malware payload (Amadey)", "value": "6db00618f6f9d4823bbeb433ed8c2a63", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696111816, "uuid": "5e2d5c89-b86f-4a40-b4dc-6d89af8ab88f", "comment": "Malware payload (Amadey)", "value": "7eb790eac974b12e6132469ebc9c6cb67c0d5ca49d29656dabfab3898a07dd91", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696111816, "uuid": "9bc431ee-54b7-4393-b1d3-89dbba70bfe2", "comment": "Malware payload (Amadey)", "value": "8c54fd65e28756fa25136e8935f4330c8ea0708d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696111816, "uuid": "1d5201d1-31ad-4543-9381-e84f484d87a2", "comment": "Malware payload (Amadey)", "value": "da756be4994d665c0a022a490db8119487ec5b0264fa254bc6aba096d8a4f5baf1cbdc6ec7b25d305d180e17d480d9c4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696111816, "uuid": "80dc7bba-1264-46c4-b218-518c7c6b39d5", "value": "T19825224AB7E84826CCB32B708CF541D3123AFDE24DB543371385A90D1DB2AD8A47676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696111816, "uuid": "5dc4b68a-eb4d-4d29-b627-6d5c7fb36515", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696111816, "uuid": "e7b93324-6891-4438-8c0f-2bd1751d7024", "value": "24576:1ygd+YzQgnyHy43hLWZxuu+kBGgNby6cA6S:Q5YzQAS3eMAby656", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696111816, "uuid": "063a9fc2-d9ce-4e49-995c-cadde8eeb431", "value": 1017344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696111816, "uuid": "23ef7490-5830-4f9e-9a70-b61f2315124e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696111816, "uuid": "6713d804-a2cd-48b9-ba5d-f118c68fbeb6", "value": "6db00618f6f9d4823bbeb433ed8c2a63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb07a01-5f2c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696035360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696035360, "uuid": "f1e48318-c5c7-4554-af5d-8307dd8ba4ca", "comment": "Malware payload (RedLineStealer)", "value": "916107cd4f5323003313c970443db112", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696035360, "uuid": "096eec0a-e2a8-4fd3-84f8-b76d616efbd7", "comment": "Malware payload (RedLineStealer)", "value": "7ff6bbf8b4accae080b29870b489a7cc872002449547c3ee827e7d344fd46fbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696035360, "uuid": "e77ca070-31ef-4509-9a44-411ce92eb23d", "comment": "Malware payload (RedLineStealer)", "value": "76bbe968321ce4035611749feb923ccc4d4f626a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696035360, "uuid": "5d916f14-c05a-406a-80a8-4e14b9ea2667", "comment": "Malware payload (RedLineStealer)", "value": "8a50fc945b81f3ebe4086734ba4834601ce51de2cfe1fba3597014d1c2ba99e12bba9aec39014b82413463be1361f114", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696035360, "uuid": "2b31ffab-35a6-45c2-8a65-948079c91c5b", "value": "T15734AF11B4E1C072DC7215360AE4EBB95A3EB93009965AAF67F40FFE4F30281D671A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696035360, "uuid": "cadba335-3a45-4444-901c-7d002d734595", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696035360, "uuid": "33aa8b36-fb94-4ac6-811a-525b55921fc3", "value": "6144:1Bz4SHy5uoBMFGV5PEkIXEHvZAOoCBHVs0BC+:UCmuoBMUOMxuCfs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696035360, "uuid": "ea644705-9e7e-4711-a949-f19fa09cb3b2", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696035360, "uuid": "ee90c2ad-0766-417a-97f8-222494ce787f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696035360, "uuid": "f88ef84c-8e44-49a2-903f-fd35a7e009a8", "value": "916107cd4f5323003313c970443db112.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79502516-5fc0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696099076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696099076, "uuid": "71a1af8b-0120-4a1b-bb8a-00fdd3267da0", "comment": "Malware payload", "value": "daeda710935ca645576818e0b0a6b84b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696099076, "uuid": "fdf5a3e5-aa42-4e9d-9fbc-7b606e52682c", "comment": "Malware payload", "value": "8085430f270fd6ebcec4d167ee88472e314ef6f7125706f0d8c8a1c3f9796b90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696099076, "uuid": "41bb8cc1-f921-4d60-9dcd-63d5f6191415", "comment": "Malware payload", "value": "4a4b01ce3e39d5598d0031cda8b1af9d3d329e67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696099076, "uuid": "18623174-8def-4b81-823f-98b3284c2a63", "comment": "Malware payload", "value": "600e88dd17f80be287f20cd7574a1c40e9fd148676247791e9429c13f02c7e23a38fe466891db3197af715b8725a2c50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696099076, "uuid": "4ad6b2c7-0c59-4f4e-b6e8-5191b72161a7", "value": "T1B254BE587AD0C860F47B54391C314E66DE3BDC364FE4EA83A3C886F87E60190DB6999D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696099076, "uuid": "8a721b06-51e0-4ebd-ab20-c223012f6683", "value": "5b961e24b82512d2a00ac6c970dad1c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696099076, "uuid": "72dc7353-515a-416b-b054-b628a5f645ee", "value": "6144:WhCcKajWpVP06ik3mU29FeiZ7j0VfWpgrj:W1KajWYUM7j0Ipej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696099076, "uuid": "5c360c08-a2a9-4aa2-8cf5-82a19331dcdf", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696099076, "uuid": "e466001e-d768-413a-84e7-a0a07365ed06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696099076, "uuid": "7b42bb57-086e-461b-b7a8-19dabbf50098", "value": "SecuriteInfo.com.Trojan.Inject4.61544.5841.6345", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "471611f2-5f90-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696078376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696078376, "uuid": "a4272c41-2c5a-4d4b-8b9e-228be155aea0", "comment": "Malware payload (Smoke Loader)", "value": "137a5aab4d49a0a588e39dda5377b6f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696078376, "uuid": "e7c0e25c-59b0-4953-b972-87015eae30f9", "comment": "Malware payload (Smoke Loader)", "value": "80a6defb0007cc891e6ea6eae2c429d02f497829dc7e51280cd13163d4cd6390", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696078376, "uuid": "e2c8bbd2-00f3-4508-8042-33029aef6244", "comment": "Malware payload (Smoke Loader)", "value": "228d1ef7d52d5d432eebcbc814184209774dff8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696078376, "uuid": "93f3624d-7035-4833-85d9-f00f2f42745c", "comment": "Malware payload (Smoke Loader)", "value": "68c2455c26b6d1c352a62614b5788cbc5d7a5c6648d0ca2d392de1ce5708abce916f16676ff9cf21ffdd0c6f45ef2482", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696078376, "uuid": "9c970aac-91d5-4724-8fac-7e8c54ee4d33", "value": "T1F6349E23A2E37CA1E66767328E3ACAE43A7FF461DF65675A3214563F09701E1C263311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696078376, "uuid": "f532b95c-996f-4db9-a94c-89d3edb83247", "value": "5a388ef2cf242f40b496c828593b517b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696078376, "uuid": "5b7c847d-2538-48b2-b777-c5d436185b28", "value": "3072:CXjb33B+IZUZkFWEVy0d38hB8CV5ae4QSaZMZGdpioNp5VQJ88i:C5NUZkFvg0GbrV5ae9SiRdpiozn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696078376, "uuid": "c5f87685-b155-4033-8ba3-1e74c6b20f86", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696078376, "uuid": "311da122-69ec-4bd7-8159-993aea455930", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696078376, "uuid": "226a9463-c291-402a-96c6-0c7183237ccb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d459fb63-5fe3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1696114261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696114261, "uuid": "d5135df0-c6c7-4dc8-8e01-2d974b20df4d", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "7d55ced04f9cb728a1ea283190b6fb92", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696114261, "uuid": "f59f0c85-4870-4e53-99d5-ffeae498696a", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "80e818d5697a79173104ce849679df30a075d2afe4f07c9e6c833f23daf5ac71", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696114261, "uuid": "2c33c93f-ba17-4e38-8377-4b5be113bbb6", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "f86a88ebcae43cebf4893d8e71ef2adaca5ebdfa", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696114261, "uuid": "a6e65b7c-4749-40d3-924f-ad0ed8eb2ff0", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "2b83c08fc2912809c005e432dad59e8151a7abd7871a92dc148ababf94b090fcbace8be4b0786750152b437a7b154e99", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696114261, "uuid": "3d63ebf0-39b0-4b23-98e7-5524f6151fef", "value": "T1B7940112B7E88177ECF527B458F603D30A367CA18978432B3799696E18736C4813A77B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696114261, "uuid": "3607c813-e80b-4175-8562-6c76a9312905", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696114261, "uuid": "f8f5bdda-1427-4bc0-8120-23aa99d00119", "value": "12288:2Mr5y90ITaf0TdFuoNSKr7p0jnNobL7cEE0:/y5TZFurwp0bWcE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696114261, "uuid": "c6ef0144-daf3-4afd-9c16-f7f7e11e6e89", "value": 439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696114261, "uuid": "41fd31ba-d0f3-473b-912a-c98714705d37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696114261, "uuid": "e62d0aee-b850-4278-b1db-cb5af9e8376e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "833b6ac3-5fd5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696108112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696108112, "uuid": "6fd8bad0-f853-4bfb-a876-dd1c6dede6ff", "comment": "Malware payload (RedLineStealer)", "value": "eeb8a6c6433dd3b3b1dba0f9b41b74ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696108112, "uuid": "3992a1d6-5801-454a-9fb2-76d3fc98fc18", "comment": "Malware payload (RedLineStealer)", "value": "80ec921ab70600f8214f19be8afc2833fef6a29d6d9bc625e6296204dec649bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696108112, "uuid": "8de730ae-5c54-4376-881a-c501dfd17966", "comment": "Malware payload (RedLineStealer)", "value": "f11c21d49622c6b9f1fa1c2bbc7489d0eb1168fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696108112, "uuid": "f5efa993-6a59-4e51-b756-9cb837651d82", "comment": "Malware payload (RedLineStealer)", "value": "f3dc55509b0168a7e6081756c26c6db927f382f053bb2e2ea8961849d6aa523643e5414a6cf2ba429786278b828aa1ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696108112, "uuid": "872c4d2e-def0-440e-b7fb-6cbe41c7ee80", "value": "T137657D7178F08DB1FDE2117A49ECB824867DF0E0072A87DB56C437EE87286D16B36586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696108112, "uuid": "b329a060-cd67-4e22-a69a-ed7e7175da5e", "value": "500aa68029ae375a898af1edb3f40b87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696108112, "uuid": "a69ced3e-15f8-4dfe-8d23-47471406c9e9", "value": "24576:9+yzyicBpqoZTgVifptq6PQMS9J41x9b9H:9SBpqoZTgY1PdSr4vVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696108112, "uuid": "d6e0427b-4b59-40f7-bfef-31df32228555", "value": 1487264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696108112, "uuid": "af9aed74-c54d-4e2f-867f-f070080daf0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696108112, "uuid": "d2f6b425-0e27-4771-8a43-b7d64b08333a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5497573f-5fb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696092143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092143, "uuid": "6b14e744-e51b-4d23-9768-1837981db4e5", "comment": "Malware payload (Mirai)", "value": "a4dec59d1414eebbd76f3d0289137bf2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092143, "uuid": "6906412f-de02-4baf-acfd-781b9efdef98", "comment": "Malware payload (Mirai)", "value": "81f58cc33db0931e3247138db6dfeb982ee3d1e31655a98888b00e6dd01ecad5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092143, "uuid": "911d8823-d0dc-43a8-be65-fa25e0a0be67", "comment": "Malware payload (Mirai)", "value": "e09ec1bd87d646718bacaaced7b22088ccfe3f61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092143, "uuid": "ed7cb739-5b2a-493a-be72-f23f0c136a55", "comment": "Malware payload (Mirai)", "value": "afb5e61ed11d990a6f21e6c6c7f522ca719495baeb24024238c32ed6cce546ceb5365517b5e828509cc517261cb6bd11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092143, "uuid": "11b1d706-df3d-4081-88a0-c886b29f9e1a", "value": "T122D36A72D8396F58C195E074B0758FB92B53A1A182474FBE29B6C3B45043C8DFA49BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092143, "uuid": "f0ddf306-d923-441a-b8c5-0fe9ad885b94", "value": "1536:baN0CR6tlhATSP8+Y9CS3K5QCgKOXW+zOWaInjeZWnysFcOCunSGsXFr:bNCR6iCkKyiOaWZSZWysFiuSZXFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696092143, "uuid": "35fc2c5c-738c-44f6-8f40-96c6e7e4b7e1", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696092143, "uuid": "84faa4ad-cfd7-4f9e-a22e-438f90f8bb63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092143, "uuid": "14e618ad-88c8-430a-9086-8518cae7758e", "value": "a4dec59d1414eebbd76f3d0289137bf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74c51516-5f9c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696083607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696083607, "uuid": "2d7d9212-e785-479e-9dfe-6477d10f3315", "comment": "Malware payload", "value": "669e4f5b688b8b69778d0064ec43f00d", "object_relation": "md5", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696083607, "uuid": "e1cbf55a-724e-475c-abe7-997509969305", "comment": "Malware payload", "value": "8531edbd8fec4f6f9672b69736b6b47d530ce9a14e0dc2b6b92144b778361feb", "object_relation": "sha256", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696083607, "uuid": "4011def0-8a7e-4b48-b4a5-36447b039f93", "comment": "Malware payload", "value": "25af7947bf01ef82a04dc6d570bd371d7795918b", "object_relation": "sha1", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696083607, "uuid": "2c7ae269-9ef6-489e-94e9-dc9d88827a79", "comment": "Malware payload", "value": "99db1d3b6ab4939ec4a6a6db4dcd9b122fee6b31e78a979d8f2738ef86d7a3def709c314783c1cfeee5ff7f696e0e39e", "object_relation": "sha3-384", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696083607, "uuid": "530ffd4b-2c9f-4683-9df8-803801c0fefe", "value": "T1C723F986B9C1CE5FC6D150BDEBAFC3B633319794E68B3707C50897247E0715A9A1AB80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696083607, "uuid": "545a4a69-b23f-41a7-9cdb-4a00a73ab7da", "value": "768:GR+yzuQzDovSYx4v+ixzE8ehDSRFHBtRFip0zfNgU9lFRN9OU+E+p:GgOOQJ2cR1BtRFiqflFRzOU2p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696083607, "uuid": "e2267d23-2506-4980-9ca1-a14f4c57341d", "value": 46463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696083607, "uuid": "0694b786-1320-41f9-90d1-8fe73dfb0f58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696083607, "uuid": "821b232c-594d-41e0-8dbc-88afa0db7a18", "value": "Arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92df9165-5f41-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696044573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044573, "uuid": "2429c202-84f9-49b7-8ce4-cf81ab8518ca", "comment": "Malware payload", "value": "c8932bc9c19355091227f75f4981e83f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044573, "uuid": "18ace4d4-8ac5-44f1-81f6-a30ddac08e8f", "comment": "Malware payload", "value": "863459003cb750f92ebb22dab8a6964b55244194c7f464db81c35b2359d7678d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044573, "uuid": "db44495a-a0c5-4434-95b0-58211f2d0585", "comment": "Malware payload", "value": "20d10faf52319f92b468aa0388734209b4b9ce9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044573, "uuid": "56d3024e-7eb2-4f56-b950-db06823e24c2", "comment": "Malware payload", "value": "39bfe3c6ba5106e0562cc7e7a293958536410078d4917f08c73ed2cd3598d378f9859858736eda2977d7f5cc69489d69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044573, "uuid": "6397c7c0-80ef-4ecc-980f-22826a2d7543", "value": "T146B53321778644F9F21313334AD227B7D7B9EA444B271CE71708C97D5B7ACD2A02DA2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044573, "uuid": "84da0d68-c2ea-4f7c-bf3c-3cd0a3ddaac1", "value": "1d0e3506c01cb61e9312cbea4911e92e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044573, "uuid": "47ac1f64-3b8a-46ff-8c76-924bcfd12382", "value": "49152:Wf++XGfmAZZRbLZW1ZH/bWMcd/nNOx5nvc9PVY:WUfmEZR03YFnNOPvCtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696044573, "uuid": "a77fa2ef-c1fe-473d-af9f-3464c73759b5", "value": 2330336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696044573, "uuid": "22692ca0-54cf-4ae8-a9a6-3228cc06be87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044573, "uuid": "54920c6f-168f-4f2d-b35c-5f8056deeba0", "value": "SecuriteInfo.com.W32.Kryptik.KSH.gen.Eldorado.13352.28966", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0814a294-5f9d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696083854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696083854, "uuid": "d39ef311-9ec0-42af-bc26-8ebe500638bf", "comment": "Malware payload (MysticStealer)", "value": "922b7cc52f8f84fc5b73a749b845bce4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696083854, "uuid": "99d63265-c3a0-4288-8631-0041a514de4d", "comment": "Malware payload (MysticStealer)", "value": "865ae1c546b12381f15add47b63c8e4ee09ba8f3a6748ae7ddb255f16f78c972", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696083854, "uuid": "0ff2746b-9381-49d0-89f6-3fef1ca92b50", "comment": "Malware payload (MysticStealer)", "value": "149b0ba27092abb9992d2576b94043bc9aa2f3f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696083854, "uuid": "4160ed5a-09fb-43ff-9102-bc328d9d5f65", "comment": "Malware payload (MysticStealer)", "value": "05c30789ff99d8ba619f8d139c934f936763dc50b829e5889afa45bf23bb5d45eeeb838adec760ed8c3e171d6b1888ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696083854, "uuid": "dc7afe58-4cb9-4d92-bc66-0e90da0a2ad6", "value": "T10854AED172D08272EB7425361520FEB14A7EEEA43E884F9B758C677D2F612D1C031A6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696083854, "uuid": "0ae84c46-a7b2-4e6c-afdf-54bd574e2232", "value": "5b961e24b82512d2a00ac6c970dad1c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696083854, "uuid": "4be43027-a1a4-4e79-9d0a-d156f1926ca8", "value": "6144:WhtYk2jWRsLz6zpclVdU5SnJFYAqMQVOkh5UChk6qBBfjy1Oj:Wsk2jWVcDZqpObCGVBfjycj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696083854, "uuid": "1783d80c-cda3-419f-aff0-8a287e6e72b3", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696083854, "uuid": "ae19b088-0ac4-4751-914b-27cfb841b071", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696083854, "uuid": "bc2cf338-8fb3-4247-9bf2-0adcf043207e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262b11e3-5f7c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696069731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696069731, "uuid": "71d0ac5c-97c1-471e-ad03-d2e4f341e9f1", "comment": "Malware payload (Amadey)", "value": "361ac98892fa1c36e2ea9a5e455b8adf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696069731, "uuid": "40a1e2b1-c6f6-4ddd-bc17-3ffe15b227a5", "comment": "Malware payload (Amadey)", "value": "86f15576b4640932b6cc701e67f8f6f7945669bcaa4b09159103ee9886eb7978", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696069731, "uuid": "57d39690-8f48-4f44-8efe-93fb355f4742", "comment": "Malware payload (Amadey)", "value": "25a9f9637c0de2d5928e1b5002027208df945652", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696069731, "uuid": "edd2ba0a-8472-49db-9200-40943cb2cfe9", "comment": "Malware payload (Amadey)", "value": "3d969da0ac2c8253e8db6d25b4a4006bf43e9a12e8ab5aa68bda82d887566cdcc1a82a19bc71ef5488166478dcb1ea27", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696069731, "uuid": "3cf84b24-3dd2-4a8f-b073-1b8b4414bd78", "value": "T1F334BF11B4D2C072DC7225360AE4DBB95A3EB9300EA55EAF63E40F7E4F34381D661A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696069731, "uuid": "ee0424b8-0253-447f-a47b-1eed9488bff5", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696069731, "uuid": "75e339d3-a913-41ed-b540-944c78e08291", "value": "6144:Qyz4SHy5uoBMFGV5PEkIXEHvZAOvOjnrVs0BC+:MCmuoBMUOMxiJs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696069731, "uuid": "ea84b5a6-5f93-474c-a06b-e695828ba292", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696069731, "uuid": "60ddc482-81ea-4aa5-ae7d-1f4affc5ce9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696069731, "uuid": "99e868a4-ef0b-4129-81f1-2a09fc557236", "value": "SecuriteInfo.com.Trojan.Inject4.61510.7337.15128", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1115e9b9-5fb3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696093318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696093318, "uuid": "1d01d900-0b47-45c5-841d-28077824b340", "comment": "Malware payload (Amadey)", "value": "f11ad49315f850fd981ffbd9cd686f2c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696093318, "uuid": "1fda049e-8697-4392-be1e-17b10136cd6f", "comment": "Malware payload (Amadey)", "value": "878a1acd32d9c0f80c125fd8347a814e44e0f05ba4e311417a06d8991389f49c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696093318, "uuid": "6bbce614-648e-424c-a66c-cfc38852ec2b", "comment": "Malware payload (Amadey)", "value": "5aaeeb12eaac26048cd7c83a1b93e4b3f5b1678d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696093318, "uuid": "6f068d96-e466-4ba7-8d85-ea389b24eb56", "comment": "Malware payload (Amadey)", "value": "719f0224dc2d4f41229b2467a747eb73e53a05f4607c057022c27dc036d1c24d216477dcc5ba7d2b7d017d3d30812f73", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696093318, "uuid": "c69dd408-f0b6-45a6-ae90-7e02ce311b3b", "value": "T1C5252257BACC5072D8B11BB148FB07532F3ABDE7A9B446672687644E8D32884B43173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696093318, "uuid": "27ad896a-c757-4666-b180-6a47d776fe93", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696093318, "uuid": "23f2f3cb-700a-4002-b07e-de270d611581", "value": "24576:byAdJ0EKzpbT0qHH7n3wcznToh5oPXeEnHf:OAHmzpbR73whGOEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696093318, "uuid": "3ed3204e-dc65-41dc-9f6b-dae751ab5c6f", "value": 1057280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696093318, "uuid": "b53d6bd7-ead2-425d-a4a9-ddde6db94f8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696093318, "uuid": "953ddb27-9cca-43f3-b931-e561408f6305", "value": "f11ad49315f850fd981ffbd9cd686f2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b06b0e1d-5f95-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696080700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080700, "uuid": "bee7a8ea-b00e-426e-b1e4-19aba85abc0f", "comment": "Malware payload", "value": "3832f42b8a1655a1ff2cce00aec7435b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mint", "colour": "#97C19A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080700, "uuid": "7d4cd6b9-138e-4fab-8e57-28ad76298a45", "comment": "Malware payload", "value": "87fb26371ed0229ba3706a76b11520bfe751a443e6598fa39d2a382facfb67eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mint", "colour": "#97C19A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080700, "uuid": "9c25e365-3be0-4559-9498-961dc50269ec", "comment": "Malware payload", "value": "d3947a80f0c1aa1c7f743fcaa74b949ee35b1c83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mint", "colour": "#97C19A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080700, "uuid": "2ee52bfe-be23-4e7c-adf2-4889b80c1b6e", "comment": "Malware payload", "value": "94a8bfaef5919741c1ab9488260e48fdae6750a9fe43a3110ea6923a3dce7a046404f32bc3165e5fdc013b72c3b693dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mint", "colour": "#97C19A", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080700, "uuid": "dca8979b-429c-42d5-b9d6-186852fc3d30", "value": "T17BC633D2F72114E8D14AC87A46105B16FA52FA0B5B4705BBAF55E028BF06FE01F37792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080700, "uuid": "8bbee9bb-3978-4cff-8dae-28404a5c6974", "value": "986104699b842f7380115122e12b571e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080700, "uuid": "d0d0cff2-c2a1-42f9-88b0-fc4aad1598d8", "value": "196608:9Wpurk8eVGB94/PByD/pUwjD7Qy9L4EfOaKONEagH+Y5afzyiyenR+hhcZl:TIVLXMrpJ8y9Lr2XnH+YAOi9+hGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696080700, "uuid": "c088ee1f-6cc2-43ac-a51d-c358af03f334", "value": 12075008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696080700, "uuid": "198c7665-10ff-4857-ad78-5e402b3ec3e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080700, "uuid": "3d59d9a8-0f22-4970-b44f-e4e28f1a6eb3", "value": "loadder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a74b15-5fa2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696086299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696086299, "uuid": "bdab9658-4cc9-42e6-8dc1-59adb0b56e18", "comment": "Malware payload (IRATA)", "value": "e37845e73167afaf1d5624383eb7b2df", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696086299, "uuid": "220683c3-09c3-4c77-ba8b-aab981deaa13", "comment": "Malware payload (IRATA)", "value": "88cacdcccc6543eb9a045a9c9aeac6ed984ecc1ed44a523db1e269fe21de0cbb", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696086299, "uuid": "95c8fe3d-cf0d-4214-8cfe-26dfefc0ed11", "comment": "Malware payload (IRATA)", "value": "02122b9625ee46f0fd08ccf1170755fee667aaf7", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696086299, "uuid": "59bf2583-5dc8-44c1-aab8-8434712512e6", "comment": "Malware payload (IRATA)", "value": "8647ce682d94e0c3f325872215cb24068feba0bbd81ef7ca70b087f8d7ef5816a539de2cc6baf4690cde30eebaddf1c1", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696086299, "uuid": "d7b7e879-982b-44e3-9b2e-96119b4cd811", "value": "T1A5A533E7F2A885B0DEDBBA3565085B9440B90FE1AD034BAA74A5FB7D1D73EF84384005", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696086299, "uuid": "be553659-cd6d-4649-8fc4-aa4b83d20fd3", "value": "49152:AEg9MFbdDuuQZwtJK2r84hgYuQdESUqRrW8jxcPtsKtxGsKNnQdHZ+98:Ax9MJdDul8sck1QdrHRlcVsoxGNNnpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696086299, "uuid": "14f7e426-1ab8-4191-9659-846a0576f70d", "value": 2239707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696086299, "uuid": "a94eaac5-2b4c-4a1c-8536-e545b33b111a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696086299, "uuid": "c4718b37-31f7-442e-bc8e-79c310da2d3d", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "272234ee-5fb1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696092496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092496, "uuid": "abcba29b-136b-47e9-8076-33c725c6c494", "comment": "Malware payload (Mirai)", "value": "52a03cf21a82c2cc96fe8160f773fc0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092496, "uuid": "e8ad2ec4-d951-4a15-9d19-8540b9bf551e", "comment": "Malware payload (Mirai)", "value": "88d7673fd41f9659a2b680e02a6604cd14017fe5d35fa9132c914906d7b579dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092496, "uuid": "8d5cbf42-62dc-43f2-ba18-799934c7daf1", "comment": "Malware payload (Mirai)", "value": "787a49278c2d831032f0e2f4fa7f633dd0ff4837", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092496, "uuid": "c9162aae-12eb-4ceb-9241-e31d03a6a57a", "comment": "Malware payload (Mirai)", "value": "2ecb7721c5d07955654466b2c3a5118479d483055f19ed06e9018ef492b54c65aa6b8c79057ee0670eb8a6c8a9ebd7ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092496, "uuid": "c8d17320-4a64-4b58-859b-0934dba185ea", "value": "T1E4F3F956F8814F16C5D212BAFE1E028E37231BB8E3DE72129D245F607B8A97B0E37515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092496, "uuid": "ceef9120-cf62-4549-b58d-c85dc617dda5", "value": "3072:U1puVwO+y0y9UZVG03cX7Qs1+FaG2JDl9fP2tSLI:U14VgyP9OVfcXcs1matPP2tSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696092496, "uuid": "6e4708da-2340-4cd4-8829-7b075441c12d", "value": 159388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696092496, "uuid": "d3a6093e-fb79-4e49-a168-75b299d5a90d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092496, "uuid": "cfdb0fff-8857-4df9-b331-371ff91f45ce", "value": "52a03cf21a82c2cc96fe8160f773fc0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d422771-5fb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696095459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095459, "uuid": "2c5712ff-d81d-4eb6-96dd-09a8463056c2", "comment": "Malware payload", "value": "b5d13a7ea1a109def3b887f14d537388", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095459, "uuid": "fcb9be7e-b925-44a5-87bb-e5d845e9e682", "comment": "Malware payload", "value": "897d5d93eca5638c6cf435a904d8bbc54c2a49b7c95669152557d585adcc3d91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095459, "uuid": "827cb7f1-7449-444c-8290-36d04539da92", "comment": "Malware payload", "value": "eff48ff578b986e5af3aecaa891275e495f1a9d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095459, "uuid": "36e30102-5d44-4b32-8fb7-65bb1a740805", "comment": "Malware payload", "value": "532fe7aca6c319ae508eefeee7fd6ab67748c512685c69bf00a95d65454c6f08f2ef5750a67708080feccb7871486fba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095459, "uuid": "6972c8db-7561-4f19-9be6-ac6d8cf222a8", "value": "T12C057B43F5A380F6C60E0834146DB33EA67D9F8A8B60DF93BB44FE6EA531181D567216", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095459, "uuid": "d98995ff-5b66-45ad-8f27-1afac1f9e690", "value": "12288:xQvxqzgAkAWBArcabVA1HweVSQpJnaT3Tz3RYReqA:xssnkAWBAoazqSYaT36/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696095459, "uuid": "6e50469a-18b3-448c-8fb7-f138b5945939", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696095459, "uuid": "c663bf45-29e7-493e-8e31-8e98e0e3a4a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095459, "uuid": "2060e179-2281-4339-a6b7-374edd334d9d", "value": "SecuriteInfo.com.W32.S-909ca299.Eldorado.8438.14104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2bee726-5f95-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1696080704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080704, "uuid": "be33b8e4-9382-4949-920c-96e11e3ddf0d", "comment": "Malware payload (AsyncRAT)", "value": "c6b95a39cd337cb795a9418ce4ea17eb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080704, "uuid": "1b13d1e1-1bda-4e8b-91a8-442122b0a49a", "comment": "Malware payload (AsyncRAT)", "value": "8a96300f4f9c4d43dd8391904842487bb82aeb5ed7fb860bfd1af5938fad83bf", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080704, "uuid": "dcb51b29-f8f9-455f-b61c-a7af7c2176b1", "comment": "Malware payload (AsyncRAT)", "value": "afa9b34687b18cf5e1303ef0a5939d3cb2a467d0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080704, "uuid": "c0fda52b-fe51-4a55-b1ec-932f49b5d6ea", "comment": "Malware payload (AsyncRAT)", "value": "d2bd41f70039a5b67891d182056159527b1d7443b050dc234f3c28846e5254c1d0c2dda172499254195a05920a8877fa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080704, "uuid": "191fbccd-1771-4df8-a099-70d0a6ae267f", "value": "T13A232B003BE98127F2BE5F7899F27145857AF2637603D65E1CC441DA5A23FC28A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080704, "uuid": "4ac4065a-192c-42a9-be53-2f2ea979bdae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080704, "uuid": "0be7e932-b093-41ba-9f95-4a1ea4849c76", "value": "768:AuwCfTg46YbWUn8jjmo2qrt+9vc7D+rdw7tPIk/6beSz0b5komwHmlASMfeae33P:AuwCfTgp/2x9v3S7Kk/6behb5ko4uWa8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696080704, "uuid": "8db0b740-779a-4fb1-8eb5-b6fd3b3acf8f", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696080704, "uuid": "9359e47c-a262-4992-b405-4c4f0323f2d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080704, "uuid": "9253d2a5-8f9d-4e61-9a80-83a3b7cf63f7", "value": "c6b95a39cd337cb795a9418ce4ea17eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61cd0e65-5f95-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696080569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080569, "uuid": "94a524b0-f91f-4d00-b2cf-8d76e95b6df0", "comment": "Malware payload", "value": "18f83ddc026a030e728f2cde2f6653c3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080569, "uuid": "c675a8de-152b-45dc-8aa1-8d58c7163bbf", "comment": "Malware payload", "value": "8b2f59fb5ea40d920b8b19127399a2dd03b472f8c644bdc394542c6b6480defa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080569, "uuid": "07bf3e3d-131b-4c47-977b-6186e4a053cf", "comment": "Malware payload", "value": "ee186712bb52c1698e0c57e1da0d7c4794531f4c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080569, "uuid": "488cac50-1f64-4fe5-a6cf-c9f918ccdc8d", "comment": "Malware payload", "value": "f9e02300ac55ef7f2fd17487fefda36daf346cf3665d312019ef6e3fe45e32040b6e95a72b1bec3ecec29efd04b9fc86", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080569, "uuid": "e0e7a79c-8b6e-4a63-903f-fc756e80548f", "value": "T10326C2D013F9449BE266C1361D60A5FAC9470477FF9AE116B0EEF5D8AB23DA0C4C83A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080569, "uuid": "f76d1d3f-5613-45ee-8831-6fadfdf3548e", "value": "920a3fe414aab1f466b1576473191691", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080569, "uuid": "78b0dead-eacb-4958-ba7f-99791529bab0", "value": "49152:ieECtk/0MmGjPaQWhAYj/YmppCyk+paFlmU4H0XU7mZevSg5BsUySzACf3YpVg3t:VCjPaQWmY8h36KQUeKe/zZT3YA3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696080569, "uuid": "6dda238e-544a-4ddf-83ef-7d99be305257", "value": 4528056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696080569, "uuid": "1e564f41-ca05-4152-b43d-328fbd4a0067", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080569, "uuid": "cb03d250-414a-439a-a18b-d60d4f0ab151", "value": "SecuriteInfo.com.Variant.Razy.877914.15353.11869", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b779498-5f95-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696080558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080558, "uuid": "61237c98-a65c-4012-8d46-321d3411cb67", "comment": "Malware payload", "value": "c69d50253cd3e7283fd662b346247a92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080558, "uuid": "db7fd4de-f846-48ff-89a3-03c059f0f478", "comment": "Malware payload", "value": "8c49a2ad3fa1c516d18fee4d9328afc76213c5de1473137f36d810da00ae6967", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080558, "uuid": "4d7c9558-bcb5-41f0-a2dd-8ce083a86ac1", "comment": "Malware payload", "value": "4b3f6e349c970328d8ef580c055a019de6f4cab7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080558, "uuid": "a6d76998-4f5f-422e-8040-b73c51886c44", "comment": "Malware payload", "value": "26141081f1ac344791c1f59300af9068fff01c132a4fba52393799ad90902cadf64caf8ee2069dd4ae9a826b822b91aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080558, "uuid": "97057dfa-f52f-4103-8f21-7c1f226bcb36", "value": "T13EE49D0EB94E4A4BC84F36711C7A01356BFA9C0F4879FFA2DE45AEFA1B23510551E81B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080558, "uuid": "c93e8198-09b9-478e-83c7-509aa923fa31", "value": "12288:TKCcu+Izqr8q38QMprTCx6gzTRBHFB5XWD3D12hsBA:TNcLIzu8q38QMQx6gZBHFrXWD3B2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696080558, "uuid": "f17430d3-a9e1-4cf4-a6d4-d4305de05d7e", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696080558, "uuid": "119a02c2-c8af-4c44-92e8-07d2245513d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080558, "uuid": "b1ac1a51-0ba8-45ff-a57c-7b6836ad9647", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.2694.18191", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f5bdd9-5fd7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696108753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696108753, "uuid": "97b7c5fd-9acf-4352-a043-b2557529ea57", "comment": "Malware payload (Smoke Loader)", "value": "deda3964e8541e34f4392708c4854d6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696108753, "uuid": "45b08b17-0c45-405e-b95e-28eff5817809", "comment": "Malware payload (Smoke Loader)", "value": "8cfe554aa051d102ed1284695b7f285a0d0669d727f489df8d30be7bc4e53620", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696108753, "uuid": "c0c6f677-5aa6-498d-a32e-dd66cce574e7", "comment": "Malware payload (Smoke Loader)", "value": "095d2ea319541f48f69b470bd6b617c8a1026421", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696108753, "uuid": "202b0680-d6ed-4530-9311-1e8a94bfb686", "comment": "Malware payload (Smoke Loader)", "value": "7b94fc3c0238b2bb5bd07d374d3d0dd6625aec7759a52ca3c5d9379608c902ba3e1c778f45e1127d9cbf490ebdf3a6b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696108753, "uuid": "88acf86e-7b4d-4252-988a-59ef164fa4bb", "value": "T173249E2362E37C51EE6767328E3EC6E87A2EF461DF69675A3214565F09701F2C263302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696108753, "uuid": "3c1850ec-9e1f-4ffc-a11c-6fec7fb3b73c", "value": "d323d1063364fcdde3ec2d7fc616011e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696108753, "uuid": "3234761a-1f00-441c-87da-e0d82ee8573c", "value": "3072:yaRRaybjSKQuehw0mFHsmWRMOGyMxXGsvF55/r2gx:r/SKAS93WtGyyXGCFr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696108753, "uuid": "0b0696f5-c371-42a0-b530-ad81067ee91f", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696108753, "uuid": "df208879-c023-439e-a2c2-462c6076db8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696108753, "uuid": "fa2598a3-9276-40e9-b247-390f056b5dc8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2cdb3e-5f95-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696080562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080562, "uuid": "b33db2c8-040b-4a03-bd73-dc7ee1453113", "comment": "Malware payload", "value": "779ff91d6893229708d97f21cb2c9e4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080562, "uuid": "e79c57b0-8f94-436f-97c0-5516546f8381", "comment": "Malware payload", "value": "8d0191d24b9d62100603d7640fe138d5eb005f758fa77cbcf0434e317286db6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080562, "uuid": "a5c96826-49f5-428f-9932-c71456a24d70", "comment": "Malware payload", "value": "883889f130a26a11f02648849829d3ba0f208fb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080562, "uuid": "73d87526-c642-467c-b5ea-127a391a5ba6", "comment": "Malware payload", "value": "0a580aa346507174c6f60be5ba6bcd5e4a28bada1b52a8e8378b4b42079d1e9cd515ad7f5415be59017da12d3795d5f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080562, "uuid": "e1c61aa2-2011-4eaf-acaf-44a3da31c46c", "value": "T135B533217BE7C07FE0A20231E5D87BB045BE83690F0865D367E59B9C5A386F2A775348", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080562, "uuid": "a20c493a-160b-48ec-8cd5-9fe272b010cd", "value": "4ba3ea0d6362a841ec66a1fc0a1b874f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080562, "uuid": "abc472ef-b2af-4994-87fe-dc7b629ea415", "value": "49152:ufBudeLGQtMYIcoU9qia+cKu2RiviribhMTQvRkVejWEGEBG:reLfMiNc+uiubhKf7SG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696080562, "uuid": "d500f930-ab3d-49bf-8ad1-5dbc9e2497e0", "value": 2324760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696080562, "uuid": "8e436921-f6a6-421c-b0b2-1bbcdb5665f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080562, "uuid": "9335e9ae-7828-4925-abf0-d1742dbd8aba", "value": "SecuriteInfo.com.Win32.Evo-gen.6656.15576", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb62c06-5f5a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696055434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696055434, "uuid": "7cfd7124-58dc-4819-8f94-9f377561552f", "comment": "Malware payload (Smoke Loader)", "value": "2a40d803ccaf191009437cb170c1e8ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696055434, "uuid": "c30de629-82f6-4dbc-be3e-f0be58157deb", "comment": "Malware payload (Smoke Loader)", "value": "8d3e860dbecc463a4a2ed989a7dbd24684b0a5e358afe864459dd002740a2035", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696055434, "uuid": "bb30b287-36c6-4058-a63d-7b959ade9c9b", "comment": "Malware payload (Smoke Loader)", "value": "dcc8e8a5df1d655a6c10a5103a2a018fac64d9bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696055434, "uuid": "116f3d14-605a-41b0-9715-c648f8f6103a", "comment": "Malware payload (Smoke Loader)", "value": "45222b62e6e7ee55329c3859ce7670d535bb343fca73e6434c128edd4012c6b14c2e75541a7a87bd4268a41a5d11db5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696055434, "uuid": "97c3e194-41a9-449c-ba09-320b90962924", "value": "T1B934AF11B5E2C472DC7215360AE4DBB99A3DB8300DA15EAF67E40F7E4F20291D631A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696055434, "uuid": "26f36e9f-4921-4976-bac0-c6454b9f1af8", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696055434, "uuid": "e8a84f2f-f0cb-4b2f-8b8c-b0e46aacdf61", "value": "6144:h6z4SHy5uoBMFGV5PEkIXEHvZAObMV+Vs0BC+:jCmuoBMUOMxpMAs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696055434, "uuid": "55e206e2-9f9b-4fc9-8bc1-748ef119afcf", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696055434, "uuid": "f4ff561b-cf16-4e62-a46b-0d9ad7e5d734", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696055434, "uuid": "03029b28-d0a4-4815-8896-00fc104b7e0b", "value": "SecuriteInfo.com.Trojan.Inject4.61510.6808.29443", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed392b97-5fa1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696085956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696085956, "uuid": "03b1adbd-bc8c-474d-996b-8eda81467c55", "comment": "Malware payload (IRATA)", "value": "c5d8d4f06a57c930860d615743f3ec15", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696085956, "uuid": "a9be985a-fc9d-4593-937b-fbf71785d79c", "comment": "Malware payload (IRATA)", "value": "8dbf0e724607da43ce49de9627823e6b372d2d923c76f2df48295d704276eb95", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696085956, "uuid": "0b1ad424-e733-45f7-94d6-8c3748a38df6", "comment": "Malware payload (IRATA)", "value": "ea9ce9aee967feff36a96b5e44d8f1242c6d48cb", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696085956, "uuid": "ee7a6b63-6600-4772-99e9-d4776298e489", "comment": "Malware payload (IRATA)", "value": "40f88e0dd4ec87142c2d03a096665b5b473b20e53c95fa174c677167f1582ff8cc3f8c2ad2ed1435a5815b6c8a085e37", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696085956, "uuid": "11b6c6ae-5128-4708-b18e-35af3335feb7", "value": "T166D52353F266A86BC8E2C37221642B35503A4F689B43E74A784837F978F7DEC4B851C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696085956, "uuid": "c5379838-d7a0-44d1-a9ee-076215b860c6", "value": "49152:BR/Fq0TmlfVQZgnwssVaeMFrKlh0C1YMsqY4u/1jH5CJLDvpnmGU/UWg1hNmbSfW:B5FLm1tn/sVZM58h0ZlqY4mDOHpnmG6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696085956, "uuid": "caa3fb31-6f15-40f7-a93f-0b2dbb9cc3e9", "value": 2964860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696085956, "uuid": "68e5537e-cbc1-489d-923d-a6a5931bac40", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696085956, "uuid": "6efbdfbc-2348-4393-8ac0-a255d33b501c", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03c5e825-5f8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696077834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696077834, "uuid": "8c51eca7-70ec-454d-9147-6d6b1b228150", "comment": "Malware payload (AgentTesla)", "value": "83557e5d13314ec959a98df60f7d4938", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696077834, "uuid": "0ef0f314-11bb-4b4f-8f6f-44d83f349c25", "comment": "Malware payload (AgentTesla)", "value": "8e5bf45a12f8c239ab98865cb7bd4e541e1ce06915c2e4acd436c25c25f9ecc2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696077834, "uuid": "49151392-b5b1-4e22-85fb-fe22f534a70d", "comment": "Malware payload (AgentTesla)", "value": "a01035da8457fc5c2f09e2c25258983a11781b7f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696077834, "uuid": "51456e98-b23a-487c-8c85-6b29250cd393", "comment": "Malware payload (AgentTesla)", "value": "84139f67a393281ce783d4786147db483e335a8324d944284f21a8b7b45d55beaee6966a61acb324a94cd52e206b4046", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696077834, "uuid": "88d65685-21a1-409d-8154-0b3285713bd9", "value": "T1CFC4238685821F05D0A6FDA3D341CB6C3EEC277A966B7210EB6CD8D831EAC350564B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696077834, "uuid": "60e09e55-25de-4014-9aeb-9c26da42ac6d", "value": "12288:YwluEKj0Hr2DbZ+5yLPq91dluLuKKggfrBm9mLP3Wb:Ywlurj0H2t+sU5u9FErBJLOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696077834, "uuid": "8807e95e-5375-4ccd-80ea-33265d0b8bca", "value": 571706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696077834, "uuid": "0f7cf5ba-0873-4e4c-85d9-5ca0cf6631f4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696077834, "uuid": "f4dc2d3d-74dd-4d2d-9429-81ba7bd50e70", "value": "Payment 25% in advance.pdf________________________________________________________.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afbd749c-5fd5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1696108187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696108187, "uuid": "7336190e-0bda-47f0-860d-2ae22a997114", "comment": "Malware payload (RecordBreaker)", "value": "45e1e599bba820bb0570f8b2a1919d46", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696108187, "uuid": "4ca6575a-ac74-47ff-8017-ce59c1413469", "comment": "Malware payload (RecordBreaker)", "value": "8f4c359f0f3be3793242a2b36f0d83318871ec4e1ccd1b8df298ef01872986ba", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696108187, "uuid": "d45dcd5c-edca-4b6d-92da-e1cd7c6ba2b3", "comment": "Malware payload (RecordBreaker)", "value": "1c595c588f8cadd973ffdbd438d280d70eec8a50", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696108187, "uuid": "d32a26f1-f117-4bdb-854f-b67b959789b1", "comment": "Malware payload (RecordBreaker)", "value": "58651fc3daaa9686873e89311550dfc961a1e3277ffc47756afd043b1b3afef020c0f0b919f285a9d97ab4e34f87946a", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696108187, "uuid": "063df706-ac51-46b7-a3bd-e9fc29796ed4", "value": "T1BF062211A1E8413FE1FB287024F982755628BC792B7119D713A07BAF1DBE1E1D2B2772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696108187, "uuid": "b7b6d54e-6ffc-48d2-825b-a1d05f9d84aa", "value": "959a6730bc071cd048c8e4c56109bff6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696108187, "uuid": "39a991ed-125b-4b9c-8f71-6f01cb1146f0", "value": "98304:vv+p9/2QykUIiTIB4gPtClGwTpCT4puijPQZyI:A/2QpQIB4kiMYIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696108187, "uuid": "5833bd3d-2f67-4b32-96ee-db9afd9bb1ff", "value": 3845832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696108187, "uuid": "d89550de-e5ef-4234-a205-48a52f9aaca1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696108187, "uuid": "a596d557-ac28-496c-ad0d-bb5082d6d5d7", "value": "Chr\u043em\u0435S\u0435tu\u0440.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d47693-5faf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696091799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091799, "uuid": "8933c52c-ef87-49a7-8e9c-048b917f98c5", "comment": "Malware payload (Mirai)", "value": "a529b5a7b22fa2fd8d85cf334fd197bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091799, "uuid": "322e9f19-3df4-4d29-a6f9-d7293e9c095e", "comment": "Malware payload (Mirai)", "value": "927c72ca480fa13b25220de6ee6c75340d2d082af4c0dfe43d3c1e09dc36a970", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091799, "uuid": "765ed027-e932-433c-a07c-c1c627c52034", "comment": "Malware payload (Mirai)", "value": "753bc8fe2c737812ef53365fb2eb661a8b04f2f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091799, "uuid": "dba340d8-ebc9-4997-bd6d-f46dc68b12ce", "comment": "Malware payload (Mirai)", "value": "2dc9fcb6a0392e851bd89cc0bd7c187d055ed290ba70ccd1d2c040f72e6a323a3b9f700b22c1090ab2df9a673ee2ec18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091799, "uuid": "a061dbc5-5a74-4d92-b00f-984e428d5233", "value": "T1DF633A46EA97F9F0CD4506B8206BAF74C436A8333130DFEBEBD8B9179D56742605226C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091799, "uuid": "e4314eb6-71df-4624-aea6-61a684c1c94a", "value": "1536:IeAolofbYYQsBehM1XcB3xUSOUd3dgb28SbmDuGU:IeyssLcBPk2Xb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696091799, "uuid": "4ec925e8-e9a6-4285-8fcc-d7a5f3b23bdf", "value": 70232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696091799, "uuid": "50cde891-5781-4764-92ac-62fac3a057f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091799, "uuid": "70f42e8c-5f38-4c52-a079-2e8fcf190601", "value": "a529b5a7b22fa2fd8d85cf334fd197bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e60a8497-5f84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696073489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696073489, "uuid": "8fd53f51-cfad-483f-a668-e947765adcb6", "comment": "Malware payload (RedLineStealer)", "value": "7fbdc4f3c11882c870ffdcc3728a8bcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696073489, "uuid": "f5ffab3c-a4ed-473f-b513-fa37682b5176", "comment": "Malware payload (RedLineStealer)", "value": "94b29c4cc909788208d4d8c814db94327e906b688aeb691172d5ca56b39be88b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696073489, "uuid": "ffdc678b-52f5-47c9-87cd-43eac496e499", "comment": "Malware payload (RedLineStealer)", "value": "d5b606440d18b3a44250a540af1fa4c5dd7c78e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696073489, "uuid": "5f5556ac-7f01-4f76-8511-0dc37b2589d6", "comment": "Malware payload (RedLineStealer)", "value": "4dddfdbfc353cff00151381f9f6ff7171cd67115244c3d3bba36c87651cd75cc29aea04823fa18b73945b62197183c58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696073489, "uuid": "c1fbe28e-7b5c-40d6-afd3-99de7bcff8ce", "value": "T12335234BFBD80072CCB9377044FA0B871935FE965F34427B231599682EB22D49A6277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696073489, "uuid": "9a372ce5-d979-4943-aaa3-6ea88557a6b6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696073489, "uuid": "ac99da2a-46d1-4b22-8b44-9e681271904e", "value": "24576:+yNKUepPKZSkq1yoJR5l7vz0bsZ3REHnAsYdq+UW9q9:NePMqgUR5l7vusVREgsAq+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696073489, "uuid": "d51f54cf-4234-4969-a8a5-53ebf564c494", "value": 1096192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696073489, "uuid": "f5efd9bb-5722-415f-8e64-a597bcd952f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696073489, "uuid": "9bb7637d-cae1-4d05-ad11-4d9611bc5f5e", "value": "7fbdc4f3c11882c870ffdcc3728a8bcd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de27a19f-5f5a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696055437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696055437, "uuid": "0e1a5291-2c7d-4191-a1b9-939b2b2ba42c", "comment": "Malware payload", "value": "5c556dba47dd6cfcbe6f41f139a72201", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696055437, "uuid": "264b4648-ca1e-4a78-be1f-3b8c984a5c1f", "comment": "Malware payload", "value": "96cbeb6a1d0458c118b4331773cbbf0bc9951d7f2e72fe39a31d85b3c130269b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696055437, "uuid": "eb6c8eb1-65ab-45a5-9c53-88c586d0f5df", "comment": "Malware payload", "value": "23fd0b6f8f723629adb705353a1cfed99b6f6421", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696055437, "uuid": "b34d324b-353f-4fe6-ba55-7cec03350294", "comment": "Malware payload", "value": "730149f9ae2b7b991fbd21a9de6792a76b55f7a8304f80988a9c22401ad30a6c44027500db58ce2af37413f9d5461084", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696055437, "uuid": "180497f1-2fb2-4135-870b-86f1fdc6e8d8", "value": "T14674BE43B4E18431DA3378390AD0B37ED47D69784C147AEF7FA44F2E8A30291ED66696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696055437, "uuid": "4061746b-036a-4f27-bdc8-b078fd2fdf7a", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696055437, "uuid": "3c742785-b376-495f-bfdf-25ddb77539ad", "value": "6144:tZTeW/s5GqrO5aXnfEGIXWPvZAO9y0P671J9oanf09ELVs0BC+:imcGqrOk86xv0uycIs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696055437, "uuid": "caa89eef-b691-4313-923f-2cb10fbdb2e0", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696055437, "uuid": "eedef60a-0021-47a5-91cd-f983e9663388", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696055437, "uuid": "50404bcf-7b20-4eb4-b8ef-5fd1c407b905", "value": "SecuriteInfo.com.Trojan.Inject4.61510.12823.24475", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762310ae-5fb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696092199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092199, "uuid": "c987c8b1-d3e9-4838-ad8a-2525bae591c5", "comment": "Malware payload (Mirai)", "value": "c92549d7a6354233eae3bf4909d3480b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092199, "uuid": "515672de-9a86-48e8-bb5b-1a4a63925956", "comment": "Malware payload (Mirai)", "value": "97ee8ebe1cbb94438e4dd4aa024ec42dd40a4ce8b4c00bf84051a907ba2e7fdc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092199, "uuid": "4088afa1-63bf-4e21-b3e6-ed0f4b7a694c", "comment": "Malware payload (Mirai)", "value": "88927d590be09c4b57458891b8956f228a422550", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092199, "uuid": "ce85199e-bce0-4cad-a7c9-e0c3359b751c", "comment": "Malware payload (Mirai)", "value": "381efaed01aa7e7cfd8ea219bf3751b5205e03fdaf4e4f644d4e3983c9718bdbd483096525323c86f52f70347483622f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092199, "uuid": "ccfe3277-cfda-4edf-b85b-d8d063f6eaa4", "value": "T1D7630985F8C745F5C8074A3460BBF33FDA32D6BA40705A6DEF59AE32DA37A015212399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092199, "uuid": "c45de019-6564-404e-94af-5aa319f5f136", "value": "768:HNlq/jqP7jqWYIlupudaHhOOvMLXmHeogHH3CvwetC2AVq3wWu7K29zlrRY3IWpG:HzrP7QIlOudSxvwCGXWwnY3JpazqOgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696092199, "uuid": "e90c889d-ee3a-4109-ac13-13adeeed78c0", "value": 71312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696092199, "uuid": "333dee3d-8388-4890-b003-c9db2a98e8a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092199, "uuid": "8970c80e-917e-4de5-8579-d0ab70196b1e", "value": "c92549d7a6354233eae3bf4909d3480b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ff8fbd-5faf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696091815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091815, "uuid": "0023a94a-ea03-4eae-9794-df0a7803b77b", "comment": "Malware payload (Smoke Loader)", "value": "9f47d8b53581c0ce724f9388b23542b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091815, "uuid": "3c4a4284-4c7b-4c0d-a7c3-d0d0940b18a9", "comment": "Malware payload (Smoke Loader)", "value": "99905c77cf3009dbafd59e33070246abe615e0961a6e9909e493b67d8631a5a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091815, "uuid": "3d555e56-4f16-4d67-a2c2-5c3f80c23f76", "comment": "Malware payload (Smoke Loader)", "value": "1593a2463aa49f6c1fb7868df7b5c27ed1f1ff69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091815, "uuid": "da735276-a9ca-4163-995c-c5e853b54697", "comment": "Malware payload (Smoke Loader)", "value": "8838a671f782af1fccec2ba5c69190b69395f57e5e8cccb94697443b0a3530659a923f6fc191f882ea734c9e4537846c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091815, "uuid": "61491690-4ab9-4037-a243-44f2c3ca7358", "value": "T1AAF3BF3674C0C072ED66D93509B0EAB19A3EFD300F909E9F67984B7B7EA02D08535967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091815, "uuid": "a25b3969-8a81-4080-baf2-15a83a444211", "value": "5b961e24b82512d2a00ac6c970dad1c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091815, "uuid": "8b645274-4c68-45af-882b-273ef0deac2c", "value": "3072:Wh2UoUowo7h0BEYmbuw16GVuiIPMoCdTz6bQpv4xykhHKqfzj:WhhliOBEBbx6Gn36bigxjhHZrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696091815, "uuid": "b38ab9e8-bffc-416b-83aa-e1694237166a", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696091815, "uuid": "7a72e03b-ae21-4fb8-bd20-5af653060030", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091815, "uuid": "10f58994-cea3-4b47-8a39-cb519c95d8c7", "value": "SecuriteInfo.com.Win32.PWSX-gen.10397.8117", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3cbb87-5fda-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696110218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696110218, "uuid": "50ae0fe3-1195-4bb7-ae88-4914b103eb1a", "comment": "Malware payload", "value": "9bcf679d07932c8bdc4c7fb69f197abb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696110218, "uuid": "6b7eb5ec-1c33-405f-b66e-f6d10e463080", "comment": "Malware payload", "value": "99f2fe4de913e06bc5e11fee9f53605dcca109fac75382f772e6df5be15169e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696110218, "uuid": "0bcb52aa-f5b5-4f89-be77-a2e0c36b5b2d", "comment": "Malware payload", "value": "feef13f18a193c0775e3e487f516c72b3431c090", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696110218, "uuid": "84a41675-71d3-48c0-914c-fc6991953a83", "comment": "Malware payload", "value": "3f2725c51010d87b62a7116e5551776e69f71f445297244092afbc58e50013f8b50491eb095984effcdd9c4bb2ba1097", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696110218, "uuid": "827c1eb7-2bdf-4c5c-afe3-c22905f27e04", "value": "T120249C2362F17C11E567AB739E2EC6E83A2EB715EF55672A321456DF08705F2C263302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696110218, "uuid": "ec0fe43e-5253-4fa7-943e-f492ee71e147", "value": "d323d1063364fcdde3ec2d7fc616011e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696110218, "uuid": "f0950c86-deab-4aaf-99e9-337eb0edad86", "value": "3072:BjhjR04dRcww0n/IzyXEE2pZJyJM43e6afcEI55/iDTg3:BbQ0gSKGM4yfcEYsT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696110218, "uuid": "5897b6be-a18b-47ac-9dc1-0362e2aeb94a", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696110218, "uuid": "c266dc57-b844-4062-9051-177a3584a8a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696110218, "uuid": "3f20fcbd-a2c4-4263-8fff-bd8e147aaa10", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57920e7a-5f55-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696053064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696053064, "uuid": "5fd7fdbf-7682-474e-bb81-5996cfade076", "comment": "Malware payload (Amadey)", "value": "bea0281b31774bbc6b85acd534df4e6f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696053064, "uuid": "f158073c-f636-4331-9eba-912c1c1cf837", "comment": "Malware payload (Amadey)", "value": "9a8e2c6eff8aaba18e42f5b77c0e0ab94c5590a08c38846ee006dd0ea0d26678", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696053064, "uuid": "23d307d7-b478-4286-b155-625d93d3375b", "comment": "Malware payload (Amadey)", "value": "442278cfde45aecf7c8d5caa47c176a6c6c84f06", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696053064, "uuid": "a77883b8-2e14-4b80-99fc-c051327acf42", "comment": "Malware payload (Amadey)", "value": "8dac15a4d8f87122194a01558a35b295a421aa87e3782b738c8c6d2759246cbe1ce26a9b1ef16b917206eedbc8ee0fd9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696053064, "uuid": "d35dd563-8397-4243-9d93-cacba5c9fc9e", "value": "T12E2408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696053064, "uuid": "d0343a24-81e1-41fa-b37b-71f1b371a21a", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696053064, "uuid": "13c5dbc8-5617-4ea7-b5c9-93d435fc8410", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696053064, "uuid": "e5cdfb49-a452-4219-9b75-7f697e55157f", "value": 224386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696053064, "uuid": "04884a9d-7cbb-4fde-bea8-0cdff3185da7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696053064, "uuid": "418fd661-c412-41d2-9610-03810897d9a4", "value": "bea0281b31774bbc6b85acd534df4e6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f92498-5f3b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696041787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041787, "uuid": "d9d0a29f-2c11-4f25-bae0-c56bea129d41", "comment": "Malware payload (Smoke Loader)", "value": "3e2b00a450033ed269795b4668c48d44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041787, "uuid": "b0231880-0d10-44c5-93b5-8dde788288bc", "comment": "Malware payload (Smoke Loader)", "value": "9b08d6daf3eb76414c8e54f259f0c103264206ca4f56d56b977540f39b287814", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041787, "uuid": "664c704b-898d-4f8a-8952-136725b6fc9f", "comment": "Malware payload (Smoke Loader)", "value": "9ee8c744c12892eb4b869ef2acd33695f41aa675", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041787, "uuid": "4baab4af-b3b8-41ca-845a-52d0dc06ebe2", "comment": "Malware payload (Smoke Loader)", "value": "710aa8656e3e2db696adf71174a8fed29dc24d4b66d46c5e0fea0fe3382bcaee369b54d9f5309f644f716befb4c83a50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041787, "uuid": "984d0301-7523-41c7-b009-2ed1f72f1831", "value": "T19A349E0A62E2BCA0DA6746718D2FC7E43B6FB4615F796F7B32146A2F18701B1C263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041787, "uuid": "da45f0d6-b24c-441f-bb73-5ac16347f7c8", "value": "a59b93a815ea9713a41e16c8d0248e4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041787, "uuid": "c954b511-83ef-4ab3-9367-8ee830f6e65e", "value": "3072:MXrascEr4aeWGRvNSmnAfyb695oPm2pHmea6528yf5YT8p:I2scTaeWGR1eyNPmVec95YT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696041787, "uuid": "582a2aa9-2cd5-44dd-87c3-bae6714c20b8", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696041787, "uuid": "a7f688db-da4a-4ef1-91c7-00def3e254b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041787, "uuid": "43ac770e-fa89-49b3-87ff-7b14f4272cea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4a006c-5f67-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696060806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060806, "uuid": "8cd638b5-eb47-427b-b7a5-92d8cbdc0fe9", "comment": "Malware payload (Mirai)", "value": "34a94fe198b840fa8e557137cc3d08c1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060806, "uuid": "bd64b0ef-c324-4201-86c8-52158137bbfb", "comment": "Malware payload (Mirai)", "value": "9b7602ffc0aa9ba0ba560b53aed14e111963d4c616291e05c6a83b21287fea3e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060806, "uuid": "36343ffb-3980-4035-a7ba-55c30c92dd3f", "comment": "Malware payload (Mirai)", "value": "5a297e0271c9cbe3d5e28b21e5bdcbc2f88fc57c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060806, "uuid": "56dfd0f3-b325-4cd6-b1e3-6769facd3fc6", "comment": "Malware payload (Mirai)", "value": "2506d1ff9f5937c997588333ea6ea55ae0bf1edd869c2146e4490ea23420d7397b00af1db9b3e413f7cbff8ec863f354", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696060806, "uuid": "9045143f-51a1-4c01-abde-52a131a17d15", "value": "T110230261890EDEF524303C76DB95979376E029B2C6673023D6190A3C3F797131E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696060806, "uuid": "3c3349e0-e18b-4160-8d41-2afb8cb05b68", "value": "768:5/TYCoIxdEk+AxoTZAZHFeq8b3M9q3UELbUXfi6nVMQHI4vcGpvO:5ECFd+A6YHAxVLRQZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696060806, "uuid": "dbc101f9-f887-4d18-9b87-64edb46af8b4", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696060806, "uuid": "1e49acda-940f-4762-ab55-b34b82e0da3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696060806, "uuid": "481d2b77-0e7d-4810-8637-cce118a9055e", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1b9746-5f4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696048263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696048263, "uuid": "edfaa870-86a0-4c65-b506-1abfb46c301b", "comment": "Malware payload (Amadey)", "value": "828c2d7ce11f2b654c81ecd6f1817c91", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696048263, "uuid": "84452884-e89a-4f50-b706-95f23fee2e8b", "comment": "Malware payload (Amadey)", "value": "9bdfb7b624f8f2ad21d5e7ab5344a45b822747e25460c6400979e138ec989560", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696048263, "uuid": "68641e14-a51f-4f7a-ba8c-d592d9119667", "comment": "Malware payload (Amadey)", "value": "13702add94d12d39e6cb8fe0542433a209ffcbe1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696048263, "uuid": "ea10884f-4e64-47c9-8862-1295097d86d0", "comment": "Malware payload (Amadey)", "value": "f9a1e139cd766d2db955abad0efbd5c0129afae0d9b11a8003cebfff0e11ef5ed4fd642796c23e639d02eb05e738cfa2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696048263, "uuid": "fd400345-48da-4f6a-87ca-71c5651573c3", "value": "T156352352EBE85561EAB577B014F71BD307763CE2982487732714AECA0D73389A83271E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696048263, "uuid": "58620ca4-c331-4f21-a243-21621bc23d17", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696048263, "uuid": "82702f2e-ca7c-4fb3-9347-cda4c090e898", "value": "24576:Ayp+Br/ssf+hb+D1Dtoo7BLUPZ3fu5VvtA0cx0:Hp+BLRe5o7BkJfurvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696048263, "uuid": "1dbe51eb-b917-4e37-a44c-d9b4aac8c99d", "value": 1099264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696048263, "uuid": "7da68de4-eb0c-4a2a-b860-5b7f4ede62b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696048263, "uuid": "dd08efc2-255e-45c6-9c58-5772344c122c", "value": "828c2d7ce11f2b654c81ecd6f1817c91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794dccb4-5fce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696105089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696105089, "uuid": "3596dd37-95e8-407d-909b-109c337d6872", "comment": "Malware payload (Stealc)", "value": "daceed4cdd520e0ace53a9fd557663b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696105089, "uuid": "26831e0b-fe0c-48cf-8883-e1fab764f59a", "comment": "Malware payload (Stealc)", "value": "9becc2796d428b8cf2e834d83093afb6bd897d1fbf6817ddc371e0c1c05ec192", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696105089, "uuid": "66b48ea4-5586-43d4-9b98-b7200aae792a", "comment": "Malware payload (Stealc)", "value": "74e69a341bc5928b6e8dba8caa35966b882c912e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696105089, "uuid": "f98e23d7-e2ca-4408-b7c3-02000f71613d", "comment": "Malware payload (Stealc)", "value": "1658547c44bf01bd40f3f1c7059271618472ec1c253c4af940bd5773277f1ebb6a062a7a2080b447ec18148430dc66d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696105089, "uuid": "8756368d-5a52-4e78-a2f3-484ec61520cb", "value": "T1CB248D2362E17C61E467BB728E3EC6E87A2EF461CF55671A32185E1F09701F2D272702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696105089, "uuid": "becdddff-b38f-4ef2-b99a-a209d7f04624", "value": "d323d1063364fcdde3ec2d7fc616011e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696105089, "uuid": "16ca6d7b-374e-45cd-9465-a5eff3ba7ba8", "value": "3072:+K3R9TZGnxNFPAIAGuswNH6fMlg4Bk/BloAkt55/g3gx:3Zo19AJyf1zozNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696105089, "uuid": "04dc7040-3a7b-47d5-80c6-c153ca2e36d0", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696105089, "uuid": "ccdfe4f8-003c-4065-b60c-54d378f0fd33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696105089, "uuid": "e41bc5cc-cb06-4051-9480-e272a7a10a03", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce66dd0-5fd2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696106760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696106760, "uuid": "969920ff-017a-4ec6-8c23-82371897049a", "comment": "Malware payload", "value": "6a80d0a49a547e7634e6a3747d995ac8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696106760, "uuid": "be8869f2-a6f6-401f-b7a6-49ff3885a591", "comment": "Malware payload", "value": "9caecc47d2e4e9758cd72483a679ccbc2ba4c6bc7966fa82eccbca74404a457c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696106760, "uuid": "82240ee4-b403-40e1-9189-873df594b57d", "comment": "Malware payload", "value": "1729530fa0f1897ce2927d04e61ef3d34b509711", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696106760, "uuid": "ceb0e136-e66d-4c9a-b7ce-1545e13c6835", "comment": "Malware payload", "value": "2fab6061c1c39c74358264b44d41854efc47a214d95609b15b0830e6a60b00b11bfc1af759962746e69e691cb3bce762", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696106760, "uuid": "f54df730-e17d-43e8-bb04-174d7e7b0f2c", "value": "T192940112BBE44073D575477018F703931F32BCA159B8827B2789A99E1CB36C4A9727BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696106760, "uuid": "a98ee55d-21d5-41b3-8aea-ace352c978ba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696106760, "uuid": "5756e0d9-db96-452d-801f-98f1b06e0f0c", "value": "6144:Kny+bnr+9p0yN90QENZCuLS2EL02Nv//EOBRhwSSLuUl0SXmzbIvuvw1X767:9Mr1y90nYuO2P8bmSSLuMDuI767", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696106760, "uuid": "94c124db-ba24-4ce4-b603-c2f12bf86aa8", "value": 440832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696106760, "uuid": "f716cdcc-f88d-46e8-b237-6edb4058845c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696106760, "uuid": "3cdd6bf8-54b8-49e4-a057-2eef2b43a722", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca662aab-5f9d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696084180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084180, "uuid": "2a2e0a2d-69af-4d8c-a623-9b97db230abe", "comment": "Malware payload (Tofsee)", "value": "0ec843e45afa120ea6536ee2f9b9c3aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084180, "uuid": "cf0db1e7-1a29-4c50-a169-39805f8ad32e", "comment": "Malware payload (Tofsee)", "value": "9d3ad3f1cbec2ee69bf3d73a8cc79acc04a877ec9f676cd6e6d89f7c8baba385", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084180, "uuid": "7a206bf2-d971-4b36-ab64-2d3432573600", "comment": "Malware payload (Tofsee)", "value": "3a3319263c9ce5b4d649c8102e6687657b1d88f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084180, "uuid": "c4b1f373-e866-45b9-bba8-91d08fdd4d18", "comment": "Malware payload (Tofsee)", "value": "6da0d77cb0ede483c346cd0fe2d92ddbacabb402b81d9425bbd0ff7eea6e0e4ae1e058d947a52df7dc99796e8e778421", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084180, "uuid": "e63e46ff-849d-48c2-a65a-cfcd330b64ce", "value": "T154349E2261F1BC60E5676A358E2DC6E43A3FB461FF69677A331B562F88701F1C262311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084180, "uuid": "53b28df6-fd89-41a9-8d53-71e3268327ea", "value": "5a388ef2cf242f40b496c828593b517b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084180, "uuid": "d152ea72-fcf3-4091-81a9-6008a160ab34", "value": "3072:hXjtEj8Bks7OPEEkYecQEOIqlMsaQHB8w6hS3Cg196p5VPLy0J:F11OPEY7QlMsaG8Rq9Yzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696084180, "uuid": "88f5ece3-3b26-4e3e-a6fa-dcd8c8a73b9b", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696084180, "uuid": "1fb47479-b0a5-4f23-aa80-1daaf7c857d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084180, "uuid": "3e46b8c5-4863-400b-b512-395ed92fdd15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3efc8caf-5fa4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696086953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696086953, "uuid": "81b8022d-1c36-476c-8cd2-894edd2ad50d", "comment": "Malware payload (Smoke Loader)", "value": "cdc140bc9946b0e1e13596b6e4f7b7d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696086953, "uuid": "d67ca071-7f69-48f4-b13f-7e33696da1c1", "comment": "Malware payload (Smoke Loader)", "value": "9d8e733fe6e1f661b785cdd11606761fad9ba21527c9dc4eba984ff3b86449f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696086953, "uuid": "b189e062-ba92-41c1-a96e-b2187405db13", "comment": "Malware payload (Smoke Loader)", "value": "84e23346c0e7501ce0b47ff83307c5468ae613a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696086953, "uuid": "d1e16c15-ec51-40fb-af14-add23e1585f9", "comment": "Malware payload (Smoke Loader)", "value": "a6b6a1e725d9799e8d3f9d40976c838f5400df3d12ce353efb8d37ae0739391d0d9fded443cfd3a6810e6eb698d0ddec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696086953, "uuid": "0d3769d4-380b-480a-aff7-f648ab7047af", "value": "T148349F2362E2BC61E5676A314E2EC6E47A3FB461CF65676E33145A2F0DB01F2C263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696086953, "uuid": "245e00a1-6a8a-46b2-bf16-fc5edb786057", "value": "5a388ef2cf242f40b496c828593b517b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696086953, "uuid": "a2c0ef1a-0dc0-4dea-86a7-9237252457ee", "value": "3072:uXj+eE5Bc6zOPUMCcl6oK/5w1KerJsyMqb4Cp0/zgtA4p5Vz20J:28nOPTl7KBw1HrMqcutAiz2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696086953, "uuid": "d75feb66-b846-416a-a032-64d4ec19ac5e", "value": 245248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696086953, "uuid": "b6e6ff68-f903-4039-b86e-375424dd7afb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696086953, "uuid": "a46caa79-8742-4b0b-a364-aa29541b6448", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15aa7d39-5f73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696065838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696065838, "uuid": "842adda3-9b24-4bc4-9818-67c6464ba27a", "comment": "Malware payload (RedLineStealer)", "value": "592cdecfb64928dc95e787f4b6b3704e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696065838, "uuid": "fc98ac9f-bb1c-4c80-bb95-22aff8aa0c6d", "comment": "Malware payload (RedLineStealer)", "value": "9daf0a520001583a07efd8120feaec2b265ff66765621486bab9008b5bbbf532", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696065838, "uuid": "aa97170b-3860-44d2-b065-ff7da34b739f", "comment": "Malware payload (RedLineStealer)", "value": "7d22dcad5c841d39309e772cad253379aa226f5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696065838, "uuid": "98b27e56-864e-4dee-9f5c-53650b4fdd99", "comment": "Malware payload (RedLineStealer)", "value": "ea664cd4552c892ae224262b18086fe95acdd2c285118e547535f537b973f7a60f3e3e37316d6018c0de35365e2c21fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696065838, "uuid": "5eb2387d-8527-44da-8ab8-402e4d62d09a", "value": "T156758C64F4A0F26BDDA2207576DCA530467EA5A8072A1BC3479C52FF53B86F13B324C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696065838, "uuid": "c92aab0a-b2bf-4336-bfd6-8a5b1b93a513", "value": "500aa68029ae375a898af1edb3f40b87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696065838, "uuid": "e63c7fac-bebf-420c-9e81-d528912a3450", "value": "24576:ewHzyix5pqoZTwszfptq6PP5EJ8sBG8ETY2b9c:eo5pqoZTw+1PxIVBG8ETJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696065838, "uuid": "15a8984b-7d52-4a9a-90e0-16d7d0d69eda", "value": 1693600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696065838, "uuid": "521b7f3e-72c4-4634-bf10-75164b7c3393", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696065838, "uuid": "204d89f9-8237-4bc5-bdc5-da42b5ecdc8c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22c4792d-5fae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696091200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091200, "uuid": "306201fa-e9e5-4095-b7dd-2d7e91fc1e08", "comment": "Malware payload (Amadey)", "value": "a70d541152f32fc0d3eb5651fc3bf5c6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091200, "uuid": "e32020e9-c98b-4193-a86f-395e6138fa1f", "comment": "Malware payload (Amadey)", "value": "9db931e577909d5ce47d4ed89913d518413ebc59cbda8fe9ca8f67f5944cc1dd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091200, "uuid": "c645f3ab-c0c5-46c3-a9c2-d5837e6fec38", "comment": "Malware payload (Amadey)", "value": "cb5b96f515414c79187e845e5963c3003c781cb4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091200, "uuid": "6d69cfd9-2e3d-4239-a976-087cce16d236", "comment": "Malware payload (Amadey)", "value": "731661afd7327f60245175f148d7cbb8088b88cc8e4dc910b77874e4ae4f3f281453ab0a8e64021888b7e97959b235e8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091200, "uuid": "826cb739-823c-4c07-8397-1fdb297aab3a", "value": "T18E25220797E44073D9F5673148FF47870A327CA1A8B08B2B7B55A46E0C327A46536BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091200, "uuid": "0a4de2ad-2da3-4485-beb0-9572358304af", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091200, "uuid": "2dbbd5b6-14cf-43f7-a752-a0d7a002f912", "value": "24576:AyqaFVjvX3oyRMh/imGew4MAEdGJN1GM:Hqs93oyRMFimFIYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696091200, "uuid": "7550838a-e0f1-44cf-aa79-bbb58cb2e56f", "value": 1017856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696091200, "uuid": "639dbd42-736c-46d4-960d-bf5559bb9845", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091200, "uuid": "055e8cdc-c7cf-418f-87c9-27ece071179e", "value": "a70d541152f32fc0d3eb5651fc3bf5c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b6391c-5f70-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1696064902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064902, "uuid": "4acf1ac8-73b3-4a85-9e61-c084fe084c61", "comment": "Malware payload (RaccoonStealer)", "value": "d93a5554b0cb981e9a8eb7f297c1f5c6", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064902, "uuid": "6b184f72-bcf5-4ed9-860c-280e1ff0239b", "comment": "Malware payload (RaccoonStealer)", "value": "9fca19c2b9971c7010ed0cc99d8f9ca5fd37775927c0721ae51e13c892a58266", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064902, "uuid": "105cd935-1032-42cc-9286-6b50bbe5c9b5", "comment": "Malware payload (RaccoonStealer)", "value": "cd084bc4d30fd9065707831f0af405d28645c3b6", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064902, "uuid": "2a1e2548-803a-48b6-8388-67462d2aaed7", "comment": "Malware payload (RaccoonStealer)", "value": "243cd752f6957b6d7d37fdf6df9055d01f340a261c693b71f5b0ef6ffc853ea01f16405eee81a65e590a8d0e287a304b", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064902, "uuid": "9b3e8819-8d35-47d2-8ade-51c8e3a29a85", "value": "T192A3F1B9F4D039E8C52C6C0A17961F6903706665C086FDEB4C98D88E2299B935DF3CF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064902, "uuid": "64cdeace-b4e9-49b3-811c-cdeba07d8517", "value": "1536:8Es9iOqjx4OhT1RvqUnwsNqG79FSTvUGcLjMM748pkHiIGvpw3EmFWeBHyq:cFCZ3qUnpp9FS4jjTlkHvGvpG5FvEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696064902, "uuid": "f6734763-2f51-41ef-a4eb-228c60c7b12d", "value": 101617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696064902, "uuid": "848e90a2-a364-4df8-b99b-a4788937121c", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064902, "uuid": "fe45b5f8-2e3c-46e7-88e1-cf209d91c16a", "value": "KSPSService.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9355543d-5f8c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696076786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696076786, "uuid": "bb61cb92-86ec-420f-9128-36343bbc7402", "comment": "Malware payload (Amadey)", "value": "90fe09b98bdafcb289e69393b8efb3e4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696076786, "uuid": "2be4a81b-4d4c-4427-851a-32cd7e080d56", "comment": "Malware payload (Amadey)", "value": "9feb6a6642431a56b6699ffd28a8785e2d711c60d5c571f8030e5a52250a829a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696076786, "uuid": "72e3660a-5567-42af-b88d-7302bfcdcefe", "comment": "Malware payload (Amadey)", "value": "1e503ac3ec5576ef0c69188d6740707cd8654a79", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696076786, "uuid": "15f5ed2d-9012-4299-9157-48f70206cdc8", "comment": "Malware payload (Amadey)", "value": "9777996c88667f0777e1294eb66eb6e187a93c8ff05ff7a5cf41af08da7be2c6cf51fca490191108b5a10c5fe9624807", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696076786, "uuid": "9f201808-20a9-499e-aeab-469269128b62", "value": "T1802408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696076786, "uuid": "1fde0257-12af-4496-9a0f-2f326ae4a213", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696076786, "uuid": "9a1fa46e-d8db-46b9-be8d-ec9e6421e4cc", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696076786, "uuid": "486b2827-fe48-4c22-9990-5eb1cedd1e79", "value": 224727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696076786, "uuid": "dde7a0ef-5a16-4af8-a3ee-5a136e819b48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696076786, "uuid": "9329f5a5-0b21-4827-ae06-49ea70241814", "value": "90fe09b98bdafcb289e69393b8efb3e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dccb40e-5f3f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696043652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696043652, "uuid": "4cff70a6-2872-40e2-b7f6-c69fa4bc0cd0", "comment": "Malware payload (MysticStealer)", "value": "119aa67c40d0956aa05f231fe37e1953", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696043652, "uuid": "592b1519-769e-4416-9a12-592926fc0118", "comment": "Malware payload (MysticStealer)", "value": "a00de9822a95f9d479024444d4b8ccb2588a4a88311936d9045f57e5e235c247", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696043652, "uuid": "14c4f43f-57a2-4b33-a81e-fa1b2b4d874a", "comment": "Malware payload (MysticStealer)", "value": "060aa98d14fcc3b712c40a9467f0311b9ab2886b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696043652, "uuid": "520296ea-b639-4cf7-a007-e41123c1e538", "comment": "Malware payload (MysticStealer)", "value": "2648f02f3abab128e39cf8b01eb75761a9d5d6b4eac917b0550ea7424c4a82a27e66ccc804b1f82bc7e8033843d82a5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696043652, "uuid": "39f3e888-9ebf-4cbf-a4ba-7285f7df8a24", "value": "T1BF74BF0175908471DD72753308E39F6E463D7EAACA465AAF57A84EFE5E3C3C0C3219A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696043652, "uuid": "fe1d31f2-cb3f-45f0-a862-ab6e36d560d2", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696043652, "uuid": "74a05eb8-1767-4f79-8dcf-6d857caae7a4", "value": "6144:KfTeW/s5GqrO5aXnfEGIXWPvZAOUyAzYflwbSEukkm+vti8Vs0BC+:FmcGqrOk86xMCwb5u7motHs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696043652, "uuid": "c83bc52f-68e2-4bef-a33a-05c839b3a6db", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696043652, "uuid": "6c31468f-8bdc-4fe7-a456-d4afc180f12c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696043652, "uuid": "7db652c0-7729-46d7-9f7a-27e1076ad53e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a48abe-5f73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696066157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066157, "uuid": "bfb12f74-3492-473a-be17-e109496f49a1", "comment": "Malware payload (Smoke Loader)", "value": "2090ba619234eeee3581a9cfb1b4ed2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066157, "uuid": "ffceb5c5-e3a8-424a-81a9-966dea0c611c", "comment": "Malware payload (Smoke Loader)", "value": "a159e50afc3f7e08a37ccfd86248954d43250f89b5cdf0226c4cfd4055615b92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066157, "uuid": "a4d47791-a1a7-431f-8f71-4b600af59ef7", "comment": "Malware payload (Smoke Loader)", "value": "dcbe84cda4c5cb694580aa2b7a09556212a3f6f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066157, "uuid": "84cf3326-15f4-4f35-869c-2092525c9828", "comment": "Malware payload (Smoke Loader)", "value": "14460b84da60f139f5c7cd2698bd50c93c631259a2617f5241ee2be68b538e52593fce06e37140392adb288a96d56524", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066157, "uuid": "4a341476-eca9-497c-ac51-3291d91bb094", "value": "T1F834BF11B4D1C072DC7225360AE4DBB95A3DB8300AA65EAF67F40F7E4F34281D636A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066157, "uuid": "4f0b2da0-4f83-407b-877f-c4104aac5e4a", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066157, "uuid": "ff379282-b78f-4485-9ecc-9e4d99aa5c00", "value": "6144:Bbz4SHy5uoBMFGV5PEkIXEHvZAOkmNtnFiLVs0BC+:OCmuoBMUOMxSAnFKs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696066157, "uuid": "3443b254-00f7-4c4a-95b9-a9f114288a2d", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696066157, "uuid": "dd1eea63-ee22-497c-b2ec-bae51e619823", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066157, "uuid": "b29af66c-c422-4d94-a628-701fe4b76195", "value": "SecuriteInfo.com.Trojan.Inject4.61510.9553.17863", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af0e46a-5fb1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696092502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092502, "uuid": "5388e44e-9ab7-44ac-843d-57faa0a95eab", "comment": "Malware payload (Mirai)", "value": "015acccb473b59e2f3cafff9fe71e4ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092502, "uuid": "867f4838-bc9c-4e10-b066-964d45dcbc6d", "comment": "Malware payload (Mirai)", "value": "a2f84d2e19bf844f03cfe2c056bb10fa2502d7ec92385818205e389bc1fc572a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092502, "uuid": "c45384fb-51aa-4864-864b-8c04e314f036", "comment": "Malware payload (Mirai)", "value": "d865acd04d61fd9cea248d8224ddbaf2d870b620", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092502, "uuid": "831614f1-d338-4db4-9caa-9d6960d37fc6", "comment": "Malware payload (Mirai)", "value": "70dab11d70e6afeffe5624ce3427114403e091c7255fb4c93a719c4550862db38a55a679b55fad9cb55ca8e7432e8bfa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092502, "uuid": "b3c926e4-96e1-4dcc-ba60-3ca56d758f0c", "value": "T13DA36CC4E743D4F1D89305B5206BFB368B32E1B92129EB97D3AC6E319C92612DA0775C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092502, "uuid": "f7cfc36a-b5ac-425b-8224-f9b38ec135e5", "value": "1536:8Y+Nxne6MblcyU8+0gCwxTw+PwmKosMxvHncLzcirg0OSGWSy30PY:rWxnetbLUWgfbPwzo7HcLzvckSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696092502, "uuid": "9c075c86-7c13-4a38-98dc-32c42591f04a", "value": 104776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696092502, "uuid": "c19d7251-25f2-4ad6-9995-8dbf0b39ab27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092502, "uuid": "391cd0fa-2869-46fd-a539-149847e6b149", "value": "015acccb473b59e2f3cafff9fe71e4ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ebba5f5-5fe6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696115406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696115406, "uuid": "bfb4a6a5-5855-4065-99ea-f9784cdd029a", "comment": "Malware payload (RedLineStealer)", "value": "1f390e306d2c0aeb85fd4d20744942da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696115406, "uuid": "9f463c1a-a812-4ab2-83a0-83c907bae77a", "comment": "Malware payload (RedLineStealer)", "value": "a3739b4c9f38ee3c7c6e24f857f3a862f3342b4f4cb1b497c2ec99f1bd696e1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696115406, "uuid": "4b59b08a-7747-4de4-b736-97d05b86fd51", "comment": "Malware payload (RedLineStealer)", "value": "de9d39e3f96f4a30e8a32d6ab2b92873f1283963", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696115406, "uuid": "e9474695-43d9-43f1-9141-2b7289cdfce2", "comment": "Malware payload (RedLineStealer)", "value": "2b11ba79665f8032a8894d857432bfdd95ad3b5026d319ea750b55161559c940d18a3fb12912eb4a9c2e0e257dfd1ea8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696115406, "uuid": "0a7ad051-74d1-473e-9326-d09f05266f34", "value": "T163940202E6DC8472E8B5277098F707D31B37BD71AAB4834B33926A5A1DB32C49572727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696115406, "uuid": "4fcf209e-f7b4-4094-8a07-834e09c74d12", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696115406, "uuid": "1113897a-d009-43e2-a764-d5a0ae77f186", "value": "6144:KAy+bnr+Rp0yN90QEn4MV0rN5J2nMTSkKejLAfItP9srTrJnLVP0hfJaRt:wMrRy90p5arN8ejL5PirHJLVchxar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696115406, "uuid": "cce061a1-68a6-47b5-93c0-e317dc9ec008", "value": 437248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696115406, "uuid": "616e9f17-ede2-4e6b-88ed-c553fbdf826b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696115406, "uuid": "646460af-fcd9-4d82-9faa-b431e9e27079", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413720e1-5fb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696092110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092110, "uuid": "7465582c-1da2-4290-8655-3338e6ab0148", "comment": "Malware payload (Mirai)", "value": "2819b358587289f06663642aa46762ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092110, "uuid": "7a652fd9-bf44-4d90-a0d0-d84a3a3de62f", "comment": "Malware payload (Mirai)", "value": "a3a4d17edfe6dc5de389d69cd233600ef8541c29b8b411fa09c0abf7ab3308ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092110, "uuid": "7f498d07-6170-4752-9bc5-5c9bce5554c4", "comment": "Malware payload (Mirai)", "value": "8cc06212851708abb9562e4cb274e47be70af840", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092110, "uuid": "5812256b-0abe-4e68-9eb0-bb5f1bb78aa4", "comment": "Malware payload (Mirai)", "value": "be4f99f6c40125d6e673875f1556a3995cd00b86b779581db0b1845a9c80a53dae3343cc07b996b8f5181319be33e0fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092110, "uuid": "c5db675d-09fa-4030-92ec-22e57041fd7a", "value": "T125E33BC7F800DDBEF40EE73648534905B630BBD115925B37229B797BEC3A1992863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092110, "uuid": "8da878b5-fd9d-43a1-9639-e09b67fe3b37", "value": "3072:uq/F++xiN9WMVR/4EzLGkefhAmdUM2lA3VBjbihLL0tyGk0FUT:VRivGkeJAob2lrLUyGXFUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696092110, "uuid": "7755b466-b4db-4b3b-9279-83e5e531e62a", "value": 157024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696092110, "uuid": "f9c90dab-8a61-448c-b5ea-a93f2ddb2648", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092110, "uuid": "508e57ef-cd22-42bb-9888-83448808c07f", "value": "2819b358587289f06663642aa46762ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0e49035-5f74-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696066582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066582, "uuid": "f1978683-2a40-4353-996a-d335fcf14599", "comment": "Malware payload (RedLineStealer)", "value": "f57a6f5003a0e82e4e2b18fccb0e433c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066582, "uuid": "4f9fb8db-ec77-4265-844b-6cdad50f9a78", "comment": "Malware payload (RedLineStealer)", "value": "a401c83dbfbe1a73d9afa2a43ccdae72cf83f7dd76b823ae6700c41621dff50b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066582, "uuid": "e68d2a10-7442-4562-b0ab-725f414aca7a", "comment": "Malware payload (RedLineStealer)", "value": "5fee5bb53b18835101252be8ba0893b8e43397c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066582, "uuid": "062fb881-a7c5-42da-89ee-cc66c17ddb1d", "comment": "Malware payload (RedLineStealer)", "value": "55d90c857f10086892107b3bcba4a7921eb1e1c9dc1ac47aff64df401660d32075cf500cb7e4ea725841393d6df1efa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066582, "uuid": "5cd15553-d4d3-4beb-be4d-f82668c85633", "value": "T155352317F7E88073E8B8A375ACFB03471E357CA29A7C976B1A52995058730449432FBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066582, "uuid": "e5835d9b-d8fe-4054-ae28-8c6453da6285", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066582, "uuid": "33773b1e-2fca-4401-bd98-26e2c982b509", "value": "24576:VyHLWXOKeT95iODrxJWPkGz9ec71kuQPD5fjwH:wIOpKODrSsGz9ecZKFfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696066582, "uuid": "2faeffb6-2b49-4660-a39d-1c55615b1943", "value": 1096704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696066582, "uuid": "b26c2686-22da-478e-b30e-a3c5fba4498d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066582, "uuid": "091fa927-3715-4c18-930c-cb5bbf6e9194", "value": "f57a6f5003a0e82e4e2b18fccb0e433c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6198990-5fa0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696085408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696085408, "uuid": "79b14f28-0426-43e0-9b26-694606e72c6c", "comment": "Malware payload (IRATA)", "value": "c5f4520e805dcfe56767d96bbad23ff9", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696085408, "uuid": "378185f4-8c8f-407d-82a9-2134b83a2cb1", "comment": "Malware payload (IRATA)", "value": "a4bffa57ce3acf47c56cf57925cc617e4537515535b3fe513f0a2c8a5ce530e9", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696085408, "uuid": "56efd892-1727-4799-b3fb-bf980e99a45e", "comment": "Malware payload (IRATA)", "value": "17b9d4a5fdc42416095b46ff6091aa15d45716eb", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696085408, "uuid": "26c75e60-6135-4f17-aa35-66960afabf9f", "comment": "Malware payload (IRATA)", "value": "03be25877de29663b5817955fa5088579251a76ef7274c77d540021584ea3cdd15fe910aaf0af06d6f6fc519dff6dc6e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696085408, "uuid": "98a72952-55a4-45e5-99b5-2d284b47538a", "value": "T1DAE5BEDBF7E8592FC87750B288AE52B1625B4D028E839F476C443B1C297B5D81F49BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696085408, "uuid": "31c0a0eb-f99a-465d-a1ce-3ac3ca624049", "value": "49152:uCIBlTkK3mPGdBxuxtkN3fhIGFDTAKZNjU9U2Fjnyryd79p+MgLCrgnDrs:kh3mPG/xHfhI+HtNU9UUGrAgLCrgnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696085408, "uuid": "8712d7f7-7066-4e0d-a0e9-b3e1b9115839", "value": 3228173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696085408, "uuid": "cbfbec47-0d49-4647-89ea-79cfe4a71099", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696085408, "uuid": "a74bcedf-4300-416d-9abb-c4a5cffc8018", "value": "app1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a572ab-5f36-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696039848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696039848, "uuid": "1b08f38a-8c8f-4536-9ca1-6e9762f43d69", "comment": "Malware payload (RedLineStealer)", "value": "e7571048d7e6a65650a31788373fd8a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696039848, "uuid": "f4792ba2-6bc0-48de-8160-126471854c06", "comment": "Malware payload (RedLineStealer)", "value": "a4d55591c20937f0d8f1bc90975f88d98098d780e259e23f489aa1c4b486fb18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696039848, "uuid": "b20c7893-90c2-4350-9941-3388b96a04f3", "comment": "Malware payload (RedLineStealer)", "value": "6dc8e85f11d9396270f3fcda7a7d0f9a1c208dbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696039848, "uuid": "6f034a11-4512-49cb-9280-942511dae840", "comment": "Malware payload (RedLineStealer)", "value": "ba77f29e3b6f386e42b883a018db1dd552ef3b76414bec2d2b43c0d58513d2af0a3b52fa13dc272c072327b15abdd979", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696039848, "uuid": "1ee2d55b-b3b6-42b2-87f3-eb91782d56cc", "value": "T11F34AF11B4D1AC72DC7225360AF4DBB95A3DB82009A15EAF67F40F7E4F34281F621A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696039848, "uuid": "79f5f102-0240-413a-b891-1df11ed0e1d0", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696039848, "uuid": "b0aacadc-5628-4028-9a4d-5eb1d66bb91d", "value": "6144:bwz4SHy5uoBMFGV5PEkIXEHvZAOm425eYsVs0BC+:nCmuoBMUOMxIPEYos0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696039848, "uuid": "33b49d73-2b73-4324-b710-f2b38e60cbba", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696039848, "uuid": "8e010370-bad1-4053-82a0-9e4fd987e341", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696039848, "uuid": "5c5e9f70-bc13-4362-97e3-36f14e8ab6fa", "value": "e7571048d7e6a65650a31788373fd8a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f47dc437-5f8c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696076949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696076949, "uuid": "388d4512-7758-4012-bf1d-3810ca429da2", "comment": "Malware payload (MysticStealer)", "value": "ee34268c1f6bb64acbc91ba24d7dba85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696076949, "uuid": "b7c3dc12-8f07-4dbf-a07e-233e9237a7a4", "comment": "Malware payload (MysticStealer)", "value": "a4e0f66c32f30cf5e73c0ceba8b5a90f007f6126594d3475c86094d850761d66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696076949, "uuid": "3460b411-1a93-4e84-a166-60b361d0f429", "comment": "Malware payload (MysticStealer)", "value": "4b8faf8e4851570331e3fae98745501ea14e8a6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696076949, "uuid": "f78d915a-42ed-4422-ab00-9de7dcafcb38", "comment": "Malware payload (MysticStealer)", "value": "56ff0aa9229787f47bbfef6117a8de68c2c5d885f537fd536a7a0d85835222aebbac26da1419f847b669af0b8cb590b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696076949, "uuid": "4c2bf5a7-dc11-4a96-9ba1-a6f2ed51e446", "value": "T1B174BF8478D1C4B5C9B223374E90AF7C152D6CB54A674A6B33EC1FBE2E707C0D266166", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696076949, "uuid": "3984050b-91c1-4bf8-ab58-1622d83ac88d", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696076949, "uuid": "60b83459-14dc-41b8-bbf3-fa65fe940a32", "value": "6144:EATeW/s5GqrO5aXnfEGIXWPvZAOZynlZO1zrd4T2scpAuRBqXzE4+WVs0BC+:wmcGqrOk86xKlZNak4B+s0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696076949, "uuid": "becc7981-5a11-4f73-b3f0-56fc7d363fa7", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696076949, "uuid": "0fda552e-822c-4a85-8392-521f1af051ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696076949, "uuid": "c95ac6bd-d252-4cac-86fb-47e1edf7bd32", "value": "SecuriteInfo.com.Trojan.Inject4.61510.4965.4257", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "107939c2-5fb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696095465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095465, "uuid": "ca538ff5-68ad-4cd4-afb1-73a9d8f11a61", "comment": "Malware payload", "value": "0801012cc1d145b53cc30db0d3ddc064", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095465, "uuid": "eac0d4af-ce3c-43ef-8816-726c13dbafee", "comment": "Malware payload", "value": "a59d10a317a779ae0c8f99b5e62719b1c150d7c3709d38764be50f450ccbcfbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095465, "uuid": "47c86399-1d86-42f4-abe3-a0b0cfef0500", "comment": "Malware payload", "value": "815f793f3276e9362b5ee74d65a7bd782e756ccc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095465, "uuid": "d241f52c-4309-4649-a081-13c9db947a6f", "comment": "Malware payload", "value": "bf35cdcfa4cec24403394105f716d00be2d899b883c0a23280cf27386acdcdaf280922adae395fe54c3de5d7d43be11c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095465, "uuid": "af494d03-f431-4e9e-8188-15191e246897", "value": "T11B159E8676B3C4B1D4665A3187F393BDCB349EC50A36C7836F90EE0588F11A0BE165AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095465, "uuid": "1700f90b-5eb7-4a4e-8f05-c305ec18400e", "value": "24576:ImMC6IfgSRdPdduRtaqHWu4EkTqT4bKwQqXb:NEIISDETgZQGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696095465, "uuid": "474361c7-c1c8-47e1-96d2-09c829709005", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696095465, "uuid": "5752a5a1-2f48-435f-9ae9-c4ec360bf2ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095465, "uuid": "be6e8911-4211-4273-affa-0f552c397fdd", "value": "SecuriteInfo.com.Variant.Lazy.350581.27345.115", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6d0a96-5f95-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696080561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080561, "uuid": "d27ef58e-cb32-4d3d-9766-c942f2696dc3", "comment": "Malware payload", "value": "21e607a621c1d322ec989b1af7bb6b9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080561, "uuid": "b7391ea1-b580-4a5f-8115-887679f85f89", "comment": "Malware payload", "value": "a5c2b18cb765726b1cfaaed30bce6cb8a34da6ddb7c3b3fe52f0a21235b9675f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080561, "uuid": "51e95061-8df2-4376-803a-111789d4a419", "comment": "Malware payload", "value": "3540cb4f339ea6b71fadce766191babcc979bb5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080561, "uuid": "8d51a653-76a6-42df-b465-a264c9ab7c6c", "comment": "Malware payload", "value": "79dc923cd7089de6aaba2044969d3c7db318b82c0f3c40c615e08b342f3ea7119f9c842bc5cb7db167b50602c06495b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080561, "uuid": "3f98f8ac-0b73-4994-9e92-432884edbe04", "value": "T10AE39E0FAFC1C421D9C1237200EA5BB5EF3BE174079AEB87A779C9755D124E6073A886", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080561, "uuid": "c91e5a89-a42e-4119-90d2-dd241bd56a51", "value": "768:qcDwwwwwwBwwwwwwwmyYGcvFWW8bZDOpaY7Z4KFj5bge0Wem0gOBKFNc0l8QE/Yc:qJtbz6yYB8u7E2YmuTTQDeeXUpksR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696080561, "uuid": "3c5902e5-6cee-4e51-ae2e-ccc01cf12ace", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696080561, "uuid": "073b4c7f-a33b-4553-8a0a-acf5406fa261", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080561, "uuid": "042d833e-68c2-42e1-b07e-52c2c70ef8af", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.9357.6538", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112baea5-5fb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696095466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095466, "uuid": "326394d2-9834-4c37-8cc1-c97da89ebbf2", "comment": "Malware payload", "value": "a12783ccfcf69af359849947250cd605", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095466, "uuid": "01660efc-7571-4f33-b920-bbc5593689e9", "comment": "Malware payload", "value": "a6192b8cb9d7a8930ab5575b00b7d05c973984fd0b611334e30c70c5e171b5f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095466, "uuid": "433ae622-ed1d-42ba-b274-994f87a7469c", "comment": "Malware payload", "value": "f638aaa90ee1bbb01562b53ba4f91d66fc072b38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095466, "uuid": "ade98192-5c58-4193-9d18-8603a30d45b2", "comment": "Malware payload", "value": "6daa405c7683030e7079855bb9b9fa580a318d207365e8523b245f5fef64655d7107edc634ec5feebb3773457bdc8593", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095466, "uuid": "2f4a523b-170a-455f-8550-3de0d2f37939", "value": "T11A55073172D6C4B1D72976339D4EE238482EFEB38958F2577324ED79887E2A0C42A355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095466, "uuid": "571fde8c-c69f-4e97-a20d-7e12e97aaa49", "value": "e20fd6d499a3e7eccf0dca08616e8254", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095466, "uuid": "b2ce7da7-5b51-4029-9abd-846134880a2f", "value": "12288:pP/5Nspt774ynTfjNDZNgs63hd2B6m9V7sCcvE6iDqQrMTTyq:pPvIjbNr63hd3mkpvEFhY3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696095466, "uuid": "90a6b710-fe15-4f50-aa1c-469bc8faded5", "value": 1286144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696095466, "uuid": "4b88c7db-647c-4451-9d1f-241d11dda3f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095466, "uuid": "932d7727-6a28-4d3c-a6f4-bfb0fc77b8b8", "value": "SecuriteInfo.com.Trojan.StartPage.55612.23300.9913", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855f99d9-5faf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696091795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091795, "uuid": "e6617c6b-31ea-4a72-a829-dcf272983619", "comment": "Malware payload (Mirai)", "value": "068fff4ee2082dd21bf45bdd443e848e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091795, "uuid": "ba683046-f738-4d34-b03f-aaca3a4278a9", "comment": "Malware payload (Mirai)", "value": "a6769fd3ff05234dcd78d5705848b12b84c4214032063a0d06afe7187fb92a3e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091795, "uuid": "aa63649c-751d-4e5c-8f3f-9e0807f938c7", "comment": "Malware payload (Mirai)", "value": "0002330aaad97c7830b82717bc01f2ec4a99a781", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091795, "uuid": "7f146768-ee1c-468a-a3c7-4e8932a6b6e8", "comment": "Malware payload (Mirai)", "value": "d87afc1cabef26fc109909dc0908e159eb48c3ad9476d01fe6276f553efd319424294c68ad19cde5bf9a58ad397cee31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091795, "uuid": "0f0709d5-a059-453b-ab89-de8110fe4875", "value": "T1F463F6753945F2ACD6E94078F4436EE91E5209283EDCD1E36083143BFF71B88A62DE5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091795, "uuid": "a1f957ce-4f7d-4668-9ece-be1b187442a6", "value": "1536:RWq4mXBnUM+mxqIK+HIZVBIVCCfy0K9UwZ:tUM+/Iiun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696091795, "uuid": "6b70e0a0-6241-4681-8f25-ffe72bb2afd1", "value": 66944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696091795, "uuid": "07806aa2-a847-41ae-9f6e-8dc7f3e5cef2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091795, "uuid": "695157d5-2107-4b71-9633-66ade76d3ee6", "value": "068fff4ee2082dd21bf45bdd443e848e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c23ad33-5fb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696092102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092102, "uuid": "a0d20eb0-39d5-4bde-abc6-93e4bf458371", "comment": "Malware payload (Amadey)", "value": "6828e2a39ac159ee24d8bcb13ad6498f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092102, "uuid": "2af88889-1f00-4e46-8971-bb8f180631cb", "comment": "Malware payload (Amadey)", "value": "a6ec6650f4099dac6073dfa05d58623efa389f473149c460be7a1c6c90ae94b5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092102, "uuid": "397f35e0-cd02-48eb-b14f-956832616b13", "comment": "Malware payload (Amadey)", "value": "b1c8875d86cb392c13ec33c501aee1a08ee97c13", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092102, "uuid": "e29c3592-6202-4186-807a-493bced8590c", "comment": "Malware payload (Amadey)", "value": "f8996bf886f06ebcfdfebb91ffe3d7119a47b30574ab875c565d1028285124bd3fc0e5442723a6133775a2bf77e005c9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092102, "uuid": "54dba258-1cf6-43a6-a48c-6adba399bfb4", "value": "T18E252321B7D8C032DCB4377049F947430A387DE58D74836B2B966A9A0DB36E0B67536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092102, "uuid": "247552ed-7f00-4629-9faa-1928881491f8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092102, "uuid": "9f98d727-59a4-4e8d-991a-ee6d54c7b70a", "value": "24576:DyT0mRUH6WBf3AlZ9vXJ/Boi3tjhFaVbv:WFGjBgPBBoidtQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696092102, "uuid": "f1e52231-3b59-4646-b39d-e10447a4ea25", "value": 1017856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696092102, "uuid": "25c63627-b9fe-40df-8b01-ce458e7598cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092102, "uuid": "c0fb6efa-3938-447d-bb97-2a8b36070aac", "value": "6828e2a39ac159ee24d8bcb13ad6498f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328d3ae9-5f2e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696036251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696036251, "uuid": "a65b08e3-288d-4ae4-b9a4-d3572d874b41", "comment": "Malware payload (Amadey)", "value": "eeacddb883c73f4e22781b88dbfb5b3b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696036251, "uuid": "3e38d5b9-1e1c-4529-8302-8153fd368426", "comment": "Malware payload (Amadey)", "value": "a7f449bc49be6f53213a078f41a3f1b222febee4a1bcb9c6d7f8fdddee03bad9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696036251, "uuid": "124551c0-fb65-4534-8f7c-2a6a125e9463", "comment": "Malware payload (Amadey)", "value": "a5d7426e70b412785d331fc96273ea4b1d987cc3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696036251, "uuid": "aad56854-bda8-49d2-ae33-51271075df66", "comment": "Malware payload (Amadey)", "value": "166428fbe2735321122ce1c1aedabada9121c7f961905d2f12a98fcb8f2da4a5bf2a9b677d4e175e846444e3f597e65f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696036251, "uuid": "f3484945-c1c4-4ae7-adbd-30f09f907021", "value": "T152151212D7E48037C4B56BF008F206930E39BD759978C79B6784A96B1DB3184B6327BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696036251, "uuid": "838a6c51-a718-4d63-b9e6-9401b102f5bf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696036251, "uuid": "2d3b100b-8443-4445-be6d-14f7558176e6", "value": "12288:YMrIy90jM4BLFyCmkb+iePQUprgyb+mfT/myMJdhSiG4gJgQLUmUPkerkxiexhik:gywMA4Cx2YUprfRfTOxDxQL/2kxieF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696036251, "uuid": "7c035a36-d41a-4300-b592-383c839a492f", "value": 886784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696036251, "uuid": "d8d8cfe9-5c3f-4230-8f63-7d04f4bc7489", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696036251, "uuid": "6c7aea5b-aa30-4197-9b1f-050df0489a79", "value": "eeacddb883c73f4e22781b88dbfb5b3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056babfd-5fb7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1696095016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095016, "uuid": "7c5b6c78-e41b-4fa9-b93d-fff254cc74bd", "comment": "Malware payload (RiseProStealer)", "value": "edc8797c0ae093272b29dfc12b4ce835", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095016, "uuid": "f1a5328c-7371-41fe-a897-5c4266b6ef68", "comment": "Malware payload (RiseProStealer)", "value": "a8749f5edc0803c81e28c6ccccac7591f0ffe24b1478936b088ea770bc4712b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095016, "uuid": "c079135f-5029-4f5e-8c31-733ae60f9191", "comment": "Malware payload (RiseProStealer)", "value": "5912c2d790934229e2a4a2d272d93b020c4569f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095016, "uuid": "c6582595-beb6-41d8-9b5d-d53a99e0ecef", "comment": "Malware payload (RiseProStealer)", "value": "96788f8190975fab48803c477c34491c9304c70d697d23f896097aad59a096043afec870b99de44e4e47ec863a9ec678", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095016, "uuid": "676c2e0f-75fb-4e96-bec5-9e45c781e142", "value": "T19254BF2362E17C61E567AB72BD2EC6E87A2FF451CF59675E32145A2F09701F2C223312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095016, "uuid": "6f9d19ec-97ee-44fe-bc6a-25db30210b3c", "value": "d323d1063364fcdde3ec2d7fc616011e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095016, "uuid": "bee7caef-4bd7-4af3-b477-5404d7199dc7", "value": "6144:cAJcXMlLF5As3xqVkDvAnjj9KAdnyaUxW:cAh5AoqWkj9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696095016, "uuid": "2b8610bc-051b-436b-9498-75310b7e8f62", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696095016, "uuid": "57b05d35-d8db-4ce9-8804-eb468343896b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095016, "uuid": "51f4bc46-9c40-4787-91e1-291b04a65cf4", "value": "edc8797c0ae093272b29dfc12b4ce835.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a41515-5f34-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696038947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696038947, "uuid": "e836b49a-527b-47ed-8c4b-17ccff542040", "comment": "Malware payload (Amadey)", "value": "337a9c771c28356f27ecf417b3a94371", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696038947, "uuid": "f156c5ed-98ee-4020-8514-e56856bd75be", "comment": "Malware payload (Amadey)", "value": "a8a25f29d48c15230253a7f2b162d69c6a662901dc781bc73e4df72d906c8bc1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696038947, "uuid": "31d4a2ff-07d8-455a-a5c0-69cfc1178f68", "comment": "Malware payload (Amadey)", "value": "897f015c5cbc1c93a422ed9ebb9cc05a962e1f12", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696038947, "uuid": "f9cefd01-c933-4051-b116-7281aa59aae5", "comment": "Malware payload (Amadey)", "value": "679268f46be4322f9408eb283ffb08839868fab6702b750f80ecae307295cab8f9ab9580dffdd4e97477877ee94a5aae", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696038947, "uuid": "b3d39315-8ce9-4a04-936f-2c7e525c2cca", "value": "T1C2352307A6CE546ACAB263700CFB17D70B3A7CB18DB543E76346D85A0D72A80DA31767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696038947, "uuid": "6cef93ee-dd96-4857-8b23-0ead37195a63", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696038947, "uuid": "d109de05-c2fd-4629-8ae3-dcb33b78ec9c", "value": "24576:TyrM1iBbirTfktumb1UIUos7SV/X6d186:mrYKQOunDSV/X6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696038947, "uuid": "5f36d19c-ede8-477e-988e-f84f1a6b4037", "value": 1100288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696038947, "uuid": "1d750947-e9cf-42dd-a0eb-04e82b6abba0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696038947, "uuid": "e8b9b3fa-0423-4db8-9093-51a9d12be68d", "value": "337a9c771c28356f27ecf417b3a94371.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3738fa10-5f6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696064176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064176, "uuid": "f7fbf0df-ceff-420b-a4ba-063f9679ec21", "comment": "Malware payload (Amadey)", "value": "129124d64f772b975ef4098d038523d4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064176, "uuid": "3356f2e6-abc3-4385-bfa6-207602991448", "comment": "Malware payload (Amadey)", "value": "a923351b49a6a70bbae58677ec113711a5de437132f0ba7677b3b0eaf15b3a02", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064176, "uuid": "3bf19951-b4b8-4481-b33b-22e96611c40b", "comment": "Malware payload (Amadey)", "value": "fee7911f19e9974bed2a00cdbbc972d25284129d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064176, "uuid": "337c9cd9-d6f2-4604-9660-879ef624d67c", "comment": "Malware payload (Amadey)", "value": "880559becbdf1744961c5c5e7b6f9a4155619b3151a37139995c9620eda7f8d5d656c0b5b3a2e5da71c3137e5037b8a5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064176, "uuid": "78627b2f-b601-4c9b-9032-1180f99179f5", "value": "T1652408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064176, "uuid": "41ddfd02-3007-4015-85af-64111bbb670e", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064176, "uuid": "2074c204-a373-4f04-95fa-6efdb0d388e5", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696064176, "uuid": "2ef16036-aa73-4ad4-9634-7c5cbcce3f60", "value": 224602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696064176, "uuid": "645fb236-5efa-4272-aa26-39771618c1d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064176, "uuid": "9cc459ba-9cc8-4a42-9e75-732b4a4af570", "value": "129124d64f772b975ef4098d038523d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4713adb4-5f9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1696084389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084389, "uuid": "42399dea-0710-410a-9a2f-6fecd0f9ea19", "comment": "Malware payload (RaccoonStealer)", "value": "952a26231656656a90a60e11db960ace", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084389, "uuid": "4148e4cc-6de0-466b-aaec-a2ee6611894c", "comment": "Malware payload (RaccoonStealer)", "value": "a93534a4e4b8d9ce1a4d0450c32e1d92260564d5de9124a7ad1c3dbe9b4fae14", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084389, "uuid": "859768f1-175c-4510-9f5f-7760ca58b43b", "comment": "Malware payload (RaccoonStealer)", "value": "8ce3592c572d7bb03f14370c26f0e4df9fe62028", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084389, "uuid": "fa43fed7-d653-4161-b0bc-179663d7e2ca", "comment": "Malware payload (RaccoonStealer)", "value": "da7ce878fdde93b99b0f40cfe3e4b03dfa37b89ee1e09bc0cf9e92a3a21a4705739ca372a9c2d8432a96c0869df75b3b", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084389, "uuid": "ccaec60a-b8dc-4b4e-a34c-e36cb7ec3228", "value": "T1744438116D818062E1BA1A30E5BC7B7159687FF80B3084DF53B47E2E3F752E2A535B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084389, "uuid": "583a58e0-8f0d-4bfd-bb59-8d2284a2c779", "value": "959a6730bc071cd048c8e4c56109bff6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084389, "uuid": "b522845c-d84b-42ff-858b-5e0997c7c444", "value": "6144:g9+qOLo0jhNnMGmmUEebVF+rgn/6GM6wW:g9+pLPMG5U/argtMzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696084389, "uuid": "1ffc489b-b1f6-4e88-ac4a-cd5445e90a3b", "value": 268488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696084389, "uuid": "5ae570c4-e7a7-4376-81e5-f53ec075405a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084389, "uuid": "d4eb395a-5eda-4323-82e5-05d63ad2bd52", "value": "UpdateCertificate.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f907d991-5f37-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696040450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040450, "uuid": "adbe490d-1998-41be-a7f1-5ff5c3c4fe56", "comment": "Malware payload (Amadey)", "value": "7867aaf4ac16e8d37a52590c52f2b234", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040450, "uuid": "b2adef6c-7143-49cd-a8e4-1978ae350525", "comment": "Malware payload (Amadey)", "value": "aaadde61ccb713ba1d6396af26b6a16f94df8dc035712a85653650f8ecb6c8fe", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040450, "uuid": "aaf3b68b-4220-47e7-bd3d-b4f76d54ebfe", "comment": "Malware payload (Amadey)", "value": "2780a78b08d6c490475c67e886cd442130025927", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040450, "uuid": "d6bd9dbb-6c74-44af-b7a1-d0a0fa50177a", "comment": "Malware payload (Amadey)", "value": "e395c6b24c3182d3a2abaf98688a4169dc17051ced18d1cde4fe688b3cdc7bd472ab2cc2e610472db2d70b24e8e61b76", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040450, "uuid": "02a6aea9-dda7-4005-903a-eb79cb5b4aa1", "value": "T15A352312B9E48473C8B223B0A8F623930B357C63DDA8A25B7B556D4E4CB3510997637E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040450, "uuid": "6f7c6b06-20a4-484e-a1ca-c9e4c06e4666", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040450, "uuid": "0dbcb2d8-a322-4ded-a542-82e3ae786631", "value": "24576:8y78TyHFnkiQWUqV717seM0FWajzs9qmqCOkhmdi:r7cyiPHqdBseMIWaZmqCOko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696040450, "uuid": "ec5499f4-faf2-4f06-99d0-b086967a2450", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696040450, "uuid": "d7ac4ec5-70cf-4481-89a9-1490af1209c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040450, "uuid": "6204d571-a832-463b-a073-d50d9a10fbcd", "value": "7867aaf4ac16e8d37a52590c52f2b234.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ea1c0b-5fae-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696091202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091202, "uuid": "8c511cdc-c2b3-4221-9b9e-17540623c3b9", "comment": "Malware payload (Amadey)", "value": "a0580871ba67c753040a4d3e0ecc4e49", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091202, "uuid": "051a0b2f-d46d-4bf7-804a-2a34c50ceda0", "comment": "Malware payload (Amadey)", "value": "abe398bee1f32230ebc939395ce2a7e1c959f1ac2acbc7bd281941ad53ee0836", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091202, "uuid": "0f561510-44bd-4bf3-b994-d1169a883ddf", "comment": "Malware payload (Amadey)", "value": "29a26cac8517e531efb18723c8c801d87c069235", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091202, "uuid": "b2844d89-087e-4360-bacb-7ecf1ba1e77e", "comment": "Malware payload (Amadey)", "value": "182851da5513ad764cc2627493ac33ec7fac5dc832d7bc6c786c11c18b0e1a2653a6a407926a1298353de1d69a55f7d4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091202, "uuid": "bee1ea68-3e73-4709-bad3-d49e2cf76f99", "value": "T1602408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091202, "uuid": "4a569f2a-38c0-4c93-bb40-508241f6ff94", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091202, "uuid": "175a4d3c-99c6-410c-9e23-2b4c1475461f", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696091202, "uuid": "ef5834a0-ff28-44c7-8179-fe23cf09b759", "value": 224374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696091202, "uuid": "3bbea098-5ce9-424b-9197-8d27fd715caa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091202, "uuid": "4f2e517b-bed9-422b-8bf6-be43a13e03bc", "value": "a0580871ba67c753040a4d3e0ecc4e49.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31a8166-5fc9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1696103012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696103012, "uuid": "34884665-dd48-4db8-a217-6400e15bdfd6", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "261ee90dd6e88975f919b249e2ff788e", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696103012, "uuid": "837ff793-bb5b-4d65-bf59-2be50647d057", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ac8ff52cb62090f12549de17ef1c720764e8c2b564ba480da40a65ce6b7ba256", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696103012, "uuid": "201e2bfc-51fc-4383-b66c-aac659314612", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "2f4cb5724d8532fb0597b5e08e004fb327c8969a", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696103012, "uuid": "26ac2290-f4cd-4392-a573-8fde2290f341", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "8253216e007292133b75f4d02043cd4b53687aac5761e373258d9ab5a0c63eb9ce16a7686ab31d81d22300e9c83a3ad9", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696103012, "uuid": "139d8416-ab3c-46ba-8484-5686f68f45cd", "value": "T174940292B7E84073DD7827B018FA07C30B31BCA19975875F2B59588D5CB32A5A47633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696103012, "uuid": "bc44ef80-466c-4a06-93b4-8a011a31048d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696103012, "uuid": "d9abaeeb-bbc9-4262-bd69-892b723c44a5", "value": "6144:Kby+bnr+rp0yN90QE2ylxdUL6k9dBsVmB348X3cXbebkjRjBmYCrNTGgxOVU:hMrzy90wylrUL6k9dGy48nbgj6rH4U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696103012, "uuid": "d1f7839a-d26a-4595-9f41-6efe9b985a33", "value": 436224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696103012, "uuid": "466d4049-c343-4ab7-8910-3f4a1215d847", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696103012, "uuid": "cbf6c7b6-97b3-45f5-8b82-755b882d0dde", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b68f7d-5fd8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696109397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696109397, "uuid": "27839cb0-92a8-4b37-844e-db8850135492", "comment": "Malware payload (RedLineStealer)", "value": "eff23844701b078b57e2e8a50b0be864", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696109397, "uuid": "5b7b4b35-342a-4b4b-a96c-9f587477680d", "comment": "Malware payload (RedLineStealer)", "value": "ac9fcf3216053bfe19fd248a87d53f7e84ccb8534a5b72f01f6b2312437ffa05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696109397, "uuid": "e8a8b825-3884-49b3-b247-4d397e47d7f7", "comment": "Malware payload (RedLineStealer)", "value": "3a112f4d66d9600ca83e06fb0f5534680c1dbea0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696109397, "uuid": "76111f68-4f9e-450c-8df0-1c164daff430", "comment": "Malware payload (RedLineStealer)", "value": "787a0012dcfe923ef3574bdd164a862ca2de5c92df772c947b09083a8dd8e65c07197f7944a11bd6b6504dcd3e59edb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696109397, "uuid": "8c190ac6-3142-4506-bb29-727d4ffcc279", "value": "T131940142E7E54573DDF517B018F702830A3ABCA14D78D72F36A5A81E0CB2694A53277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696109397, "uuid": "775ec741-830e-483c-9dd7-cbae7b645846", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696109397, "uuid": "148efef0-3061-491a-ada9-1c32d699895b", "value": "6144:Kfy+bnr+Yp0yN90QEQulq82bzAWUTeeH9tK12yeRl8BJxADSBJ78C5wL:dMrAy90quFq0rTrH9Ff8BJJyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696109397, "uuid": "f3369cea-5686-41ac-9d9e-de77b189f7ba", "value": 437248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696109397, "uuid": "c75f788f-041b-43a9-ba67-3afca8af81f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696109397, "uuid": "a8178ea2-6b97-437e-999e-6e6053c657be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640d09fa-5f4c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696049219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696049219, "uuid": "54909e14-55ef-405f-96eb-38a8e4677793", "comment": "Malware payload (Smoke Loader)", "value": "7737794b0d9818f463ed522e2cc498ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696049219, "uuid": "b4f7dec7-516a-4b97-b980-97c01a4074ad", "comment": "Malware payload (Smoke Loader)", "value": "ad8b49621e35dd571c0d887af8c026f64b74b48ec1584e64844f83de023b6e96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696049219, "uuid": "ffc630b6-2d29-45ec-a687-c0a7cf337daf", "comment": "Malware payload (Smoke Loader)", "value": "0b6b3d0e71204d0b0b8f3fb78eaed89afb3e9d0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696049219, "uuid": "925bd04c-b215-41a2-b802-acff5576b594", "comment": "Malware payload (Smoke Loader)", "value": "3a706bc7afe28a618c258a187eb841325b6923f2a9ccaa2b380a67821eaa64dc987e0cc3b4bdf926a499a077242f1389", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696049219, "uuid": "9178f0e7-3d9f-4860-8903-a8bf0aa7532f", "value": "T1F3349E0A62E1AC60E52746728D2EC7E47F6FB4618F792F5B23045BDF1F721A2D262701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696049219, "uuid": "18daf4fc-afda-42c6-87b3-65915fb9da77", "value": "a59b93a815ea9713a41e16c8d0248e4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696049219, "uuid": "3ad2ea99-1b56-45bd-8f5d-be96989d1a99", "value": "3072:7XrJI3fU9GXMUNW/p52ljOnap5OGIdooxLg6528TxTZYT8p:Td6LXMxR4OnwO4oxiExTZYT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696049219, "uuid": "fbb52fb5-1c2b-48a2-843f-84f50af841d5", "value": 250368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696049219, "uuid": "1f29b22c-0a69-4fb7-ab10-2177db411252", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696049219, "uuid": "8ea15e9f-ae92-4216-94f0-08bd85970737", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475e278f-5f94-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696080095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080095, "uuid": "38855dcd-0c00-4de6-a0ff-9f1a32513d70", "comment": "Malware payload (Amadey)", "value": "96b17e5e2a2db276394f002907ae8237", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080095, "uuid": "fbf3df66-74ed-4d91-bc2b-3717cfb92664", "comment": "Malware payload (Amadey)", "value": "ae910681dcdd265577c2be72470a8428f802c6cfebad53335517c3e34bf4f968", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080095, "uuid": "35484e02-184e-4d84-957e-0c6e78a61daf", "comment": "Malware payload (Amadey)", "value": "bf85e766b295774e7062dd60d44373af00524add", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080095, "uuid": "18e3ad1f-67b5-4aae-ac20-4381f67f262c", "comment": "Malware payload (Amadey)", "value": "1b4e522d8da0b409a71d045740afc5243e50ac6216132cd42d9d2560a8be2c26075ee42673523d226d40b01893d5647e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080095, "uuid": "63d5e047-b0b3-4ba9-9b15-927c19526680", "value": "T1282408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080095, "uuid": "862d6a1f-529b-47bb-990f-a7bdce0f6a4c", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080095, "uuid": "aa1cc2de-b831-4c25-b889-41cb18e1071c", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696080095, "uuid": "77a44ad4-353f-4480-98b3-0566dc3c04af", "value": 224277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696080095, "uuid": "9b3ad802-a80e-4901-9487-e4c706b53f51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080095, "uuid": "5e72a43c-30c3-4f41-9d5f-21f72d0acdf0", "value": "96b17e5e2a2db276394f002907ae8237.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e8a9d4-5fe1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696113137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696113137, "uuid": "d4044400-8b30-4843-b8d1-e57053a94658", "comment": "Malware payload (RedLineStealer)", "value": "12b9cfc82a17b8ffe59ea43467a0aa2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696113137, "uuid": "a2d58912-68bd-4629-a2a3-e1aafe913871", "comment": "Malware payload (RedLineStealer)", "value": "aee2c1373dd453203a13f89bb13051b979ec70e75e090b89bba5217e83acc265", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696113137, "uuid": "1df751a1-a8db-4424-8aad-91b926b0c03d", "comment": "Malware payload (RedLineStealer)", "value": "af23494bc6e76fbccb17fe8e07021fa6088399f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696113137, "uuid": "4029d340-0f42-4b14-b594-b2e0507355c8", "comment": "Malware payload (RedLineStealer)", "value": "5d1ad9db174434e84981cf80d57c76c2b84f93b5f4aac6240bbf36208a30e3034f711cbd71b9989e236690fa144fb2e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696113137, "uuid": "3064e005-4734-4c97-b843-78ce8f37f931", "value": "T14154CF2352F17C50ED676B728E3ED6DC3A2FF460CE59676A32145A1F19702F2C262B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696113137, "uuid": "029f101a-a662-4382-9fc7-9f6f9a8ceaf1", "value": "d323d1063364fcdde3ec2d7fc616011e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696113137, "uuid": "e8d8b6c6-c693-4971-b185-8a61eb1edcb4", "value": "3072:ZqERvokWIzlM+w0//oLzMyijI85ftZzrUzC/U3bug9jzXrPtXC3bnDIJ/D2iq2M+:tN/zyGIdyZttrZUSw7PgMJr2T21cW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696113137, "uuid": "c36f0607-fb86-49a1-b18a-9c4178e9cce4", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696113137, "uuid": "6f245e5d-bb9e-4a7f-9693-3cf4d288709d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696113137, "uuid": "6d3e7078-aa35-4a0a-a5d9-a331834e3401", "value": "12b9cfc82a17b8ffe59ea43467a0aa2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2841bd-5f7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696068988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696068988, "uuid": "3892d581-8a60-46f8-ab30-9497650f874d", "comment": "Malware payload (Amadey)", "value": "3181058df3579f552726171cc67a0203", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696068988, "uuid": "b19513b0-7aa9-49cc-80fc-960a9b65f8f2", "comment": "Malware payload (Amadey)", "value": "af442f2ad4ab078efca95c6890bc560feaadcd6a5ef5413946a115e21c35cfc8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696068988, "uuid": "bf4f7a3d-ff9a-4f3f-81af-fd61afabef95", "comment": "Malware payload (Amadey)", "value": "5d7c2feec95b6d60cef9ba87c95d493b540f2b82", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696068988, "uuid": "0c7cb72d-c73c-4035-96a3-2f5569b5defe", "comment": "Malware payload (Amadey)", "value": "4e60ab76a37bff5a933f05a1bad68e94fb08fe2900de5a517a154d442bcc9c898164ea57deeabc5d1e5923a3087bcdbc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696068988, "uuid": "dab0bea7-db38-4271-ab18-2e5cef42508e", "value": "T103352307BBD8D4B3E4B52B7099FA06832B3A7D514938839F67204E971C72694B872773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696068988, "uuid": "4dfa925b-5675-4b66-8d0a-626dd48c704c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696068988, "uuid": "84463416-6fc3-4bab-b738-e7c41c9ba8f5", "value": "24576:+yTiKQajQgvSGnP/U252eYcY/QPzqyuAJSwVpR5OXpUr:NOKQUoGDlfY/QPzPlr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696068988, "uuid": "7448e05a-19ac-42f8-b655-213c76df8630", "value": 1101312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696068988, "uuid": "7fb77744-5b19-4ffd-95b1-35ef82336087", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696068988, "uuid": "79c5625f-c664-40f8-9473-9d554223516e", "value": "3181058df3579f552726171cc67a0203.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5edb0f28-5f95-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696080564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080564, "uuid": "5c44488c-53f2-463d-a25c-ce27182aa249", "comment": "Malware payload", "value": "1e3a512fbceb893ad157943c174be317", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080564, "uuid": "1ee1c433-06d7-4071-bf74-2f2e765d056b", "comment": "Malware payload", "value": "af5c2c36eb78a80459d9793d8adb92346d0041d97209b375f2bb22fc0ae73baf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080564, "uuid": "fbad4557-23f0-4c68-a48d-5d0b6f0d190f", "comment": "Malware payload", "value": "ef127fb5161864ab70afe76d6d223109372fba1e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080564, "uuid": "b19cdc3b-9522-431e-b7a8-f08999427813", "comment": "Malware payload", "value": "db036c0015eefd4f6ab26b9de840a9305590221d8f8ea58078f4e75961d19633630af99b36964a4a458fe355e511463e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080564, "uuid": "169973f3-0339-4a49-84bb-18be031f2564", "value": "T1F375A50ABE18E1B5F02900F04CDAD62D6626FC60D9021917BFCCF76F15F7268BAB6915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080564, "uuid": "c222280f-76d8-4192-bce1-247aa581d8e7", "value": "24576:gtnEOU6hp4PwRPEY9PMQg2E9IPDSODTf26tR5mgfvj5HfgkE/W7IX15imfMdz:gjPEY9PMQg2E9IPDSODTf26tR5mgfvj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696080564, "uuid": "ab6f8226-93f0-4698-a024-0976fdae0644", "value": 1556480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696080564, "uuid": "9aa93ed9-794a-4a88-bb88-a1cc6695a8ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080564, "uuid": "c01a2d24-9485-4cbc-bd4b-22d79a905f48", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.27194.24088", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9582c3d3-5f41-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696044578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044578, "uuid": "dfb3788e-1ff4-4844-b8dd-2a3f3db2e7b4", "comment": "Malware payload (Smoke Loader)", "value": "c2a3d78bc7bbc241439d32aa06842ad6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044578, "uuid": "a788c6b1-183e-4c59-b363-519884d4b807", "comment": "Malware payload (Smoke Loader)", "value": "afc5af854b3a9614431a7fb88c6ff93eea10d5420419c435fc3bd0890d40cf1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044578, "uuid": "27a6f1ba-c479-4b95-98ae-84a8220232d2", "comment": "Malware payload (Smoke Loader)", "value": "d98ff148cab3fc42b3524037d83ee8fdcf3c52d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044578, "uuid": "0b8760cf-a1cb-490d-8d82-fdce1bbdce78", "comment": "Malware payload (Smoke Loader)", "value": "7676bb2434f78bd13eea8980d120d0d0dc6379e3c21637397f228442c3ef7f0307aaf356e3ca3d9523ca88cedb4615c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044578, "uuid": "5ec2c346-cffd-4d68-adb1-edc4e9e1f45a", "value": "T1F534BF1174D2C073DC7225373AE4DBB99A3EB93009915AAF67E40F7E4F30281E661A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044578, "uuid": "ebf22004-58f6-4175-ba4b-3e57e11dafdf", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044578, "uuid": "a49e2403-b93b-4794-8dd2-7d51027fdde8", "value": "6144:qFz4SHy5uoBMFGV5PEkIXEHvZAOPJED+3t0GObjdGd2Vs0BC+:lCmuoBMUOMxdCD+90GObj/s0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696044578, "uuid": "4dcf6963-44fe-484c-8351-a4a2dd625d03", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696044578, "uuid": "e6c79c5c-dc00-4d80-9ff7-f32f13aa0759", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044578, "uuid": "83784235-9f57-4bee-978f-30e958857751", "value": "SecuriteInfo.com.Trojan.Inject4.61510.23536.19125", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f19b7a11-5fb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696092406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092406, "uuid": "eb6a0397-d550-4627-bf7e-c1afbc30e3c5", "comment": "Malware payload (RedLineStealer)", "value": "f4ee0f5c475ef982fcc33dc1f216fa3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092406, "uuid": "29b4bf6a-a4c5-4801-9fac-f3b4eb027b10", "comment": "Malware payload (RedLineStealer)", "value": "b053491bc2d7b1f6878e3bdff73a07e8b1ea81daf965f7b93527b63c85a002a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092406, "uuid": "7a2e7ad8-d547-4800-8f6d-10f5b45f5f5e", "comment": "Malware payload (RedLineStealer)", "value": "877f4dea2a3e99278e7c67bb488905d69c093265", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092406, "uuid": "91df29b8-7ac4-4dee-8672-f55640732d49", "comment": "Malware payload (RedLineStealer)", "value": "9f8caa744db13a11b56761e7493cf9cc514a9bf44a74849b0180f761be4ac8a20dcffc4372be8dff0d4a9754b850176e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092406, "uuid": "6050b1fc-9a95-45c4-bda8-7f213d267b13", "value": "T179252312F6E4D0A1DCF9177415BB07830E36BDA24D7483AA2746F91E1CB3781A93636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092406, "uuid": "787048bf-48f9-433d-8070-9dff06062048", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092406, "uuid": "5b73d8a5-f3b2-431d-8df9-e3d75cd5a499", "value": "24576:ryywB5zYYx+4vU5ttkHmBNGQf9E3OjwPnWEEuXJmm:eBBDU5DgQ1w2wfWEEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696092406, "uuid": "7a0d0f8a-3bb5-42cb-bd93-ff59a059198a", "value": 1017856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696092406, "uuid": "02887cd7-76d1-4fbf-9c13-7e8f213a0ab0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092406, "uuid": "a0c0bdd3-629a-400e-b493-dcacaa06ec09", "value": "f4ee0f5c475ef982fcc33dc1f216fa3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62bcbf5c-5f8f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696077993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696077993, "uuid": "788cdb47-e346-4284-88db-8f4e290b60cd", "comment": "Malware payload (RedLineStealer)", "value": "988a37c8363d881b7280d6004cf87f56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696077993, "uuid": "fd34db6b-6f69-499c-817c-f940d6f10305", "comment": "Malware payload (RedLineStealer)", "value": "b155a1b848383e9af61c2ae1cca073528edfbacb930fc03874ddfd914aa6aa11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696077993, "uuid": "70bbf79d-ebf6-4713-bb15-2999a489c81a", "comment": "Malware payload (RedLineStealer)", "value": "385df12524352683b584b3426222076a8998998c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696077993, "uuid": "2d98de2e-9041-4528-99c7-892e41b99034", "comment": "Malware payload (RedLineStealer)", "value": "7c348ea5d05f39d36cb8fe0228163f63bab84df3fd45bafd8d359056e572e62df38a9656ec8540f981a1c8161291e14b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696077993, "uuid": "ac0970a8-cf74-4d9c-998b-99ec17460366", "value": "T10AF3BF1675D0C0B2ED661D350DA0EF718A3EFC740F949F8F67881A796FA02E08636967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696077993, "uuid": "18bcb479-f2a6-4283-9fab-731415865b65", "value": "5b961e24b82512d2a00ac6c970dad1c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696077993, "uuid": "a89c796a-660d-4cef-be47-fc811e74795e", "value": "3072:WhTUooowo7h0BEYmbuw16GVuiIPMoC8TCDyg9ZRfzj:WhwFiOBEBbx6GmWDzrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696077993, "uuid": "05ec9896-5731-4b9f-92f2-d64df98cb651", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696077993, "uuid": "7be036b0-9ca7-470a-970c-b7b49a8491b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696077993, "uuid": "976c3432-30cf-4b61-92f0-ccbc037301a2", "value": "988a37c8363d881b7280d6004cf87f56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57cbb3ed-5f52-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696051775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696051775, "uuid": "107d7617-a109-458d-b67c-0d8c7ddb976f", "comment": "Malware payload (Smoke Loader)", "value": "cbaeb8bab4c274980a7c2a76bb4db4d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696051775, "uuid": "e2facb4a-4c78-4c4b-a642-274fe5580746", "comment": "Malware payload (Smoke Loader)", "value": "b2e831d032c645ca1c751976c7cbbdfbac3bd511595eb33dec8d99f8a4d29dc1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696051775, "uuid": "ff792f74-8c80-415d-a589-eb0c766d348c", "comment": "Malware payload (Smoke Loader)", "value": "cae75085dd32764ced696d2bb790871a1de0bf01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696051775, "uuid": "909323a3-e2cf-4f9d-b256-2e0970c20332", "comment": "Malware payload (Smoke Loader)", "value": "bcfb3a7b4076b0960ae7df2734c13b40fa128c9dd18b2fc68494d0137a04b8ab235820e4acd078b18435113b39ae3695", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696051775, "uuid": "af6c7b99-53b5-4bc3-bd00-8e96b4f2a776", "value": "T1F934BF11B4D1C072DC7225360AE4DBB95A3DBC300AA65EAF67E40F7E4F36280D635A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696051775, "uuid": "91dbbb1a-5d11-4a73-aea3-f65b895d0f25", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696051775, "uuid": "64c032d4-22fe-4947-bbab-7b416515df96", "value": "6144:YAzYYHy5uoBMFGV5PEkIXEUvZAOp8RJCSes0BC+:+ImuoBMUOTxn8Xhes0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696051775, "uuid": "5c10a175-b68d-44b6-9674-175b9b1887a7", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696051775, "uuid": "aab47790-a2ba-4c96-9b33-5d18673830f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696051775, "uuid": "c40c944a-f188-4b17-8d05-6ec64599169a", "value": "SecuriteInfo.com.Trojan.Inject4.61513.25668.17868", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "797df257-5f3b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696041954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041954, "uuid": "568f2bd5-2d4e-46be-8516-8e48517130de", "comment": "Malware payload (RedLineStealer)", "value": "b66c9ca0752f72fc4e3a5b318dfde563", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041954, "uuid": "6206205a-e484-4e8b-9754-ccdf2922b0d4", "comment": "Malware payload (RedLineStealer)", "value": "b463b9b4f1300d89f68ece18924fd12efbcbd3a70a49cefc32b7268fb47c3ef2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041954, "uuid": "bbc14e6a-e898-4b82-b66b-9c22f700f5f0", "comment": "Malware payload (RedLineStealer)", "value": "186810a2620db5f3dfcfec74de19540c4085f5fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041954, "uuid": "e3e60a06-3dd5-425f-86b0-611e6bf4afe6", "comment": "Malware payload (RedLineStealer)", "value": "354a870089a9c9be04a60956c4ba504de4b580354d594ced42fd7d47d08957c859df5ff2e724e74a8a4ce425afe1a6c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041954, "uuid": "79f209ef-fa72-409a-aebf-1074a3db14f4", "value": "T10244AE01B5D1C432D87211320AE4FB7A9A3EB9604B545ADF67E40E7E8F607C1D732A7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041954, "uuid": "62f864c0-8d40-48fc-be14-3c471fa49d19", "value": "e6417806f636d3a26a1e8916d3e05d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041954, "uuid": "d4bb7ccb-2601-449b-ac2a-1ee2d63f7b1c", "value": "3072:7OT1C0ctZI6461YHBe6Itf1/iTY6ce6pn++RcNLkBHgDK6gpRnUuEeAg0FujDZzv:7OjctlMQMY6Vo++E0R6gFAONq7EYxg35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696041954, "uuid": "3ec60f9d-18e7-4acc-9e8b-7bdfed8d2147", "value": 276344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696041954, "uuid": "e40b1568-c294-4a2d-8aff-759dcd01b2b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041954, "uuid": "80b4fcfe-1ad7-4aa4-be8e-6514e061e517", "value": "b66c9ca0752f72fc4e3a5b318dfde563.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c37ca726-5f9a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696082880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696082880, "uuid": "2d94c8c0-97ca-4998-a64c-42b73d64cb40", "comment": "Malware payload (Mirai)", "value": "7f08870062c25e36fab534b71daae731", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696082880, "uuid": "5b4e0d39-cfc0-4230-b1f4-db13f41941d4", "comment": "Malware payload (Mirai)", "value": "b4cc15f6405efcbe66c2575e417dbca9a6771b1f86f1cab157fde7eb99c32450", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696082880, "uuid": "b4a605a1-2484-4f5c-a79f-cc2f63d69943", "comment": "Malware payload (Mirai)", "value": "d50e078da47482558c9cf3b9e6506c1f43f8793c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696082880, "uuid": "9adb4b2d-6420-469f-a8c5-1534536e1784", "comment": "Malware payload (Mirai)", "value": "d72913ef0cfe0b61ff042b3325c8e9cd5be254cc3fe5b8fd628a64d7e070e294df939e497c46953adac6f5ef6a067fbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696082880, "uuid": "ccf32712-6a53-4318-9dc8-7789f1c02eb9", "value": "T10C435CC0A613D8F9E95A46741173F7374732F0F611E9EA63C7A8D933BC81B01DA1A698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696082880, "uuid": "a7832a40-07a4-4a25-b8d3-4c777569835c", "value": "1536:00D2dhuPhqjxVEuyfFzuafCQyHitKm37Cx2EnpTpGSA/:0W2dhahqjxVlyfFzuafCQqk7e2Yxq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696082880, "uuid": "348e7e5f-c5e5-49aa-8d24-4707c82c2265", "value": 56528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696082880, "uuid": "f1611a4a-b2bc-47ce-a522-cdf641fdf6f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696082880, "uuid": "af02ec98-8730-4e93-a1d1-a25ca2ba5db9", "value": "sdxkzX_UXA229x.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f2a91f-5f33-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696038351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696038351, "uuid": "dc2e2619-ca82-448d-824e-f7ff22b45048", "comment": "Malware payload (Amadey)", "value": "9208d801174d1519ebd285c29622fe2e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696038351, "uuid": "6cff78a1-ca30-4c6a-b501-da45ac7e52ef", "comment": "Malware payload (Amadey)", "value": "b514ed376c311f2273b95a856762a103bea06d193394e539733b6df70cc5ec4f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696038351, "uuid": "05eb6b3c-1b23-4a3e-8dc4-d57e1a25b59c", "comment": "Malware payload (Amadey)", "value": "15cc48c7d57d84f7923c8f66cab0046536f981b8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696038351, "uuid": "14268569-4b93-465e-84dc-ea8bdbca72b6", "comment": "Malware payload (Amadey)", "value": "c0f81d721bf536f7526894425e70966abc43d50a89e439ce8a67f4e25aa5ae223234a14eac4e3bc82c09cde0ac5cc056", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696038351, "uuid": "2755ff75-b2a1-48c6-a634-ee5a7e8e5e1e", "value": "T173152203AAE89432D8F12BB018F707A31B31BD419A74436F3719A99E5C727C8A57179F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696038351, "uuid": "85629a4d-b3aa-4db8-8b1d-79ee8d515542", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696038351, "uuid": "94fa0a7d-08f6-4c58-805a-01511182e1bf", "value": "12288:OMr8y90RKh4r3zQQsIFlIWQLfgGGm4zxWjKfzKJOXBtXum4U+Jj7upN9px3motit:myR4rjjoWqfDG06zoUanX49px3ALZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696038351, "uuid": "83028573-f294-4e56-8c61-7f10c481e57a", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696038351, "uuid": "f528755d-6821-4edf-afb2-418bea687b22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696038351, "uuid": "9fd27794-943d-471d-9c89-05b629db63f7", "value": "9208d801174d1519ebd285c29622fe2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8317149a-5fa1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1696085778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696085778, "uuid": "cdfcf6fc-6a43-463c-8c08-7149d9cd216c", "comment": "Malware payload (RaccoonStealer)", "value": "a7900cdbb2912d76aa6329c5c41d8609", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "Raccoon", "colour": "#C8C58C", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696085778, "uuid": "5079a9f1-b578-4c74-85ea-228c73e86d58", "comment": "Malware payload (RaccoonStealer)", "value": "b583d86c4abc6d6ca57bde802b7e9d8143a249aed6a560a4626e79ae13f6209d", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "Raccoon", "colour": "#C8C58C", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696085778, "uuid": "40d2ba94-17ff-4243-a936-2a80f5236c11", "comment": "Malware payload (RaccoonStealer)", "value": "10e3b5e5cabcfbe1e79caa1a47efd994122d5429", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "Raccoon", "colour": "#C8C58C", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696085778, "uuid": "1d82a3ce-e554-4dad-8b5e-402b488cd7f0", "comment": "Malware payload (RaccoonStealer)", "value": "b3afe6114c0b012f4503a31de08a54c141cd2e508e85cce2848d483ea5a58a97c3ac2cb0ea7fcf802f525033d8d35c49", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "Raccoon", "colour": "#C8C58C", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696085778, "uuid": "e923d076-e366-462d-8d9b-303eccf97ff5", "value": "T13A4733D93063B115FAC90C20E92A18D2B5579FA5F5042C7124F6AC88BFE3DDAE1CE275", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696085778, "uuid": "f6f15277-3259-4a71-ba80-f545038e416c", "value": "393216:kKc5VmYor9Dcm9n7EaLY9eoRbFQ067wNg8W75dBGNUNpWXNM0AsfjYgsErOwm9r1:kKc5MYa939oZBk/XBGWNc+0AwjNs33h1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696085778, "uuid": "05b0be85-5b0d-4dac-b3e3-d080e61d7c2a", "value": 24637335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696085778, "uuid": "39cfcfc8-ab07-476b-a56a-6846fecc1564", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696085778, "uuid": "fc66da4d-b061-4973-bb7f-c24b810ab76c", "value": "Ml\u0441r\u043es\u043eft\u0415dg\u0435S\u0435tup.appx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611ea4a9-5fb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696092164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092164, "uuid": "820d8e1d-5f3f-4951-bcb0-c747b758c486", "comment": "Malware payload (Mirai)", "value": "657b9253080b2cf4a6e91d1023ae61c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092164, "uuid": "e4d61d63-3c4e-45a7-9db2-7fa07ced2390", "comment": "Malware payload (Mirai)", "value": "b61923c6290b1f2acaf913a5ccdbd1f655a69212a7970040de9c007c8ca383b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092164, "uuid": "18d80223-f3bb-4f7a-a410-1faaaa9323ce", "comment": "Malware payload (Mirai)", "value": "94f99a9c53810a9c3b3d8dada9afd69b3ad43916", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092164, "uuid": "3f719633-e1c0-4a73-b022-23d742e3e7b0", "comment": "Malware payload (Mirai)", "value": "6eb44ec10d8c3ea181f6ac77218a4de02dfd1e1656414f706ac7119eef303417925a676ad3a7720815a4b4f388bbd019", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092164, "uuid": "e51dfca8-6c4e-402e-9f96-d2e62e687e4b", "value": "T1D453E682BC51A629C7C04777EE6F509E3311BBDDD0DA3742DC150BA47A8AD0E0D67B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092164, "uuid": "e9010a54-5295-4f2f-a0e1-1bd3cf84def4", "value": "1536:pwY/76zkSfcbSDT0y/vzfvRB8t46SvOTnS:qdFfJnT84Fvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696092164, "uuid": "1027901b-30fa-4232-a9e4-10adf091c92d", "value": 61204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696092164, "uuid": "8b198bb2-0541-4e0b-a5f1-9fe0eb454118", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092164, "uuid": "4472d0b5-02c1-43b0-9f17-920505761157", "value": "657b9253080b2cf4a6e91d1023ae61c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3debd42-5f8c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696076948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696076948, "uuid": "85c77d39-3cf0-47ef-9231-35d137a579a4", "comment": "Malware payload (Amadey)", "value": "413d6477c150e234770b08ea631cc3fd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696076948, "uuid": "7fee1dc8-1c8b-44c1-a90a-b4162a12a641", "comment": "Malware payload (Amadey)", "value": "b63607ebdc0822301b90142f5903dae951fd00a952cc0cafa2f562cfd6e98239", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696076948, "uuid": "712d04d6-965d-4080-ab9f-7861502671e3", "comment": "Malware payload (Amadey)", "value": "b3caeaa16c1b98f183965879820aeba277d4abec", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696076948, "uuid": "2624c973-3a69-4fc2-aa39-6f624864d32a", "comment": "Malware payload (Amadey)", "value": "80294e3899050f3b0e4caf667d3f35db7332c21fbf66e756c54298e25feb175cc713c3a4d4d33b48956d4eac3cc7dafc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696076948, "uuid": "d39f2d6a-8729-4fa7-9715-42aacb4cf997", "value": "T1AC34AF1175E28072DC7225360AE7DBB9993DBD3009925EBF63E40FBE4F34281D621A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696076948, "uuid": "3204b4e0-d9a0-4021-8032-94c5999392cd", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696076948, "uuid": "2c0361f9-0b76-46a9-9ac1-1a2dd4af9181", "value": "6144:Y1z4SHy5uoBMFGV5PEkIXEHvZAOP8ygnVs0BC+:PCmuoBMUOMxxjMs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696076948, "uuid": "40082842-d2ee-4e60-9b8c-6f8a5ce9290b", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696076948, "uuid": "7dbab688-c006-4485-a17d-c19a187855f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696076948, "uuid": "62677aba-9b86-4fc1-901f-f82f39f87fb7", "value": "SecuriteInfo.com.Trojan.Inject4.61510.24681.13911", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63544c2-5fc8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696102695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696102695, "uuid": "dda3ebab-f6ad-4b5b-9a74-c87bf90d6114", "comment": "Malware payload", "value": "5bacad997fee21b16c7265d27f8cf2f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696102695, "uuid": "e70176b6-3e46-4644-b83d-c55c8835971c", "comment": "Malware payload", "value": "b653a89e2a50d9f48353c875198d7f64344d227accdc5c8bd35823502800842b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696102695, "uuid": "38f6842e-0b94-4257-adca-5f92e29d7e97", "comment": "Malware payload", "value": "4c16385554f31b237336e0ec27674127ba9dd735", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696102695, "uuid": "afab41cb-8d93-4d1a-a42e-e024b5003589", "comment": "Malware payload", "value": "1e0e6c9a00d7dbb6e7556e55eb71b1de5b7ac2341b30ceb9fcc86e780549e6acb1ec60b91f81e59f46c9bc4b99df0197", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696102695, "uuid": "bb35c7ca-5c5a-48f8-95cd-d804d5170dbb", "value": "T17BB5336136D1D2FFEE933430DD1466B9D0F4C7885B12AE938FC0D7069E3C09156ABA9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696102695, "uuid": "9c7a1cae-76ac-458f-9329-f538972a54fd", "value": "4ba3ea0d6362a841ec66a1fc0a1b874f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696102695, "uuid": "f6ffa09b-5599-4083-883c-ecce07b20217", "value": "49152:ufC4M200n9b3Dd0iefUpYpYsEWFSrV5N7mAui+wSnpgrEIr:jxk350HfUOhEWFSr7xu4SpdIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696102695, "uuid": "9c4a20a6-d2da-46dd-939a-e05ac0ff18e9", "value": 2330434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696102695, "uuid": "e7b5ca49-4d4b-4a41-a31a-53ebec7655cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696102695, "uuid": "499a9de4-a0cd-4320-96f5-ceca7ad63b43", "value": "SecuriteInfo.com.Win32.Evo-gen.29934.27343", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69fba2bf-5f7a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696068986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696068986, "uuid": "2dc355ab-04ae-4be5-9b66-478d5cbecaaf", "comment": "Malware payload (Amadey)", "value": "f9f30d658b05a3f9e9507e84413bf9ea", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696068986, "uuid": "5b7ac9b3-f0d7-4a11-945e-e73c3c842a15", "comment": "Malware payload (Amadey)", "value": "b6548e8d61950bc5b85ef276edcc294dcf3d2af0e030ce2ec237e3f465f380a3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696068986, "uuid": "66b10a09-4b9c-485b-9824-020d17c07058", "comment": "Malware payload (Amadey)", "value": "1c018ba303de114d897a6bd109256e4bd948ba8e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696068986, "uuid": "08bbc8c9-f831-45b8-b5ae-2ba1b64e124a", "comment": "Malware payload (Amadey)", "value": "1cabfe618b16d28c8d939cf3d416e3e403c5f5be17f25d5b13e1c9b2f0c6a41ceb7641021d35c698cd5cf77cecee8356", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696068986, "uuid": "f0ca86b6-0458-4659-aaab-e8753051adb2", "value": "T1692408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696068986, "uuid": "eecf8a8f-9b76-49e1-b192-791e13317458", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696068986, "uuid": "7945b074-7475-4b0b-8741-9e945e83c858", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696068986, "uuid": "c52d191f-2ed9-4f90-9528-f94f07ac6559", "value": 224655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696068986, "uuid": "936edb88-9137-4800-baf9-042f33c24b42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696068986, "uuid": "65dc7e5f-3808-43fe-a2e1-0696e90a9b69", "value": "f9f30d658b05a3f9e9507e84413bf9ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b22492-5fc0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696099075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696099075, "uuid": "8013cc49-a4f3-46b6-9113-7c65a17d5a4f", "comment": "Malware payload", "value": "b7db7a02a8590f38ba28dd5d4a75bd7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696099075, "uuid": "f22cbbf6-d3d4-4960-8d9d-b1d6b0550c58", "comment": "Malware payload", "value": "b6c7f66593503ce7de53dec372a3407ab0c0ed221007eac96e44dd9b9488df0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696099075, "uuid": "54f3ed1b-5eb5-4d79-adc1-6c5b1b0806c7", "comment": "Malware payload", "value": "2f244bc5c19b10be3b35f6ebba3b75d12edadcbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696099075, "uuid": "de6be86e-ca84-4c4d-b789-ddc66128c791", "comment": "Malware payload", "value": "a695c0e24d01af4d6ad48c80dea15d96b5cda85795cb851e58a54e6ed51c8e0545b6c09ac5af3953f98b957bda618484", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696099075, "uuid": "d332f947-e87e-4786-9786-a03297bc327b", "value": "T10EB5332239FA40B1D1AA1532DB593BF426F0D2611B140E972748AE1C3F399DCF0BD89B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696099075, "uuid": "d20e2ed6-bc2f-4d0c-bd2d-67991d20e256", "value": "1d0e3506c01cb61e9312cbea4911e92e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696099075, "uuid": "18effcbf-dce2-472a-ab77-482f2486b95c", "value": "49152:WfAm2sLxHoyUTWgvedeVU8yTtCKE6lW0Ez0q3MFS/sktK:WLnHaeQUNRCYlbgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696099075, "uuid": "b3fe6498-a010-4791-a56e-1e8d0fd32258", "value": 2324699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696099075, "uuid": "4a52a805-68aa-4213-97ed-7bb894ecdb77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696099075, "uuid": "9bb7758f-b076-466d-bb72-e9dde2121c55", "value": "SecuriteInfo.com.Gen.Variant.Mikey.154275.20256.24835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0c5070-5fc6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696101547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696101547, "uuid": "d1551cc4-2599-4d1f-9c4f-97cfdb8d2747", "comment": "Malware payload", "value": "98ef6234f854b45bc8c277d6849cf119", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696101547, "uuid": "595edc49-9041-4373-ba5b-63d0a207c14e", "comment": "Malware payload", "value": "b6fcfa65d7b1a57400dafb8d0dccb9af9b70ac8a2a801d1bf221f95f3ec58bbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696101547, "uuid": "b266206a-1e0d-478f-ad3a-878bf00611fd", "comment": "Malware payload", "value": "021426374e8e41bee242720c15903d7478ef5c98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696101547, "uuid": "8be34bff-bc3a-451f-a1a2-afd9ef90ba73", "comment": "Malware payload", "value": "fda59d6a368894a79fd1925f586ce9e121cb2d094e4e8d27c59d3134eeb39e5236c8f6e3fe20b8214bcb08a19c2fac00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696101547, "uuid": "bd304c5c-a043-4c23-b462-1ffbfca8c07c", "value": "T12E249EA362E17C61E5676A328E3EC6E8762FF851CF55575A32186A2F09701F2C273312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696101547, "uuid": "0971fe1a-c100-4ac9-a287-77fefa869be6", "value": "d323d1063364fcdde3ec2d7fc616011e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696101547, "uuid": "0ba7e78c-6b55-4c0c-a2c1-3db00a72a7d5", "value": "3072:GaxRRRkoaZK4ieL1MIWgOIwSGYYMe55/Rvgx:vGKsBOpSGfMKRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696101547, "uuid": "78970993-4bfa-4c3e-ba13-eb908a1e8d9b", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696101547, "uuid": "ff77b96d-1a8f-4405-96d0-6e8f3c4c9815", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696101547, "uuid": "23e56a3c-29a2-4679-beec-6c1f04e38598", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b2da2cc-5f8a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696075887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696075887, "uuid": "39be8069-24a9-48b0-94d0-a6e19c869de0", "comment": "Malware payload (Amadey)", "value": "d62a8c999349e83976b9fac147203fec", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696075887, "uuid": "150d6a45-95fa-49ee-97b3-d5310f284b8c", "comment": "Malware payload (Amadey)", "value": "b7aaa21b09418f60ad0ec31f85b3907a3489227bc66aa1236580794f0e48a509", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696075887, "uuid": "f8ab1b10-18a8-46fc-9fa4-181afc25b80d", "comment": "Malware payload (Amadey)", "value": "6eedcefaadcea8c2e7102636f3bd81f19edc5ab2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696075887, "uuid": "5140c6d4-e3e6-453c-bd01-c35974833931", "comment": "Malware payload (Amadey)", "value": "776d76a69025a512e82d8f509f216cb0f026081688237139b834d6401877725d8cb3e4e4130c6d582ba68366cac35858", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696075887, "uuid": "7288e7b8-c70a-4f48-98e7-65958debc326", "value": "T15CF3BF1635C0CC72FD6219350AB0EBB18A3EFD700F909E9F63984B796E602E095F5967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696075887, "uuid": "3974eaeb-e9e3-497d-85a4-9fdcc7ddc2c3", "value": "5b961e24b82512d2a00ac6c970dad1c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696075887, "uuid": "78513bac-17fd-4331-a051-3328a0356668", "value": "3072:WhsUo96V+E7NWgHEjwAuIASGGhNpIPMoCtaUUr+l7Yaozj:WhLaksgHE8AKSGUJky5jyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696075887, "uuid": "91024d59-5b3a-4695-8476-9d4f7b049a79", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696075887, "uuid": "2f581975-463d-48e5-bf41-1bba15fd0b30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696075887, "uuid": "a85cb89f-2a57-4759-9aa3-ba81cdcaf030", "value": "d62a8c999349e83976b9fac147203fec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c4f3afd-5f37-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Meterpreter)", "timestamp": 1696040187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040187, "uuid": "3a8b403a-4377-4716-8f79-49dc04c6f0a3", "comment": "Malware payload (Meterpreter)", "value": "8d0dc07d79078f68dd32d461c03dd531", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "msfvenom", "colour": "#1A541B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040187, "uuid": "bca0d2e7-2e6a-4a0b-b370-927df2e95d19", "comment": "Malware payload (Meterpreter)", "value": "b818cb146de28aef397ad51ef0403713899e0d7376acd2ec5d2d6c9258d7ba6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "msfvenom", "colour": "#1A541B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040187, "uuid": "3885ee23-a4b1-44fb-aeff-99a3359128ad", "comment": "Malware payload (Meterpreter)", "value": "f9adb080255bedaaf24db4bbbfdcfe3696123947", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "msfvenom", "colour": "#1A541B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040187, "uuid": "2ca984f7-e372-4955-8d51-b64682e4a8da", "comment": "Malware payload (Meterpreter)", "value": "60a8643f62984c5f0dbbaf4f094bddb36e7352045ca3f3620c36b4c793312f1289e8293d0f53b3e3b4bfd819e2ea5b50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "msfvenom", "colour": "#1A541B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040187, "uuid": "a09c3888-7558-4142-aedf-a5bb36664175", "value": "T1C173B042DAC44531D1A6223E2AB53A7A9970E5F73601C1DF398CC9E5DBC0DB0972A3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040187, "uuid": "b6b7499b-aedf-4b3e-bde7-db914e08ebee", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040187, "uuid": "815c47e8-de23-486b-b37e-9079b20a8b16", "value": "1536:IrJCbSiHr3VNC5EZP/nKABP5QVopkZMb+KR0Nc8QsJq39:lRHr3VNCWN/nKABhQGwe0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696040187, "uuid": "8eef850b-17b7-4f37-8246-12e45ca355ef", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696040187, "uuid": "1bbc85c3-4cb8-492f-8b56-d2fd5073db9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040187, "uuid": "b4c3892f-0fef-465e-aafb-3dced0c3582d", "value": "mw3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674a9da2-5f9c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696083584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696083584, "uuid": "9e59070c-4d98-439f-91d9-3cb9a1ddf32e", "comment": "Malware payload", "value": "ef156079393461dda75aaaf7e442acbe", "object_relation": "md5", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696083584, "uuid": "696d5e98-900a-435b-bd1f-7bfafa48c0ee", "comment": "Malware payload", "value": "b849de1ae7d942f6adab50f5569180b69659afae6d26c7fd9fde0ebbd057912b", "object_relation": "sha256", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696083584, "uuid": "b9b804c5-b6ec-4f34-935d-0a57c7535fb6", "comment": "Malware payload", "value": "460a22d36c2dcf3041439b5ea2b031716a2cc92c", "object_relation": "sha1", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696083584, "uuid": "277f226e-a50b-4845-9b80-62363c994810", "comment": "Malware payload", "value": "2e152646897a399e1db4226a8460a89b5c4a24c172c21a55267a53f9789c00ad0a2508f601da639e122ba905166f3b81", "object_relation": "sha3-384", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696083584, "uuid": "e3b6c768-e652-488d-9233-58020da60fd0", "value": "T1F3231846B9C1CE5FC6C140BEEBAFD2B6733197D4E68B3707C5089B247D0605E8A1AB90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696083584, "uuid": "10a6151d-a83e-4351-bbe4-e66e4f31d9c1", "value": "768:s+9zka+kGtw+7/Js+ivRsYGhkk7SB97k8r/I0zfNgU9lFRFNORkOGq+p:xZYwRJ+j7SB97ka/TflFRnOe1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696083584, "uuid": "44f8d8fb-640c-44a7-85e7-bf9d264e3322", "value": 46431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696083584, "uuid": "c82f3e72-7087-458b-a234-6c4ff062de77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696083584, "uuid": "188b935d-c8e6-4248-9ab6-a7755910e6eb", "value": "Arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd44c9b7-5f31-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696037772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696037772, "uuid": "8d4c5e51-bd7f-4a81-a1b2-54c12c2c6e6d", "comment": "Malware payload (RedLineStealer)", "value": "97963955ebfd71197e6f713a54dad26b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696037772, "uuid": "b4634eab-1c68-4694-bce6-e7576b7ff2f2", "comment": "Malware payload (RedLineStealer)", "value": "b87617482554dbaec97acbb9f97960cc3283fc2c51c2f6f7c2b935f0035e8b01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696037772, "uuid": "d0249e29-87c1-4eda-b7d0-f3a3b364a1da", "comment": "Malware payload (RedLineStealer)", "value": "65039a6d3b4b027c7888cce11ff525c8142c5560", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696037772, "uuid": "c99d4f1c-6294-49a6-a591-a27cca88d8d2", "comment": "Malware payload (RedLineStealer)", "value": "627dbc4b9b5f7833a362fbd98522c28d3b14cd1fa639efcbe8bf40a294517ab9ee2d15f440408572b0b21c186219b00f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696037772, "uuid": "08a9b4bf-f33f-46cc-886c-bae757b8fa0f", "value": "T1F084D00A62E1BC60D5624A718E2EC7E4363FB5E1DE7D6E5B3314AB7F08702A1D663701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696037772, "uuid": "3f32ccef-85da-4262-83a7-b97bb19a05b2", "value": "a59b93a815ea9713a41e16c8d0248e4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696037772, "uuid": "4ca35812-ac4d-4722-9d86-2486e884902e", "value": "6144:joWZ0VA928qtt8Fret7WDoymp5IlNpN7LnvtHvqu5EIKcZqTm9tILkScGZYTp:joO0KM8mSKrIlNp9nvZqu5jyygYEIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696037772, "uuid": "55bb3987-5723-4262-8a78-5aca4dc75401", "value": 407040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696037772, "uuid": "f137e01f-dc93-41ec-8889-dcca82af19a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696037772, "uuid": "ddd646af-17c5-40f2-ad69-877670790eef", "value": "97963955ebfd71197e6f713a54dad26b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce8e224-5fb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696092130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092130, "uuid": "b58808cc-33bf-474e-a809-5966f9014a83", "comment": "Malware payload (Mirai)", "value": "96db9f80fe3844ef743a5d02a7b51107", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092130, "uuid": "e2760b7f-62c8-48d8-b880-0000d9ce619f", "comment": "Malware payload (Mirai)", "value": "b87e89d76b8e6d2ed7909145db89440baf7a92a3fe422574d2d035f7a0dc3e0b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092130, "uuid": "34f85cf4-21cb-4373-aeb8-2373707f6dc2", "comment": "Malware payload (Mirai)", "value": "d3186eb6f8602bbba25bf4b3dc26840929b02f28", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092130, "uuid": "ef766d69-0a7b-454d-8a17-08ed930e6b7b", "comment": "Malware payload (Mirai)", "value": "ff6a4eaa3fd636575514bdd55dc9961298b82f9c157f93d6482cf545607b098a4ffa09f99b9b5fde8f84253e2d11ea6d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092130, "uuid": "98080a03-36bd-46eb-b63d-7f5026800b6b", "value": "T110E33A02730C0A47D2532EB03A3F27E097AFEAC125E4F645255FDB999271E32558AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092130, "uuid": "3929636a-bfba-474b-9bcb-e90a93e76777", "value": "1536:DmyjeRCAY5FYffw9F30s8pxlRqePIwoqyno1ad6AgvASRnJUs10+/qVcM1Lc/ljm:cRCAvArE/pxah0cocd/Sk7xLmjTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696092130, "uuid": "eed0f0cd-2b9f-4807-bc55-91a40f623e1e", "value": 150360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696092130, "uuid": "2019e71d-2bb7-4ccb-b0ea-33fb9415ff60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092130, "uuid": "dcca2706-b437-4311-b469-fa610d551c7e", "value": "96db9f80fe3844ef743a5d02a7b51107", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bc50c4-5f91-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696079015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696079015, "uuid": "7d599913-5f08-46d2-bafa-03c26c4dab3e", "comment": "Malware payload (MysticStealer)", "value": "a51d3f8672ee3809d5ba8334319633d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696079015, "uuid": "aab31d1e-2c5b-45e1-b44b-dd303a43a7e3", "comment": "Malware payload (MysticStealer)", "value": "b8ce48f350bb5090bc18e3f8b5be5efb9da48e6c48868e405397c000992aaf53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696079015, "uuid": "62aa56bb-6216-4ce9-99b5-c8bd30136557", "comment": "Malware payload (MysticStealer)", "value": "1ab293d2834c2004e666bd4179d7a8d2cf81e25f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696079015, "uuid": "5b6adce2-feac-43ff-84a4-cffaf0f383b6", "comment": "Malware payload (MysticStealer)", "value": "a6400fe6fcb16aa7cb27df4c6a922ae08fe07210a5066eb7c4d486e323ef43d4d415faa1bca89d89f03940b10855e000", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696079015, "uuid": "a96cb1ae-51d0-4d09-8944-2ce75c114826", "value": "T16A54BF1234C08D31DB6E12B81BAD5FA3853CDA610B698DFFDBA84A7E3B543C14475E89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696079015, "uuid": "98c70364-2f6c-423d-a8da-967b11b592ba", "value": "5b961e24b82512d2a00ac6c970dad1c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696079015, "uuid": "65f3aaf0-abcf-4373-a709-3e149dfd7899", "value": "6144:WhbMKajWpVP06BrW/sYy36tUp3NXMPmTKrj:WKKajW56eMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696079015, "uuid": "8c3f3750-a777-4637-8444-f8e1910bc55d", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696079015, "uuid": "29cfd6e0-2290-450d-9fe8-828b28c04165", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696079015, "uuid": "61ec8059-159c-424b-9e92-63512b60460b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3039661d-5f84-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696073184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696073184, "uuid": "8dab81ad-c263-46c6-839b-1ac35f612101", "comment": "Malware payload (Amadey)", "value": "7f89c88bf975188c18c32894f1d10f54", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696073184, "uuid": "ab1e823d-c6ee-459b-8610-1b9e378ec329", "comment": "Malware payload (Amadey)", "value": "b8f33f15e157a8e67de4e29af1f196e45af99db6ec579d3a4ff3558108fbf289", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696073184, "uuid": "ee1d8606-33cc-404c-b499-b56bea952ac4", "comment": "Malware payload (Amadey)", "value": "f7506d99662fd07990706964592e4c73b12e3803", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696073184, "uuid": "7122f85d-2559-4c9a-8d5c-ab4f107f1558", "comment": "Malware payload (Amadey)", "value": "ff45e82a2a140f3072b2aa5abfa6d8c9e6757f32fc729564bb8bd64da11e0e7c46db959fbdb5235b208e83300c2cb669", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696073184, "uuid": "21fbef0f-73fd-4dc1-ae3d-46b47346daed", "value": "T1172408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696073184, "uuid": "17e488fb-23e6-476b-b3fe-51c20634d669", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696073184, "uuid": "498f7423-0c36-4f2a-93fb-37ae7a8bd8c1", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696073184, "uuid": "cb2c83d4-4307-4262-a2e7-294c9d894b26", "value": 224700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696073184, "uuid": "31806a3d-6d7f-4bb4-a386-33ad36d515e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696073184, "uuid": "4c8e06f9-cc01-4376-93a3-3da0be6bffb6", "value": "7f89c88bf975188c18c32894f1d10f54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b12913-5fd4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696107794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696107794, "uuid": "3f81a23c-3c12-43e5-9982-a5816017d3be", "comment": "Malware payload", "value": "47a960676ae11afd01d2f333544f7444", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696107794, "uuid": "2a9e5faf-8d93-4f41-9fa2-07089838d2f8", "comment": "Malware payload", "value": "b9212b5890e6c7cf4b56d58c67e17376889cdcef4b5fc68c61693a20785cd78b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696107794, "uuid": "f807eb63-24ab-4cbc-ac26-dd163e49e87c", "comment": "Malware payload", "value": "ba70bd78d7f3367629badd38c3026d13ca01d2f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696107794, "uuid": "488422ad-0b1a-4710-89c8-4a51b1541f34", "comment": "Malware payload", "value": "da9a5776d00a1cde15083c6c5910784d9ecc126843ddd2028b060d91cb9914782e65515a71043894f57217b3280d2b56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696107794, "uuid": "e04ee1b6-2f19-4adb-937e-449e6cb3f18e", "value": "T19E24AFA362E07C51F96B6B728E2FD6E43A2FF451DF55A75A32145A6F08301F2D272302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696107794, "uuid": "f34218ce-74d0-42b6-b896-449db4d1cfb1", "value": "d323d1063364fcdde3ec2d7fc616011e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696107794, "uuid": "365043fe-72a4-43df-a3c9-d032b573fa9a", "value": "3072:aHDRUma4DAkH6acw43GkrpXLfc7hl3AXMuwfPLnszTA55/BUuVgxA:sRuw43GkiBZnHzszTQBUMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696107794, "uuid": "4b63e994-7484-4538-9847-d46e6369975e", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696107794, "uuid": "37cd8d67-d3f1-4325-999b-72d0ffaf84cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696107794, "uuid": "a74a143c-4968-43fb-bf66-a64877367b03", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ccc5fac-5f46-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696046737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696046737, "uuid": "5060a7bb-a576-4e9e-90c6-3c52ec98c09e", "comment": "Malware payload (MysticStealer)", "value": "75a4c6c312a798793abf89cf98850dec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696046737, "uuid": "fb4d6bc3-2224-4c17-b462-35a33fd77a5a", "comment": "Malware payload (MysticStealer)", "value": "bb83b2c907b06304164367cb0e9876cfa80b97ebb9f6e526167bd3ba2e52702d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696046737, "uuid": "ebeaf61d-4b01-4844-a459-72616b73d232", "comment": "Malware payload (MysticStealer)", "value": "0f6080bac6f1d0041c8bd54f47dad76c75e413bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696046737, "uuid": "151be5d8-1dce-46b3-83b1-51d982df7fb5", "comment": "Malware payload (MysticStealer)", "value": "a54d3185b9b27230a697b0e3880e5f4325be06ddd5bb68d2a51f7d70ce137546fa5ef9576f863f0cd3efec0269bf07f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696046737, "uuid": "565066ff-4a54-440b-b565-cb0327ae2513", "value": "T10074AE2135D3C0B2D87555384AB8BB799B3E397509B00EAB63D41A7EBF68180D7139B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696046737, "uuid": "bdaaa681-ab67-4bcc-a081-d01af1e8176e", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696046737, "uuid": "49ac3ab3-6797-40f6-8168-633daa0d2789", "value": "6144:31TeW/s5GqrO5aXnfEGIXWPvZAOpyijwoAMM3jcEnjrj0+VVs0BC+:kmcGqrOk86x4zcEn3j0Us0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696046737, "uuid": "7b21a2ee-bc26-41cf-9d89-fe9a2612858c", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696046737, "uuid": "bfb560e2-8214-4fe1-a2cb-17b22a552fbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696046737, "uuid": "a7dc01a3-ab50-4f9a-b117-b4b07bcb1fbe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2444968a-5f66-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1696060279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060279, "uuid": "c0a6b61a-c9e5-4a16-b5c7-68666372950f", "comment": "Malware payload (AsyncRAT)", "value": "bf55dee34ac140ac4f7d717900613fed", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060279, "uuid": "08a27d2e-6734-4a0b-bbc7-d852298b4770", "comment": "Malware payload (AsyncRAT)", "value": "bb858fda45f0ba2c5ef800bcc9f23424ce2d43ae4e202cbf3e293ae16089d4fc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060279, "uuid": "ae758d11-d8c4-48c5-83ef-28052c198e34", "comment": "Malware payload (AsyncRAT)", "value": "5ece7fe6ab249b4396892cbb1800f75c62aa1d8b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696060279, "uuid": "14ef3cdf-4eff-46d0-bf95-8f042449a7e5", "comment": "Malware payload (AsyncRAT)", "value": "5089d69949c4f0978396b8cafe111c1ae48a61809481af79b84858571c6a43bb8750b15a825f7e4abe93c5315ae72d29", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696060279, "uuid": "5c8d7da2-c9ce-4d3b-a916-ec593eafea23", "value": "T1E75329103BF88126F2FE4FB858F2614046B6F9676512DA8D1CD8119E0623BC6D952BFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696060279, "uuid": "6a816210-7e2d-4382-80f3-4599c5370e3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696060279, "uuid": "a23c64ff-eb1a-45f3-bcf3-96a8bfbde713", "value": "1536:vHDTgTiogcF0aJb9eVyN3dp7b5pAtYZR4v7Sf+:vjTgTiogcGaJb9j3dJKcpm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696060279, "uuid": "b7d3376a-0d3f-465b-bf59-36f8a4f0b2ee", "value": 64000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696060279, "uuid": "9d696007-1f02-456c-b254-b5221528890e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696060279, "uuid": "cd28fd60-3ddf-4d45-8d71-736ea2e5e8f0", "value": "bf55dee34ac140ac4f7d717900613fed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c70438-5f89-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696075587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696075587, "uuid": "1977bf0b-32a5-49ad-a359-398a7b92be5d", "comment": "Malware payload (Amadey)", "value": "b6b7d95632cc0243ac7d764209320692", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696075587, "uuid": "d26b095c-93ca-4659-9d9d-c89b2f0b80a8", "comment": "Malware payload (Amadey)", "value": "bbb74b26875d6e71a5b5c9b1ad4c497264f76dcb2a4c84b64e9d50691a986c8d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696075587, "uuid": "49d0485f-ce6b-41f7-af21-fa7794a99f20", "comment": "Malware payload (Amadey)", "value": "ab7ea51b0eec79436ea032766253266a718da56d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696075587, "uuid": "c37cf407-7644-4eec-afdb-a07a23797a9a", "comment": "Malware payload (Amadey)", "value": "5c6aa31f3f227a4784707be4996561e926ece07c834b03c14d473d0db897d1d7b256a33bfedac649af041b7579c53e12", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696075587, "uuid": "b800edbd-4611-4335-8169-dafd75018383", "value": "T1F42408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696075587, "uuid": "55eedcda-344a-4fe8-8de4-ab4e7827f00b", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696075587, "uuid": "9e39ac31-db3e-4759-a7d3-50330b04a90a", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696075587, "uuid": "228506bf-55b0-49a8-aa98-22564697b588", "value": 224715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696075587, "uuid": "fdeb2150-9f6d-4a3d-8a7b-976c99d28818", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696075587, "uuid": "5cbb0e1d-04d7-42bd-b8d7-06206d3558c7", "value": "b6b7d95632cc0243ac7d764209320692.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974c4c31-5f2f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696036850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696036850, "uuid": "45d35079-6333-4a32-89ba-24559719751f", "comment": "Malware payload (Amadey)", "value": "fcc0eaa09c250ae16d79d401da987b35", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696036850, "uuid": "f4ad7265-cbd1-4fb7-894b-09f941933f54", "comment": "Malware payload (Amadey)", "value": "bc2e58eebf1963c956f72bab17896b942103e31626cc18d5b1d20fd8c0ced3fe", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696036850, "uuid": "ed0a8bd3-c6eb-4c83-885f-784b043e48b0", "comment": "Malware payload (Amadey)", "value": "18cf22a09715f034c5169f08333f6490c31b005e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696036850, "uuid": "fc896af0-c1cf-41b4-8f4c-22bef6dafccc", "comment": "Malware payload (Amadey)", "value": "24bad6d634f0b0a7bc5cf8d13aaf619c54e4d113ffb8d9a6f649e45b3b6dbdd753a1d7d255214db67a5ab8dfee2f802b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696036850, "uuid": "a31187a5-8c6d-46f8-9d88-93da75ada5f4", "value": "T1D634AE11F4E3C472DC7215360AE4DBB99A3DB8700A955EAF67E40F7E8F30281D621A76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696036850, "uuid": "249545f5-fdcc-4992-bcd5-8de6e3138ed3", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696036850, "uuid": "9b3b5cd3-fba7-4d80-a3a5-5462a0bdff1b", "value": "6144:UXz4SHy5uoBMFGV5PEkIXEHvZAOmb8UDVs0BC+:NCmuoBMUOMx8bvBs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696036850, "uuid": "dee5cbcc-ea87-41b5-8359-f848e07bf35e", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696036850, "uuid": "277804a0-70f8-4eed-947d-894f7d76309e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696036850, "uuid": "a81fda48-4ea4-4715-be2e-0f82fb241646", "value": "fcc0eaa09c250ae16d79d401da987b35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27234c5e-5f51-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696051264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696051264, "uuid": "697f1ff2-ea0b-4fd8-ab64-f769dde56f65", "comment": "Malware payload (Amadey)", "value": "84d0eee58258548404fcf81f61aeda35", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696051264, "uuid": "c30f0865-28f7-439d-8452-c73c4eee5be6", "comment": "Malware payload (Amadey)", "value": "bc66a70f527b72aeb7a37db5c32290a41f3b83d8c2b187a17a5cabd9076d2c91", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696051264, "uuid": "89ae38ed-e7a5-4e9a-8238-81a0f8d87d68", "comment": "Malware payload (Amadey)", "value": "3b75bd12fd3ea50dac34dde02956415dcb8fd396", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696051264, "uuid": "8255512e-3db7-4e20-ae26-d054aa0d2ebe", "comment": "Malware payload (Amadey)", "value": "f3d6e1d9ee78e8dcbf0ad06231a65ec0bc002e09c4772b2e7a5af21c7bc806a8836716b38866cadcb6d1866145345051", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696051264, "uuid": "dbae6747-f60c-45f2-a3c8-974ba5b4e7e3", "value": "T15B2408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696051264, "uuid": "2af9b5c3-1667-492d-9d31-af3240aae29e", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696051264, "uuid": "075445eb-b90a-4498-9153-f88f386370c4", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696051264, "uuid": "839d6c51-3e5e-44f3-8399-dbfc91f2fb75", "value": 224372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696051264, "uuid": "0df57894-5d9f-4ea8-af14-47ea3c851b71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696051264, "uuid": "94e1f60e-8b8c-4e4b-a69e-11708ab45684", "value": "84d0eee58258548404fcf81f61aeda35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b12bbe-5fa1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696085707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696085707, "uuid": "60d57721-75ef-4f08-953b-deeee90c6469", "comment": "Malware payload (IRATA)", "value": "74b704702e1b5eb37d291df3f67932d3", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696085707, "uuid": "acaae5f1-2588-4087-a6ba-435bbc266616", "comment": "Malware payload (IRATA)", "value": "bc9e6d07ee2409f97083103009b8a0c29d0a91bc49855f3a4f203741be314c1f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696085707, "uuid": "82598953-4674-4fc3-865f-7af8f5ffcdb4", "comment": "Malware payload (IRATA)", "value": "4b7b6bff6ce39d7c30d94d75e50da09cb0721bbe", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696085707, "uuid": "9fd33e07-1482-448b-a5cb-b63f23811f90", "comment": "Malware payload (IRATA)", "value": "e337ba94c5470555f4e880cc035bccd6e30dd1e7b53034d5fd00e99919bed8d4b4524ad9c9c24701a207c85be59a97a1", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696085707, "uuid": "8f6472c1-d944-4ce0-bf46-6a57c97362c5", "value": "T132A533D7F226AA72D7D7A7711552C3410E362E30AE8352867C61B3AC62B37E8FF09415", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696085707, "uuid": "c82c132e-4dc6-40c2-91fc-525a294e4267", "value": "49152:AE75sBbnpD8UmC90TXArA14cIeG/xKl9ovH27GxGB0nH502Qmx6y:AGO6bC0SY4cfAG9ohxDnZZQm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696085707, "uuid": "48829617-c131-49c0-9788-7ff222041063", "value": 2239707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696085707, "uuid": "85a7e4f2-6d7b-4fd2-8a0a-bfaa6dacaba5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696085707, "uuid": "33614f7e-f84e-4696-8ec0-1678d88031b0", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c3b8ab-5fa9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696089412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696089412, "uuid": "804bce2c-abf4-4a30-94d7-fb3399a7ac21", "comment": "Malware payload (Amadey)", "value": "8f5e2cd6bc79e0febc31cea38fa52e6c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696089412, "uuid": "407dba5c-6506-4486-94d7-2984553a09b7", "comment": "Malware payload (Amadey)", "value": "bcbf938d0c51dbe362abb5b8c6e37120fd2ad3ab2a787fc83366107f0f1a311c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696089412, "uuid": "e3966acd-cfd3-443c-971d-3d25828c4f31", "comment": "Malware payload (Amadey)", "value": "8158f19a8df58444eb7eab05e750ce2e4351a589", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696089412, "uuid": "54fd598c-8c53-4e73-9ee8-ad5fc43e4557", "comment": "Malware payload (Amadey)", "value": "8038f52134c8f0dff2a8726f4e4040511a18fa58da43e63c9b9458fe0c2496747f835c8e02c9d3ace55cedc4ebf608cf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696089412, "uuid": "645a15e5-52f4-4355-a9fb-c5060c941926", "value": "T1092408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696089412, "uuid": "2c94a91b-c9b4-478b-b1b7-cfa77300df22", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696089412, "uuid": "4d217122-7d8f-47a4-932f-1164949c588e", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696089412, "uuid": "8f2e1624-7bdc-4cd0-8b22-c77b4e823457", "value": 224368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696089412, "uuid": "011b1011-2e98-446a-84fa-a8392579dad2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696089412, "uuid": "9010250d-cc22-469b-95b4-bce6d7c60f70", "value": "8f5e2cd6bc79e0febc31cea38fa52e6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57ea5a72-5fb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696092148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092148, "uuid": "a236aea3-5e8d-4a20-9d5f-b99e93047ffb", "comment": "Malware payload", "value": "473aac17809166bf28de22bc69be691d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092148, "uuid": "df495e09-9e1a-4c13-8d67-060e938af9c5", "comment": "Malware payload", "value": "be32373f5df36c7a3a9fa576fcc3dc31e242311538524c0052b92cb8af60642f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092148, "uuid": "007137ef-b65f-4855-b2ea-03f801389865", "comment": "Malware payload", "value": "9d04afca26ad22d4f9a67e6c0ee7c2598a33f899", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092148, "uuid": "83d56bc0-25c5-47e9-94ef-33408b599ee9", "comment": "Malware payload", "value": "898d904b525f4362effcf693181b382cad5eb94a833bd16bdf83d7eecd86c8f4dd634bdc6589bc432389da7b7530a6e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092148, "uuid": "624c4f62-900f-4b36-a465-9e53a7fb580c", "value": "T15D07BFB875047DE6E66F537BCA96ACDC13B626229B8BA4CE4064B7C30573375FE12804", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092148, "uuid": "b573377b-ff96-463f-9654-1e0d2d26958a", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092148, "uuid": "b7f4ac81-3eee-4991-b339-277a4c809268", "value": "24576:fwD3Xxz42akTMBIw8HSvYwgL2K9oU+7VkZ0f3iOm1rExLBnCq/L0sWaqt3zQbEH0:wz42akTMBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696092148, "uuid": "19980f6b-c033-424d-b9b5-50718650041f", "value": 16999424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696092148, "uuid": "665bdfed-2e3e-4d21-bf07-dcccf14376a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092148, "uuid": "55f6fa2a-a850-4b80-a5ae-9d3e2f6bfc4d", "value": "473aac17809166bf28de22bc69be691d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f921a1f-5f53-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696052164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696052164, "uuid": "802d58d3-0284-4d0c-8c56-301f112b6dd4", "comment": "Malware payload (Amadey)", "value": "bb44f5d6ca7c9b834469a46e04d97b50", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696052164, "uuid": "c8d3ab3b-159f-4c0e-a6f5-ded0e7f7380a", "comment": "Malware payload (Amadey)", "value": "be68dad45f912580b980ec1c049c1ea23d4bb5e1909345ba23b1756bb8820b1d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696052164, "uuid": "d89d416b-5d3f-450d-8320-a724b198affa", "comment": "Malware payload (Amadey)", "value": "38f6b282de49e3f044fbf30a053115832a21e822", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696052164, "uuid": "2ae4d799-1bbd-4825-b490-30399fcc21ad", "comment": "Malware payload (Amadey)", "value": "65339052e0c5d0b773ddbdadc15370fb93326c6ed9ffaf0f3b8846d3c69070681eeaa2c708357d53037028ad66c4ec20", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696052164, "uuid": "61706cfe-77b6-4413-a2de-602cf33ef326", "value": "T13344AE11B5D1C472D87213320AE4E77A5A3EB8200B655AFB67A40E7E8F607C1D731A7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696052164, "uuid": "20f1f285-19c9-4b14-804c-16674f38dca9", "value": "e6417806f636d3a26a1e8916d3e05d01", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696052164, "uuid": "6467a440-47d8-417d-9dc5-f3a2a0bcb93b", "value": "3072:Z0TeD0ctZI6461YHBe6Itf1/iTY6ce6pn++RcNLkBHgDK6gpRnUuEeAg0FujDnzn:Z0HctlMQMY6Vo++E0R6gFAOb9KMp2g35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696052164, "uuid": "0da7937c-c551-4d95-b8a7-e91ae811c424", "value": 276344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696052164, "uuid": "5f6780b8-4457-4c3c-923c-d3537e76fe38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696052164, "uuid": "c20ee8a0-d74a-4360-84fa-0aa7dfa6946a", "value": "bb44f5d6ca7c9b834469a46e04d97b50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9511f68f-5f28-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696033839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033839, "uuid": "2a352d18-6411-4c6e-aa02-a8be002fadab", "comment": "Malware payload (RedLineStealer)", "value": "7db90d1bdf586c55a2f40c6b563f9cbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033839, "uuid": "06afe165-6d80-42e5-9399-b8a1e4bbe5ec", "comment": "Malware payload (RedLineStealer)", "value": "be6f449b18b8c55d78c17b6b0b7c84e469458e319dbdb26f5b90bc7b4fadc2c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033839, "uuid": "12c94098-3b37-4efe-8100-637181aed346", "comment": "Malware payload (RedLineStealer)", "value": "bb0f0c4c6c25e7ead577b8eaaebb59307c42e9b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033839, "uuid": "2d35ff61-df89-44d7-ad23-db86bce28724", "comment": "Malware payload (RedLineStealer)", "value": "5c6d4874545b1be28c52b7cc71f06e0ff9802b37c18cbd3f72ad6e115a9c4933be3f55c8e38230004499606322607769", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696033839, "uuid": "b466f3f3-e989-43c2-b397-c34e302b3bd1", "value": "T1B534AF11B5E1C072DC7215360AE4EBB95A3EB8300D955AAF77E40F7E4F34281E632A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696033839, "uuid": "517feeec-b3f3-479f-9ce9-36ec0f9205d9", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696033839, "uuid": "e4a54caf-1b35-4dea-9435-86415c844a3c", "value": "6144:WDz4SHy5uoBMFGV5PEkIXEHvZAO31uA0PVs0BC+:rCmuoBMUOMx8s0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696033839, "uuid": "cda5d94c-322c-4b4a-bb55-1305878c0bdb", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696033839, "uuid": "0938fdf4-be39-4752-aac0-3826a40b3def", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696033839, "uuid": "4f82e9cd-4905-43cc-bdea-93a7d76f4454", "value": "SecuriteInfo.com.Trojan.Inject4.61510.8971.32593", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c5013c-5f54-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696052769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696052769, "uuid": "78b1a230-46f7-42d9-8263-8deeb20ac68b", "comment": "Malware payload (RedLineStealer)", "value": "f1308333597455d0be4f1823bb1d6dde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696052769, "uuid": "ecee43ad-78f2-4798-844f-d24a357f0fca", "comment": "Malware payload (RedLineStealer)", "value": "bebf0e0bbd5722c3b9e0e511eabb7e9055a321272b0f90b0bd38197b800b60ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696052769, "uuid": "38b6ded8-4354-4c3a-9f29-1be800c0263e", "comment": "Malware payload (RedLineStealer)", "value": "94885cd6a83c21a0a371f0b94cf36f37d6e51663", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696052769, "uuid": "ba6ea633-e466-47ed-b9b9-3b22dfd8f04b", "comment": "Malware payload (RedLineStealer)", "value": "7f9041df27ae5bb0d9ce665a09e20331a8540083ae251fa5f82df8676e075e7f31fbfce0053b6a77c42bebed67baee24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696052769, "uuid": "0dfaf028-f021-46bf-abf1-c7940f921f05", "value": "T15A352307A6DC9423D9B423B009F713830B3ABCA15E74932727D6AD6B0C71B95A93177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696052769, "uuid": "4c21d024-845d-48ea-9092-089bb5d41e9d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696052769, "uuid": "70db7ba5-95c5-4a1a-b853-7daff48b81e0", "value": "24576:qyPCtoTy6WRMxO4HMZrAb7P0AykurlIdq90fIga:xPgoTy64h4HMdO0IdqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696052769, "uuid": "33000c8e-f763-4616-841d-627ad2d7292b", "value": 1099264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696052769, "uuid": "bcc56882-f075-405c-addd-a170a7717174", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696052769, "uuid": "60e0d8f0-5dfc-4db8-95ac-5f80ff40e493", "value": "f1308333597455d0be4f1823bb1d6dde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94dff38f-5f41-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696044577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044577, "uuid": "e17acba9-9d67-4d88-bbab-46b88602c196", "comment": "Malware payload (MysticStealer)", "value": "2ae04669e3ca0338f02653445e52fd15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044577, "uuid": "6f696532-e0eb-458f-90ef-236d3669fba1", "comment": "Malware payload (MysticStealer)", "value": "bf3123f9b064cd14e3c265e97f5f120acc400731e75e04b44b5a3ca508017b5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044577, "uuid": "e09bbbc7-0d7c-4c2f-bffa-f8fc2af6cbbf", "comment": "Malware payload (MysticStealer)", "value": "c3d75770dff1b03d35ec7bfa5f57b325c2f7666e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044577, "uuid": "7261e0df-829f-4382-ab9e-a2f7c3a3c6f3", "comment": "Malware payload (MysticStealer)", "value": "c1c09924eb5be8941a8b3838ce31d13dddd416dd6a4900283db94c6ff58c41f52dae26f8b5a4d77d7e74825dae0e43c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044577, "uuid": "17ec4ac9-f1d7-4da1-8f09-49bebf91199c", "value": "T1A774BE05F4E2B473E8762C341AC4EF75997D76500684CDAF2BA74FFA4B34241D6232AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044577, "uuid": "20758dcd-bb8b-43dd-a9e3-e1b692ebcd27", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044577, "uuid": "c4e86d20-715c-425d-87b9-c051e07f11e7", "value": "6144:tgTeW/s5GqrO5aXnfEGIXWPvZAONy9GHkcDa3t+aiJHV+uL3qswVs0BC+:XmcGqrOk86xu4kcDwt+a2HV+uLaLs0Bl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696044577, "uuid": "a5ba3ad5-4daa-457f-ab55-1bb4af7c0051", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696044577, "uuid": "95607e22-6b21-4667-b430-40b495d08743", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044577, "uuid": "d6370c08-894f-4030-977d-f741dd5ddba8", "value": "SecuriteInfo.com.Trojan.Inject4.61510.19284.29774", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e7d013e-5fb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696095461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095461, "uuid": "696fe2a2-b008-4b72-bf1a-c2600f236b77", "comment": "Malware payload (MysticStealer)", "value": "4f7257bf7a15305d79286d0825c677fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095461, "uuid": "68d92843-d426-463f-acfb-b047805bcf92", "comment": "Malware payload (MysticStealer)", "value": "bfee209e1db1e4d79404c0e406b885323fbc76932df9b2c7d790687bd9d58c51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095461, "uuid": "71dd3660-5925-4edc-b2d3-933e08f7e4f6", "comment": "Malware payload (MysticStealer)", "value": "cd9c78a7c46407169c93068dc1e53ebfa57f4ab4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095461, "uuid": "12f5c0a6-0ad7-407c-8952-bae158845656", "comment": "Malware payload (MysticStealer)", "value": "c7f941c037d4787c21db613524349f809bd0f5c88cc079d008282a4eec129e64355f53f7859197596981cef7b9713cb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095461, "uuid": "e1a9d800-c342-41ac-9712-3054ba3cf048", "value": "T1CF54BE203EE0B330DE132A3067A15BB84AFDD53005B46E9F7E941A7759D02D1DBA49AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095461, "uuid": "b73650e7-ea33-4dda-baaf-8a8155a3ab88", "value": "5b961e24b82512d2a00ac6c970dad1c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095461, "uuid": "90b69a3a-243f-4454-8b1d-3cdd017a1a27", "value": "6144:WhX0644xW4P8t64FOI9mt0qYnOLWEbr5fVVM4Ej:We644xWMI9mQkrxmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696095461, "uuid": "5a8ebd68-00ef-4c86-850d-9b547fa06ef2", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696095461, "uuid": "d65444db-8d35-40b1-8294-3c6ad543ecb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095461, "uuid": "2202582a-8d40-42da-b6ff-7805c04d1243", "value": "SecuriteInfo.com.Win32.PWSX-gen.9948.15128", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3155730-5f7d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696070424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696070424, "uuid": "b19a3cdb-48a0-441e-b305-a44e2cbd2ea1", "comment": "Malware payload (MysticStealer)", "value": "39c35c325ae3da707d000359372a66a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696070424, "uuid": "bca9fb81-48a5-4f5e-81c8-ac1c0ca6be09", "comment": "Malware payload (MysticStealer)", "value": "c009b07f7f921bb2196d269aa2eb54e273ef9bbccd9a1f56023efd26eecd20c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696070424, "uuid": "bba7e5a5-1286-46dc-834f-d2de64e78086", "comment": "Malware payload (MysticStealer)", "value": "4462252892affd8065cd7e36bf410245380ad16b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696070424, "uuid": "7b141248-bd43-4475-b328-c2c84f77a017", "comment": "Malware payload (MysticStealer)", "value": "94195fbb918f9d24525843e471c03ca062d5ba37b0e668d274c4a75d8c9364edd63c53d6fbd2045d53de09666cc09e91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696070424, "uuid": "b0d5253f-9dcf-4653-9b76-74042fca4b81", "value": "T1B774BE20B5D288B2D57B1F3103B9DBB08A3FB45E0F6256AFD7E84BFD4E122419261176", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696070424, "uuid": "4740026b-ab96-4542-b80c-946ee0e75b57", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696070424, "uuid": "c6e8807b-cd49-4bda-8b58-73fb4c48afc6", "value": "6144:OiTeW/s5GqrO5aXnfEGIXWPvZAOjyR2KD2B7BEdUea0NUNQlay+WYIzcuW2DhzV9:8mcGqrOk86xAjD2B8Uea0NUG2pIz6Ys2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696070424, "uuid": "91de2d14-7b59-4994-a0ba-8bd15225037b", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696070424, "uuid": "b9e16d7a-868f-47a9-87e7-9f7d34233046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696070424, "uuid": "e33cd3f3-86cd-4571-8bf1-5615fe48c482", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd81b0fa-5f5a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696055436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696055436, "uuid": "f2a0bee1-055e-49c0-bbc0-41b4bca7e3d8", "comment": "Malware payload", "value": "f0b4338b55beb99cf6f1667729690af6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696055436, "uuid": "2236e1f6-347a-405e-81ab-bf1abc691f3f", "comment": "Malware payload", "value": "c01d6864be77980990dedb7c35949fa58f262128a55e3cc30ed78f207b6092c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696055436, "uuid": "50fe0937-fcbb-4334-b5b8-2384a4357b94", "comment": "Malware payload", "value": "8ab66ab39d52029f0c45326cb7a5565207183f4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696055436, "uuid": "69fd47ca-5ce9-42c0-8b79-afec0598466c", "comment": "Malware payload", "value": "3b2e8ce964134a591bf923c43b2d7989b7079f1002008cf19002ce9c95614e21758ecde5c6951e3a6042fa146b0bf1af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696055436, "uuid": "410371c0-9953-4ba4-bb5f-29bbd08d6be7", "value": "T1A4B533203ADBD1FEF2719030AB243F7657AAD3582F0A86F76344D10A877C695A37225D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696055436, "uuid": "3af2bf54-d6b6-40d6-bad0-d46db8b54e20", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696055436, "uuid": "e75191e7-449f-4019-bb64-beb50e57897f", "value": "49152:mcBflUuq23zJG7fsS6edpGBLio6vm6jFSx0ApkPwOav/wRKPia7:mIlUNOzUkpBLioboW0AGnanw0r7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696055436, "uuid": "7ee634fb-c63d-4199-9154-dea47e1c2ffe", "value": 2321528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696055436, "uuid": "f0248b55-2020-4631-9128-7a095772e61d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696055436, "uuid": "ae6b469e-e63b-467e-bd14-e64c356057e7", "value": "SecuriteInfo.com.Win32.Evo-gen.13443.27814", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c25c4d0-5f47-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696047058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696047058, "uuid": "923ce4a2-8a5d-494a-88c1-eff06ee43930", "comment": "Malware payload (Amadey)", "value": "ccdae656aaa6b9aa12bf1a744398d60c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696047058, "uuid": "0b72b281-2e6e-4a50-b2f1-ebe3d4993995", "comment": "Malware payload (Amadey)", "value": "c1c9658393f57ccb33e884d10635db1edc4ea12c877d5db2d4d299cc6e7cccf6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696047058, "uuid": "888dd55a-36f1-4f7c-9f04-11c4f0d229da", "comment": "Malware payload (Amadey)", "value": "0658fc7a1cb5ed06ed897afb239a22a7339eec2f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696047058, "uuid": "314d35bb-6a69-4c24-b12c-a239235775fe", "comment": "Malware payload (Amadey)", "value": "f3551c9d3852ed8b09f7e7dc39d96aae623a707a037bd2910c09b9c3d5a3b28e9dffecd8e9effec4d1ebddd40aed9f14", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696047058, "uuid": "db3db45c-3153-4028-8b6f-62af51e5b548", "value": "T1682408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696047058, "uuid": "07d5da8e-bc6e-4422-93d6-2ed490989675", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696047058, "uuid": "ab2912b3-4b55-4c05-b99e-52e4c86ba38f", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696047058, "uuid": "5e6347e5-37e5-4b12-96e6-c3f1cf198420", "value": 224325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696047058, "uuid": "59a42aef-333e-45d1-a66a-f784bced8cde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696047058, "uuid": "a1fb8667-fbba-4404-b6cf-a94528b685d1", "value": "ccdae656aaa6b9aa12bf1a744398d60c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54083497-5f37-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Meterpreter)", "timestamp": 1696040173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040173, "uuid": "14ca66ad-e13a-4d5b-b481-149987868dac", "comment": "Malware payload (Meterpreter)", "value": "56b15ab58477bd660bad4708938d8987", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "msfvenom", "colour": "#1A541B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040173, "uuid": "25681204-24a7-4c8c-9468-979b88de7a9f", "comment": "Malware payload (Meterpreter)", "value": "c36580036412cc938d9ecc1ce4747d61b9038a7e5e77447158d5aa134fed23bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "msfvenom", "colour": "#1A541B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040173, "uuid": "92582e2b-7a8a-49d4-ae3b-4d912acd83c3", "comment": "Malware payload (Meterpreter)", "value": "cd0b1b72b51f4985cca3ca9ea82c22a59d9cc9ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "msfvenom", "colour": "#1A541B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040173, "uuid": "4a9039b5-4dad-4d67-8890-ec30e4b05186", "comment": "Malware payload (Meterpreter)", "value": "b5c62763756f0faac119ce4e06603379388164a3a2e1f179c56edd59e5d28583f61a66bdc70a25beeaefdd541e984752", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "msfvenom", "colour": "#1A541B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040173, "uuid": "2157aaaa-ea3d-442b-a591-b74cb461fc56", "value": "T12C73BF42D6C41136D1A2023D27B52AB5A9B4F2FA3605C19B798CCDF6DBD1DB0A3263C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040173, "uuid": "c483883f-420d-4813-8d78-3f2a3f2f397b", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040173, "uuid": "7e15dbde-4aa3-4baa-8cde-d48cb1ed4c27", "value": "1536:ITysmp4pXaM33K+eHPBoo1bcN/+5Wq6NMb+KR0Nc8QsJq39:Gysm2XaTv6YYN+R6Ne0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696040173, "uuid": "dddb8443-f9d0-4054-a87b-871a778d70a6", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696040173, "uuid": "00e2da99-c219-4e79-825a-cccabbba025d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040173, "uuid": "ec9c4209-285a-47ba-9501-b338c8b6232b", "value": "mw2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dace35bd-5f4a-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696048559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696048559, "uuid": "2d9697da-d079-48c7-88d3-78b3f25392b8", "comment": "Malware payload (Amadey)", "value": "8585c424e0cb619f3b4bd487ddb61985", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696048559, "uuid": "1ca5db03-1481-42c5-9a25-b04ac290a19b", "comment": "Malware payload (Amadey)", "value": "c509a5e414082d60be4317cee46d4e093b176da4d88871bb810aca365d62c646", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696048559, "uuid": "cf540c0f-54da-452c-9f07-f2eb119ea892", "comment": "Malware payload (Amadey)", "value": "644f10b0819ecac749b17368b7bfb17ec734c19b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696048559, "uuid": "025a1a11-3eeb-4c29-bf6e-805a031232e1", "comment": "Malware payload (Amadey)", "value": "b4d3ee76896704551573c1fef0a44e944a161ff017e727a6942eabd3de33419240b90f8477f7e0cce30de09ca236c5dc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696048559, "uuid": "edb452cd-0fa1-425b-8f66-ca45d6e3e4c4", "value": "T1FF2408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696048559, "uuid": "2fd2933c-3cef-4c35-840a-66f3d4a2f9d5", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696048559, "uuid": "233ce160-efcf-401a-aedc-a9a1abfbe1b4", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696048559, "uuid": "68ef5a0b-339d-4040-aed3-ecd208cd0e7d", "value": 224342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696048559, "uuid": "d776edaf-d829-49d6-9308-13f625ec73c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696048559, "uuid": "d007ae64-3cdf-4288-8731-57a3567dd6c3", "value": "8585c424e0cb619f3b4bd487ddb61985.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "727d8a43-5fb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696092193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092193, "uuid": "c430e90d-ea7a-4bf8-9c62-8a813080c641", "comment": "Malware payload (Mirai)", "value": "c367e99394c041220f4d24215ccc15d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092193, "uuid": "400d35a2-537e-4e34-9d0c-7ea3174fc562", "comment": "Malware payload (Mirai)", "value": "c78005e143d6f87744712aea62d5f53058aa066720c4625ee14271ae99a6e930", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092193, "uuid": "72492988-f648-470b-99ec-606f4321447b", "comment": "Malware payload (Mirai)", "value": "3cdbb5cf2d35396f2ff9222705534fcc5cdfd404", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092193, "uuid": "ec1832b3-fe69-4262-92d6-73e05018641c", "comment": "Malware payload (Mirai)", "value": "8a7bfd40d5b3f2470e6768a97a020383bf71643aaf19092abfa454bafe515eb49ca0be393c5c61abcb1ddec3e1257715", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092193, "uuid": "710dcec1-4ae5-4333-84e6-82c43d15895c", "value": "T14D633A99B401AFBCF99BEAF941120A0DF421A25560930F27B72BFE937D710E1DD06D4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092193, "uuid": "d7e48171-950b-4963-a803-bf971b26359d", "value": "1536:lTg9OuTO+YbAyXcp2rOZZRya1W2TDPt+KHz82p:ey+YbA4ccrAz5wq+Sz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696092193, "uuid": "caff5f25-396f-4bfc-b560-2cae41fab79e", "value": 67216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696092193, "uuid": "53d18bca-ce58-4fd8-aa9d-59e8f5a017dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092193, "uuid": "472834c7-1297-4d45-8362-5948b3166f31", "value": "c367e99394c041220f4d24215ccc15d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07cca509-5fb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696095450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095450, "uuid": "eaa4bd09-39d1-4f4a-9a1b-6e04f3136e70", "comment": "Malware payload", "value": "595ef80ad213d8857ddf4d708d2ecc19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095450, "uuid": "ae9caaf0-2de8-4fcc-8039-7029eb76738f", "comment": "Malware payload", "value": "c8e8a8a9a64a9a2dcb8a5d34b7a28796565e0bab035f2583956802274190b0eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095450, "uuid": "b037039e-e14e-417d-957d-392d0f1d906b", "comment": "Malware payload", "value": "9c6d5aa8b05eedc46d371b1eb2fa6661fd9c38f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095450, "uuid": "2166b685-fad6-4800-9f43-5ea80f557bea", "comment": "Malware payload", "value": "2cd2f957e8ca787cb914ce03169257db7bbb4aab465e03a821ab484fdac8707d5031e4e1d5586ca0eb415e5d87bb763f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095450, "uuid": "c74a3b64-626b-4470-a7ca-89c309687178", "value": "T158359C85F9C380F6D3A12930096767359A7AEB471B34B7DFA279DF580E23D905833292", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095450, "uuid": "f1e9bef8-4cdd-46f2-a6e9-cfabcfdebae0", "value": "12288:wgVzxZRfIwXrNAMPuhHUXwNg5ZljTDijAq3+SXYxLNaUttxXMegcya:wU4eulUigXpVagx8egE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696095450, "uuid": "2d2b3ca8-7a45-4845-b934-f647015b4f5e", "value": 1159168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696095450, "uuid": "d71d37a7-5acf-495d-ba61-b1b87fd84a83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095450, "uuid": "03c48057-bb7a-4e12-942a-4d8ebafc0482", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.19917.8106", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e312133-5f29-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696034150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696034150, "uuid": "e8d74850-60f6-424f-b04b-44e2b1656413", "comment": "Malware payload (Amadey)", "value": "3ce392b983dc4bde7ebd81775ab0e7eb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696034150, "uuid": "43c82acb-771b-4122-ae1b-1326d319caa4", "comment": "Malware payload (Amadey)", "value": "c9401f3af4e3a346384dc341d1dbe3ae64e8c7cd1b1fae51558531393e8b0dfe", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696034150, "uuid": "daece73e-c9a8-49c2-a690-07eab79e8c30", "comment": "Malware payload (Amadey)", "value": "b9ab22bc01c1d733d802d4ff5482956a575f8688", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696034150, "uuid": "b0cb95aa-a9a3-4c6f-913e-e42035e8bf92", "comment": "Malware payload (Amadey)", "value": "4560d6c057ae94e589d900e30f1706007e0debd2eda11303080e79b34ac6cb043e3ea81c96781b4d1d9ee934462e718c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696034150, "uuid": "90cd1cf9-a6a6-4a7e-8e25-263272754c9b", "value": "T15234AF11B4E1C472DD7225360AE4DBB9993EB9300DA55EAF63E40F7E4F30281D632A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696034150, "uuid": "aa4b16cb-76e1-4894-917a-118cb3fcc86f", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696034150, "uuid": "944341ad-c535-40a8-8881-5a8d747d0532", "value": "6144:23z4SHy5uoBMFGV5PEkIXEHvZAOnLokVs0BC+:HCmuoBMUOMxdBs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696034150, "uuid": "7f6c65e2-eab3-46ee-adbd-26f0ae9855b0", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696034150, "uuid": "7225f254-645f-42eb-894e-9f3e6942fdb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696034150, "uuid": "95ca253c-5ab1-4c63-abe2-3d9a19c89551", "value": "3ce392b983dc4bde7ebd81775ab0e7eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86dcf5a5-5f9c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696083637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696083637, "uuid": "2e48683e-23c8-4a7f-9c65-195963181150", "comment": "Malware payload", "value": "0df79ec3a6461cfe058a6a83cfe8ac2a", "object_relation": "md5", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696083637, "uuid": "24c4670d-52f5-4122-b3cb-1251aac70074", "comment": "Malware payload", "value": "c97349d6317318c2f61733219d4bfc007fef58e7f35ced05c9b12badb5f6754e", "object_relation": "sha256", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696083637, "uuid": "c49a8b45-9b42-4118-a818-310c62e46408", "comment": "Malware payload", "value": "ef6d5ede139c9b8b3f907e9ff3e1703a52ff1567", "object_relation": "sha1", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696083637, "uuid": "9651ff37-c7e0-430d-a2c4-a701f5479bf2", "comment": "Malware payload", "value": "f977658d641fe5b288c7778f4c1d8c1e8d023d9acd99be71710fc1373b80ed930e79857b8f30048513e244d2ba7c1087", "object_relation": "sha3-384", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696083637, "uuid": "0c9d7733-f772-42c6-8d96-eaf54ae950f7", "value": "T1A813F80B1A755FBEF778C73986678B218794A2A247D5C949D03CFD128A1870EE80F698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696083637, "uuid": "5dff21f7-eb11-4c16-af23-4879ff49879c", "value": "768:F0jsI03LnCh55Mqs/0vPc0+Pc0eX4f9ZXBN7DDss/3ujMMIoDM0ldlW0JxwMVZ4Z:g1Nbvx+xL77nB/MQH3dIRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696083637, "uuid": "b556909e-a026-4bf7-8595-7d82c8622f45", "value": 41560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696083637, "uuid": "ff8b00ea-2ce9-4fd8-8d17-3c6f2e6a8ca8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696083637, "uuid": "10403581-a4b6-4760-a40e-1f7f7a738e36", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661dad75-5f39-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696041062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041062, "uuid": "068ebf95-8c88-4457-a435-dfe0bdae4ab5", "comment": "Malware payload (Mirai)", "value": "7712622b406f7bbf8ba62a28e1e35158", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041062, "uuid": "3834825e-e9cc-4117-a24a-cd0c4eb3ac25", "comment": "Malware payload (Mirai)", "value": "ca1af61fd2c6ecd3827b63604900beaaf6382c8bf6ef6b7a6e469e250f9b2e7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041062, "uuid": "cf0a389a-b7fd-413a-b9b6-cff4998bf983", "comment": "Malware payload (Mirai)", "value": "eb5fdd089b82ed7634965f6569eeb6c5302b5a71", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041062, "uuid": "17f81219-8af2-48f0-88e0-46813d819b15", "comment": "Malware payload (Mirai)", "value": "ae16893597bbe90fee216f3c6b7594a387836b877d5930143342d0734bc473b4f4d903985ad28967970c9ead02ba589a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041062, "uuid": "1b3e4559-74be-487a-b484-db0b69ed88ac", "value": "T1FD73C51ABF610FB7ECAFCC3749A91B0529CCA51B21A83B757934D418F24B64F19E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041062, "uuid": "51a9c7fb-3495-4417-9cdc-a006562c5ecc", "value": "1536:znTcO2ULJEAnDrRSWHQLgTPoMgr3d4MXRPd:zTD2ULJEApUiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696041062, "uuid": "ef66f0cb-a846-498f-95cd-7b7eae81a8d5", "value": 76016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696041062, "uuid": "408bf9d6-7854-4fb6-ac20-8498915bc143", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041062, "uuid": "5d6432dc-ada3-4fc8-bab6-edcad5028b51", "value": "7712622b406f7bbf8ba62a28e1e35158", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087af8dc-5fb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696095451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095451, "uuid": "a78fed94-04fd-4bb9-a4b7-7794b8bbd4bb", "comment": "Malware payload", "value": "c81b4d4186ed5568fd8606bfa0aafa3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095451, "uuid": "bdebc5ce-f6c7-4db6-8d41-e0a6e56477e1", "comment": "Malware payload", "value": "cbb06f01c562da87686ba5952c99cc0e3bf361a418dd261774be5d3f009b995d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095451, "uuid": "26bb50ff-b7fb-4f9e-89a3-0db180608d4f", "comment": "Malware payload", "value": "61ec767585f1f7f4096e34b094cc9f2cb0089472", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095451, "uuid": "dde3cc0b-81ef-4b42-98dd-a650d30bfd5b", "comment": "Malware payload", "value": "d697128a19938ca4b83e5daab765d52dfc353c3a1908298859bc1596714942150ccc5dc790de5613510a8c00e1e5532c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095451, "uuid": "62bcc74d-69c6-4b4f-976f-7253c8d186bd", "value": "T148558DA2E122C487E0D75430BC2BCAB95021FE57956629FD7AF97E2CDF36AC3B410542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095451, "uuid": "a3ec214e-c5ef-48a8-88f4-bbe3687886e9", "value": "12288:jhufBRgicAPbv6EmBzwhOaZ3hD2TRyzrPrBW0mwQVQujtQz6Sz:M5RA4i1sdMKrPrBW0mwi2Vz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696095451, "uuid": "6dae196a-2cb6-4e7f-979a-4b49e5e7f034", "value": 1318912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696095451, "uuid": "b7626a90-ccec-496a-96b1-286bb6517e6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095451, "uuid": "b8748350-fa99-41ce-9d9a-9df1094b9fa1", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.30479.21562", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f05aac-5fbc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696097408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696097408, "uuid": "2bb419d4-a650-4dc8-a1aa-4b7a258bfc2a", "comment": "Malware payload (AgentTesla)", "value": "ebe0c0bf3c56fc2f6dccddda8ff93dcd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696097408, "uuid": "837ab2ab-fe2c-428c-9bb5-729d0282e7dc", "comment": "Malware payload (AgentTesla)", "value": "cc141b7289cd7f46f00dec52019353138badf3df643c6d056b296257221016cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696097408, "uuid": "32788eb5-4992-4091-a285-f59f8bc93d18", "comment": "Malware payload (AgentTesla)", "value": "713c663eed7cadeb40bbbea1e56efa2829260350", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696097408, "uuid": "4393f8c8-4a98-4114-9f4f-a4b6942dba7b", "comment": "Malware payload (AgentTesla)", "value": "6c1abc72404a9b810b3d88cd4b68afb328acd83a36357d9c59e8fa68e17ac17165eafb26dbdb23832758cfc786884863", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696097408, "uuid": "8bbb9a14-2313-423a-8d96-a43c16fe8df4", "value": "T179141949B7F44909F8BEAB3248754C1A6774B4925923EB0D4FC184E92E73340CD9BBA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696097408, "uuid": "fbf334de-b1aa-4147-aa71-cfc232273503", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696097408, "uuid": "01c019ff-1df3-4731-8e69-36e19c057efc", "value": "3072:4rUoqpuiUFHAakH+LGP34o7KerVUzeeDXbwa21DX9ua/aHyvNUUd2mg:4rUoQHUBbdbwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696097408, "uuid": "a6e2b133-d8d3-4ff7-bb73-150652c871ae", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696097408, "uuid": "1cc5cd86-7cde-4c8f-9039-c122a00d19db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696097408, "uuid": "ba63e9ec-bcad-40fc-ae04-ec6ebdd6cfa4", "value": "expressvpn_windows_12.59.0.42_release.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d783d7-5f9e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696084518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084518, "uuid": "5ddebc7e-769c-433c-a1a0-97df38c84b16", "comment": "Malware payload (Smoke Loader)", "value": "195e87075a7924b2e8b6cc880c05b28e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084518, "uuid": "0c00dd7a-3a39-4fba-91a7-67724908349b", "comment": "Malware payload (Smoke Loader)", "value": "d055a2cfcc1c1c0399fbfd53b30b21083aed57ec6677f3fd4db61ebf01561356", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084518, "uuid": "6be6c730-0444-4572-93df-03fc711146b1", "comment": "Malware payload (Smoke Loader)", "value": "04e998ce99a1498b205245918c891fd553dbbb75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696084518, "uuid": "3927733b-edb3-4059-8db2-e476f0cd94af", "comment": "Malware payload (Smoke Loader)", "value": "f4b504a90734519c8081ae6a9c12df1aef5371ed49994cf997cc4d6346e99c348c3b38bd1eeb26946eae0b85591ae677", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084518, "uuid": "e8a780fd-cb23-4350-9e79-c5ed57645a5e", "value": "T19F348E2263E2FC61D577A6328E2AC6E43A3FF461CF68676A7318561F09711F2C663311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084518, "uuid": "4f99b504-69a9-4b6d-ae5e-90673f1a3ee0", "value": "5a388ef2cf242f40b496c828593b517b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084518, "uuid": "d255fb9f-53ac-4530-9a6f-2a27eca21c93", "value": "3072:iXjliYBn8cXICsADr2w5m7TfXKBjINDmOMhTd/kPgRSHY6p5V40J:ifxXI5WKwyfXKBszqhgDL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696084518, "uuid": "3b2813c8-8d92-4683-a508-8133d0d90200", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696084518, "uuid": "f26c4a02-54ba-43c5-8c5d-6f0878d9fb43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696084518, "uuid": "6afc868f-7284-4855-8b3e-e7a163c5fd23", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68a045e6-5fc8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696102484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696102484, "uuid": "475cf266-bb83-41fb-9144-1bfa55d8567d", "comment": "Malware payload (AgentTesla)", "value": "aae822cfaae4e1cfcdfc4f1dfdd7a966", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696102484, "uuid": "f73f262a-ba3e-4d6c-9e2a-5508d4e28b1c", "comment": "Malware payload (AgentTesla)", "value": "d06db1d822307914827ad6241ceba35895b95a5cb6d18629d0b6390b562204e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696102484, "uuid": "6af3228d-c7a2-461d-ab4c-922053da572e", "comment": "Malware payload (AgentTesla)", "value": "f22817ca641b30ddd80c05a6168169dc1d838af8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696102484, "uuid": "b2695731-0b99-455e-b126-95741741f721", "comment": "Malware payload (AgentTesla)", "value": "8a512fd07bf4b095129b95f247e20953fba36ba9c83712819880966451f7042022f320b1e70a583df257c291e46f3566", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696102484, "uuid": "2858a94d-7e4c-4fe6-856c-897e22868919", "value": "T194142949B3F81944F5BF6B7204B3480A2770A6524913E71E8FC748A93E737908D5AF6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696102484, "uuid": "dc39a9b8-bb20-48fd-bfcb-d5239026281e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696102484, "uuid": "2ffed9a9-c474-4da8-89e5-0ee80262a9e4", "value": "3072:sKOn4PobUb+BYkH+wWtaisGlIQZboLRG9ua/aHyvJ/4d2mdM:sKaBbU6r71GlVbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696102484, "uuid": "a2db989b-1ee0-436f-9c50-1b8fd62a728b", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696102484, "uuid": "f044e429-281f-4ef5-b3ba-8fc8f0b89796", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696102484, "uuid": "8c76768c-9fa8-4bea-8578-a493b568d20a", "value": "SurfsharkSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2511a82-5f73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696066154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066154, "uuid": "04c62335-1874-485e-82ed-f6345085b528", "comment": "Malware payload (Smoke Loader)", "value": "f527123515933e90671b0d495488b378", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066154, "uuid": "71dfb7f0-9f33-4219-b726-ed0b2acbec32", "comment": "Malware payload (Smoke Loader)", "value": "d146fc39118048d1a7bb6f6ec6c51d2efb674a39e4d4df9d54d45b084831e47c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066154, "uuid": "40d795ce-ff7a-47e2-b8fb-826e26b938c4", "comment": "Malware payload (Smoke Loader)", "value": "af6794083c022012777ee0b632363f078999337f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066154, "uuid": "cff6e6db-3507-425c-9fc3-11a47498ea49", "comment": "Malware payload (Smoke Loader)", "value": "f90e2e21c0f6d954e88f4d7b52f3b685949c0b459516660f6bf3de3a8a5e81c8ac077440e8a0068a17089ae1cdb8c535", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066154, "uuid": "13af4823-a9aa-44a4-aeb4-e5c500782081", "value": "T17B34AF11B4D18C72DC7215360AE4DBB9DB3EB83009A55AAF67E43F7E4F30280D625A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066154, "uuid": "fe0bb650-867f-4e94-ae8f-6683d71dca8c", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066154, "uuid": "06337212-287d-47fc-badc-5b0133a37c3b", "value": "6144:no0z4SHy5uoBMFGV5PEkIXEHvZAODxYYzVs0BC+:0CmuoBMUOMxd9s0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696066154, "uuid": "43a025e6-a50e-4433-a2df-71c09189c0e4", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696066154, "uuid": "55b4bbfb-1c76-491a-9415-31c5ef2e7f7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066154, "uuid": "5bf43a95-0cc0-43b5-8c84-b26e2f7a5fa2", "value": "SecuriteInfo.com.Trojan.Inject4.61510.29304.29384", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea548a8-5fb1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696092509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092509, "uuid": "bc240b2d-ecc1-4f9e-aa8c-785589ff8ca8", "comment": "Malware payload (Mirai)", "value": "371df120f559dab86db13e322a043f08", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092509, "uuid": "e57e2541-8481-496b-a65a-cc6f06a9a293", "comment": "Malware payload (Mirai)", "value": "d193921082760e7c64387896677ed24cc36cf72bb864b24e556b2b3e70d6cd2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092509, "uuid": "186bbb63-bdae-4417-8a2e-82f59e3dda55", "comment": "Malware payload (Mirai)", "value": "98b87877ff55e7d91a81084d8864451a15e49478", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092509, "uuid": "2fc77fc0-ec50-4c53-bffd-3b4b003968b0", "comment": "Malware payload (Mirai)", "value": "28dc75b74a08869cdcc11cb10f7aefbbed8ea5b22209567841e19e0a399f74ae7dd212f1dfabb425a779eece4861dafa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092509, "uuid": "404f29b3-d8e8-45a1-809a-35a9650faa8f", "value": "T15D04A75E6E228F7DF668873047B79E25975C33D627E1D644E2ACC2101E2029E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092509, "uuid": "eb66756f-6946-4641-9e1f-cf7febccf6c8", "value": "1536:MBCkd7owqFdXd/3zQmdWn6ygwaNU2eu9WqayrXTvcStzBFTXpAY:DkdEwkjbdWn6yVaOk9Wuo6zBFbpAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696092509, "uuid": "e3e311d9-cc21-4039-95e3-c56f8f7edafe", "value": 182768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696092509, "uuid": "54a126b0-35e3-4f75-b4b5-0bfc0b860caf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092509, "uuid": "bf84fe20-1c8f-47b8-a8a6-d3f61ae18830", "value": "371df120f559dab86db13e322a043f08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41516da4-5fe2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696113585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696113585, "uuid": "ce39480e-c392-4886-9248-64d43a41562f", "comment": "Malware payload (RedLineStealer)", "value": "4413e6b96bb1b524585049dc2b7d5d08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696113585, "uuid": "1a31e6e5-d281-4e52-97f3-87fd13914de2", "comment": "Malware payload (RedLineStealer)", "value": "d1c7bae315ef64874ac2d709211ea2ef46030e368903da91373df42554f70384", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696113585, "uuid": "771a47c9-6acb-407e-9c2d-8996b50499ad", "comment": "Malware payload (RedLineStealer)", "value": "35fdea08bd3dddc136d91792737c825c193d2d9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696113585, "uuid": "0a0a18e1-aac0-41f9-a7d4-9d85cab8bc59", "comment": "Malware payload (RedLineStealer)", "value": "7e44df0fd9e6a6c0f3228fc1627b181c54e77ca683264acd31e6621c6a2cec1a50a796e920fa3f6256c317b93e23ee9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696113585, "uuid": "e85e5d52-deb5-4d93-be45-4d8043501ade", "value": "T12A84D02362E0FC60E5666A318E2EC6ECF71EB451CD186B7733146A6F29711F2D263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696113585, "uuid": "3cdad7b2-438e-47d5-9fd4-167616ba5462", "value": "eb89aa3fcf43b156dad667e281a2675a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696113585, "uuid": "98dab430-47a0-4a19-b63b-9120a3be0e42", "value": "6144:nJNwgJ5Sy4AAV7jTmVZDzUTR/rfksUHP7Ti/hvtnXvwOeZu8QSXWNJSxaAT:nHwgOAs7jK6RbkB72JFnIjYHgWNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696113585, "uuid": "d2cadac4-016f-42e9-8001-3cbb90fa7dea", "value": 395776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696113585, "uuid": "e79e5b5b-f537-445a-8c16-ee990709cc7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696113585, "uuid": "ced22971-2102-449d-b76b-57501be57a9c", "value": "g.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a993fe2b-5fa6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696087990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087990, "uuid": "512a1e17-ac1e-4b60-b996-2649433e6f63", "comment": "Malware payload", "value": "670d13819a751e33fe827c9338afe857", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087990, "uuid": "eb87a573-8659-4768-aa10-4770cf79abff", "comment": "Malware payload", "value": "d1ef6523758dd7695999c252c63b8dc8ffac74c4b1a672457a1780a9c812d03c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087990, "uuid": "74bf70b4-429a-4ff1-9127-66cf614b2292", "comment": "Malware payload", "value": "1bd37c7baea0cac7f507482e1103699272ec30a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087990, "uuid": "d1e7023d-94c5-4611-84a8-ea784e4ef041", "comment": "Malware payload", "value": "7452c8a7a7e7f216b668ae2198b58ecdaa8044b7dd76c08cc055d8fd17d10a7bd2267f2f10b1970a6e0e3cd8ab05e1c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087990, "uuid": "de501e5c-4dd4-48e6-9cbd-d4b59fa54873", "value": "T13FB5335239E2C8FEDF4265319490BBB660F3D3DD0F2655FB534469180B3CA83A271E9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087990, "uuid": "28627e47-3cab-4f22-bf96-565a0847f808", "value": "1d0e3506c01cb61e9312cbea4911e92e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087990, "uuid": "4e5f277b-5428-4efb-b023-274248ff73a4", "value": "49152:UJGi2pWOIds+NZwD5l0HMbW1jnZ+TYEl0j/ALkwFMWSXo/JW6TqJSVsb2ddQMBC1:UIi2tAs0+tl0HMbkV+TYEK/9wT//bWQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696087990, "uuid": "79263aa6-0e91-4080-a766-322c1e6ca863", "value": 2329507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696087990, "uuid": "9fb06eb0-1e1d-47eb-b9fc-51a756629412", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087990, "uuid": "3d69d709-3ff1-4578-87b0-a6375f741b27", "value": "SecuriteInfo.com.Win32.Evo-gen.14215.9848", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29a10ff6-5fa5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696087346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087346, "uuid": "f72c6bb2-4def-4928-b68c-e9a4f8e8cddc", "comment": "Malware payload (IRATA)", "value": "9c72293e5e1b91d4dcab9f2c0cc4983e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087346, "uuid": "dff45665-e10d-4dc5-a70c-a2d525ac3a11", "comment": "Malware payload (IRATA)", "value": "d2c519f378a23cb9a912d7f405a0a391610373cd780087079e148f436afb9238", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087346, "uuid": "cf4d41ac-fb67-498b-b403-d16e7fab89d0", "comment": "Malware payload (IRATA)", "value": "b4f9898b4cf71fbbc52d05d645549ac9792c159a", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087346, "uuid": "419b845d-9744-4682-a382-23de9c9c5f0c", "comment": "Malware payload (IRATA)", "value": "9e67611857b757c2958165aa387edbe3f12e78db8c42de72245136a31402b44cf4ad3e1a92bc949d191bd18db265e06e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087346, "uuid": "efee0734-ec61-4069-ada2-5c751519afc0", "value": "T108E53347FDD3A02DFF4FC438E06640A3BB1C76D8895A6DE15B419C162EA2D006B6BD78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087346, "uuid": "7c93f82f-fbe5-4de9-bb37-3c28456efb22", "value": "49152:N1xA2zYFMuHL0trBmgHPmibCd0fJL9Q8gwzu6WepM4T3vSus/Ip7f1bc:Ns/FMkwtrogHPtbkkJL5gwzlWedT311Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696087346, "uuid": "441eb901-84a7-4f43-8c89-8ea843ce4254", "value": 3118260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696087346, "uuid": "d1150c03-1b52-4bd9-a1cb-c6093ca41e71", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087346, "uuid": "e915e636-4995-43bc-a883-cef26465edea", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f4af5e-5fa4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696087265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087265, "uuid": "c9df157e-bcf6-4e59-9b98-e96af93eb761", "comment": "Malware payload (RedLineStealer)", "value": "1dcca4fd91773d19e335adc19b1bc755", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087265, "uuid": "51a576fa-1bc6-4a97-bd20-868c7ec846c2", "comment": "Malware payload (RedLineStealer)", "value": "d2df5bae26f889ee542587acee436b65203f8d827f5aaaa0a285a0254f763bc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087265, "uuid": "d9c61c52-69b2-4bfb-b07a-e888dbe132c3", "comment": "Malware payload (RedLineStealer)", "value": "0225b752dfcce51ba15fba99625937206fb30c7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696087265, "uuid": "8b3b18a9-7f89-442f-88e2-1d42568a84b7", "comment": "Malware payload (RedLineStealer)", "value": "1a63e911c18a89410ffedab76ca3dcfc12b84c327cd7162626365f4c6ea15d4e2981362d7e6fd19de68a52dd8358fb6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087265, "uuid": "48ba35a4-048e-4469-97e0-efd19f25628a", "value": "T18184E127A1E1BC64E9676A718E2ED7D47B2FB461CE659B1A3318872F0C701F2D263305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087265, "uuid": "9db21c13-d8c4-4753-935e-4ca52ef9bce9", "value": "5a388ef2cf242f40b496c828593b517b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087265, "uuid": "a65cb639-6c98-4952-9ee6-c9f3ec412d5e", "value": "6144:xnh9A0rh+3HkmZMNaxFx/Zkddf6r9jUQj6vtgm2Ou2:xh9AA+3kAWaB6OpjF6vtg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696087265, "uuid": "4e7c6b68-7ed0-4212-bfe3-df959faa696f", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696087265, "uuid": "54bcc48f-35bd-43c1-8a66-bfd365440d1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696087265, "uuid": "a39466a9-fefa-48d1-9301-a3f8b73bb59e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097afe4c-5f5d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696056369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696056369, "uuid": "b1658adb-515a-4bbc-b246-66b87f67391f", "comment": "Malware payload (Amadey)", "value": "fb238c7da575be1fd1f78df6aeabedfd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696056369, "uuid": "180e9c51-8646-4895-81a0-2b84fe7da9f7", "comment": "Malware payload (Amadey)", "value": "d33fbe53889b9c127780bc15c3c98339dd3b773ccb57cccd6c1eb26d53fb6690", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696056369, "uuid": "f7100880-eaff-4de6-9bff-db83c77fd5c5", "comment": "Malware payload (Amadey)", "value": "8237626719645359fd6d175efe377d6698742250", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696056369, "uuid": "52a6d4a1-de07-4f0c-afa6-2360c4b63c41", "comment": "Malware payload (Amadey)", "value": "a8279768f01118065fab178f0290962e214ea771ea7a33f72fd443359c71ba05bd5937c1aa19151e66e50d3b6936a92c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696056369, "uuid": "d520e6af-ce63-4120-91b9-ce1409ef2a58", "value": "T1E12408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696056369, "uuid": "a3ac8533-408e-47a8-af7e-d9c4819d3021", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696056369, "uuid": "7a0f89c9-7a83-4c55-a404-d5dee5c3a554", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696056369, "uuid": "b7b32068-f12e-40ef-96cd-1c21f77cbd39", "value": 224410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696056369, "uuid": "1255c227-ecd3-41bc-8575-5c21020ae437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696056369, "uuid": "f95c4fa1-9d8c-4311-95c0-b959f06668be", "value": "fb238c7da575be1fd1f78df6aeabedfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f434ba-5f96-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696081050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696081050, "uuid": "f388ca9a-1afb-4374-9cd5-c2ab1068a2bb", "comment": "Malware payload (MysticStealer)", "value": "a4f2a650766595ed4b745f5abefddc29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696081050, "uuid": "9741dca3-cd0a-401f-a00e-aecb62be797d", "comment": "Malware payload (MysticStealer)", "value": "d400ae8368680805e1172303d27358f44dc6428ff6a304622bd43f79956fb0d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696081050, "uuid": "8a12af77-e631-4cbd-865f-62b2417584da", "comment": "Malware payload (MysticStealer)", "value": "82a6587a3b37b06fb325e82c7f35c79314de629a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696081050, "uuid": "c948a9db-6df0-4dc8-b9a7-276c518d529e", "comment": "Malware payload (MysticStealer)", "value": "984367165f8abea4b762a4b245bffc22f017a6136fb292d4302b539d8a7214043b30f992a27e695aa5c8647f27ab6a3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696081050, "uuid": "efe2895d-e503-43fa-bf34-78dafa26c458", "value": "T13F54C09A77C08BB3D8856D31C168D6AB87F5F8100BC0395FDFD8672ABD512A888D7817", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696081050, "uuid": "51d83e41-b2fb-415b-9f57-f50271365c4c", "value": "5b961e24b82512d2a00ac6c970dad1c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696081050, "uuid": "02af2da9-bc82-4feb-b7a4-4004d57a7198", "value": "6144:WhBnKajWpVP06xohFl23ha6sSHNEzZJ0wy5leXwbK7rj:WfKajWmjlaszZJ0wy5leXwbyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696081050, "uuid": "d32ebc4d-709a-48b6-9a52-f04f7dd5285b", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696081050, "uuid": "ecc8a1db-2305-4f73-baa1-1523f25f3920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696081050, "uuid": "2d9bc8f2-d39f-4c71-b433-034b3a51a1c4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70002637-5fb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696092189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092189, "uuid": "9649ff4f-5744-4f87-9255-d621331f55e4", "comment": "Malware payload (Mirai)", "value": "42060e4a7b0aca6bd8d200977b2f8bf9", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092189, "uuid": "0c5c6b0c-5c0f-4cb7-b9ea-2c217c49dda9", "comment": "Malware payload (Mirai)", "value": "d4933d467e1da4f2f1599438776f98ed32a91ff88e19d90bd7ff4fe18d185005", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092189, "uuid": "713e12f2-0ea6-4c64-b04c-c171ff45a192", "comment": "Malware payload (Mirai)", "value": "5cf1c3414af79da593e4f087424be2146ac653b7", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092189, "uuid": "e99f5925-a487-43b5-a372-32449d1e8190", "comment": "Malware payload (Mirai)", "value": "4bcd1293638fded0ea38b84e139783f3fa46e4d98e174835c3459a5bd4bdb9f8991d2103787ce51c785e4973b807f4b0", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092189, "uuid": "7ba4d447-be5c-4368-af0f-4d1ce338dbdb", "value": "T1E5633A07BD8086EDC089E1B802BF7579C066F1BC277571CB6BD4FF2A7A15E601B29909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092189, "uuid": "f4a0a58f-e06f-4165-bb9c-d8918add2f73", "value": "1536:Tfu73WGGE0DUm8lquk5OTeGdkmM1bK148/yUVI:6Z10DU3lqVZCkmMBK14HUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696092189, "uuid": "bf3308f1-c245-4b62-acf4-68b467fae229", "value": 68512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696092189, "uuid": "4011d8f1-2a7b-4f82-8a5a-80c42de27148", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092189, "uuid": "dcff1206-9238-4f08-90a4-13a063790f1c", "value": "42060e4a7b0aca6bd8d200977b2f8bf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9421a94f-5fa1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1696085807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696085807, "uuid": "dc02824f-0e21-4c51-80d7-d954c2cf92de", "comment": "Malware payload (RaccoonStealer)", "value": "d113b3debc7e0a2da4369dd8d1dbad53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "Raccoon", "colour": "#C8C58C", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696085807, "uuid": "da012519-e44e-4375-a748-1496ba3e9e1f", "comment": "Malware payload (RaccoonStealer)", "value": "d60d4da2cfe120138a3fde66694b40ae2710cfc2af33cb7810b3a0e9b1663a4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "Raccoon", "colour": "#C8C58C", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696085807, "uuid": "e220d20e-2770-4c3b-8972-34582baed388", "comment": "Malware payload (RaccoonStealer)", "value": "78e17bd7e30c66aaef91a5b5fcb36a036a1074b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "Raccoon", "colour": "#C8C58C", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696085807, "uuid": "fdd78185-de72-4cef-8443-5bbc3fc5bf46", "comment": "Malware payload (RaccoonStealer)", "value": "e212967ecc02bdfe9d63ef6fcfb98720fc032418e25be6a808429ad06a42868aff867f17a1da628bb8f87cf6b59bde5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "Raccoon", "colour": "#C8C58C", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696085807, "uuid": "549f1a97-9fdf-4529-a2f9-7fe7d1af6a7d", "value": "T1B7372312FA42C071E8D70171647A6B7E9939AF205734C4D3D7E02D698D316E27B3B3AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696085807, "uuid": "104b516d-7f7a-4d70-b11d-3b54054fbf01", "value": "df40d8be5c4e5f68cce5e2718020b391", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696085807, "uuid": "5e74d591-20a4-4d2c-95f4-aedbf89ae576", "value": "393216:nEwZORKlcGk9wNM6lnFKYcjGnMCArFDJgbgrD07fesSOB50OoIhCwkbrSv271mL3:EwZOgbF6t1JgkrKmsSc5NodZnA2ZmL6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696085807, "uuid": "b55aac88-5c95-4d37-bdf6-ed1c0106500c", "value": 23151176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696085807, "uuid": "cfc48472-974d-4fa3-aad8-4cbf024feeba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696085807, "uuid": "9b1678d3-ac44-4d15-ae36-d1e5c5ad4f1d", "value": "KSPSService.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f6e45d1-5fd1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696106254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696106254, "uuid": "dda40532-9bfc-43a9-9be4-ac19e11aafaf", "comment": "Malware payload", "value": "54c6771566036ebd397c1dddf86deb93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696106254, "uuid": "444c2281-2a1a-417c-ae66-c3a2e56a60f9", "comment": "Malware payload", "value": "d7017c00a3d60ff9c05f3a83e9694dd51c929ecdd1d339b9840c68bb8bce5e1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696106254, "uuid": "ff52ed55-e5d4-4223-99e9-9577593ecff5", "comment": "Malware payload", "value": "6139e66ab2934019ff9da4df152f76bd3ed0babe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696106254, "uuid": "71584e4d-ad5d-4bdd-bcd8-40d121e910a1", "comment": "Malware payload", "value": "e0b7001a1dd6f97dd3fb5dc20e8d3f0df3f2e01508bc23eaa64d4ff32d05c9d49cebddf8f9755acd1e8a63a0329590ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696106254, "uuid": "c1854076-0769-49b3-a9f8-77c44235223c", "value": "T1D6A533D713041869FC3BDAB07A096A0C0558BE6497B17958E9F28D6EB2EC00FDF561F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696106254, "uuid": "97dc3ebf-f0c0-47d6-a778-13807594db6c", "value": "7a5e2524b66da5177b4ec46d305a3dd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696106254, "uuid": "ae273a3f-7d7f-46be-9188-9182ae2e789a", "value": "49152:ISBA9NPpJasJGl511F2vWRrgOphLAhcf1fleW:IS69NP6sJoT1DWShLAhqflB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696106254, "uuid": "ac9a1703-bf6f-43ae-bfb6-1e1207dfb23b", "value": 2237524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696106254, "uuid": "b9a864af-0929-444e-92f2-0abaadc41f19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696106254, "uuid": "397aeba8-30f7-4a88-9cbc-5b4074fc5d10", "value": "SecuriteInfo.com.Win32.Evo-gen.24931.29498", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e1ab29-5fc4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696100844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696100844, "uuid": "b3ee8dbd-83ec-4af3-90e4-7305c9a76dc5", "comment": "Malware payload (Smoke Loader)", "value": "59e6dadcccfd3e9da5701469e06d0227", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696100844, "uuid": "be563d2f-6bed-48fb-826d-38acf5c5614a", "comment": "Malware payload (Smoke Loader)", "value": "d7c832e4aafba4e7d549484c3dc98442f78f31fc53604b87f16a7f7f51ba90e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696100844, "uuid": "19f1e863-ab37-45bc-88bc-2961048588d5", "comment": "Malware payload (Smoke Loader)", "value": "1e518e70113cae12162d1076073cf81e8f3bdf58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696100844, "uuid": "035a6dad-6d5b-4b0a-aecc-bf0c08b1e7d8", "comment": "Malware payload (Smoke Loader)", "value": "d01387132e32882cafbd1b8ea047924f64ddd5b7d72fa97b8ef2f0386e9e1b890c36b2ed7ebd503f20ec3f080cf7b369", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696100844, "uuid": "9b896b1d-0362-40e2-bb9f-a55536bb1a99", "value": "T19A940252BBF89072D9B52B3058F603930B36BCE1AD74932A3755A86E0D73680D43677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696100844, "uuid": "278d0119-6cfa-40f9-8f53-238781241a03", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696100844, "uuid": "37ce7dcd-9ccd-49ba-911c-87c53f10366b", "value": "6144:Kny+bnr+Cp0yN90QEm2E22sKoPOU6pUrh9VdM7A4jOOS0vVgrdOhi8zK8GIiLiec:hMrKy9042D22mxpAhaUayru85L7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696100844, "uuid": "3dd5ffbd-f0aa-4d60-9db6-568f082d8fd8", "value": 437248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696100844, "uuid": "6daa725b-d022-4dc2-b781-55fd8c5b693b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696100844, "uuid": "7f1b141e-bd15-42a8-9230-d23cc0967503", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e1f316-5fb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696095474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095474, "uuid": "71edecbc-7606-4e36-8673-dcc168920e95", "comment": "Malware payload", "value": "ec83b4eabdee9d3e7d3d2c04c874d1b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095474, "uuid": "52de37b6-f2cd-4a7b-bad3-b9d2cd345a21", "comment": "Malware payload", "value": "d84acd554675283504bdd27f2c36ee8dbd09dd89d3dff7f139eadcf186c3626d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095474, "uuid": "60ce1b86-e409-4b3e-ad12-122c0a946b2d", "comment": "Malware payload", "value": "dcf9c858a5244ae1528d334f6a2e2ad98709548a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095474, "uuid": "5c379bac-d32c-42df-8220-52c54c18abd1", "comment": "Malware payload", "value": "87d043a59ffbb2a2cdb5da97d75eff44de11117e72df11a38b5b0badcee68a839d89665a8dd27682f72214e417539f15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095474, "uuid": "14b47240-c3e2-4578-a250-a7263552c021", "value": "T169358D22B5A2C4B6C229053048E65775EB31FE464E14CFA397A8EE3E2D36250DD3716F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095474, "uuid": "5a9db993-f2e6-4d9b-8d3d-900cb8525763", "value": "addd867252a025b7478dbea31c7c4bf9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095474, "uuid": "127ab1b9-c1cd-4d67-9d20-0c9b30ec109f", "value": "6144:mPoUFAPxD/QdjRjk4kHjsAErxqGnxp8Ny8OYkHMNyV5IhCU/5+ZL5OlVsJb1lHY+:mPoUsDMdMPErx9UNQ0CUs1OnEstY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696095474, "uuid": "bc9d7ed5-8b9e-4351-bfc1-db08c2f1f237", "value": 1129186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696095474, "uuid": "7a83b8cb-e69e-43eb-a89f-615d309d7758", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095474, "uuid": "05ba0280-43d5-4985-92c0-3f6c93174ba3", "value": "SecuriteInfo.com.BackDoor.BlackHole.55951.25738.15896", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce38ea98-5f7b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696069584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696069584, "uuid": "20947f4f-781f-4cb4-ac0d-87f852ca61f1", "comment": "Malware payload (Amadey)", "value": "0b459792310ffbb162d73fa1b95e1e87", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696069584, "uuid": "97ddbff7-84b9-4b3b-914b-02ec265fb367", "comment": "Malware payload (Amadey)", "value": "d8562f03bf114e18ad19e16b792346134c36c63394b8efc1ba67dde9fe33cd13", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696069584, "uuid": "45ee139b-edac-412b-a25c-d7d6eadd4330", "comment": "Malware payload (Amadey)", "value": "e2fd97ac1e87ff3feb0d8f6de0596610ed911d30", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696069584, "uuid": "584cd008-914c-4f7b-b156-2ae4683bf52e", "comment": "Malware payload (Amadey)", "value": "40fa6a2b656921952843660d778fa95eed95e87cc72f50ee3d97f28e34457f0b71a57663568f39fb5f1bc7615cb5d770", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696069584, "uuid": "b4e4aa64-0377-451d-b39d-597b388516e4", "value": "T1542408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696069584, "uuid": "5c127e5f-fda3-4b4d-a726-a57d6a8ea2f6", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696069584, "uuid": "59b34857-e20c-4129-bcb5-9e27ca02b9a1", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696069584, "uuid": "79d2eb7b-cd3f-4097-b416-56d0af9273a2", "value": 224668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696069584, "uuid": "0b54f302-5b39-4974-b87e-f42477876186", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696069584, "uuid": "cc50903f-805f-4ccd-804f-63afc68551ec", "value": "0b459792310ffbb162d73fa1b95e1e87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd78c75f-5fe9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696116907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696116907, "uuid": "4bea0e7a-668a-4daf-a51b-ca89f9609a60", "comment": "Malware payload (Smoke Loader)", "value": "6c1581c681ae8cd6f6b09f159aed7219", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696116907, "uuid": "d90dca3d-3c0c-4a1e-9707-09105fdeb353", "comment": "Malware payload (Smoke Loader)", "value": "da66fedd7831c720e47597fda2295ebcb868479b9c21bc86646c523b99e3233c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696116907, "uuid": "adbc4c86-4ccc-4dfc-a1fc-122067d49dad", "comment": "Malware payload (Smoke Loader)", "value": "2918809f6da16e5111a24ff91dc9bb358faaac8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696116907, "uuid": "29d3f681-6b0c-4180-b57c-e71dc35007e8", "comment": "Malware payload (Smoke Loader)", "value": "1e3a037d6b940553edec22a5db063cc5d9c54c80abfe8a7b43210b0fc834beb9c868e57852d4b3c86b428ebec905d624", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696116907, "uuid": "40246b43-d65c-4c7d-9d1a-fb79abb1e0f2", "value": "T12B940256B7E45032E8B11BB059FB07830F367CA29A74836F2394995E5DB3984783273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696116907, "uuid": "2d49d2ae-6cf1-457a-a25c-24ffafecae57", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696116907, "uuid": "be11f42f-8171-4283-9958-6703f12fb1d6", "value": "6144:KIy+bnr+Np0yN90QEMmIOqxxJEJYz1XeuqLVMpbgrcWFNb1vFRQAy6WQ:IMrFy90ZINXOg0VLVMFWc8NbnRXlWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696116907, "uuid": "1e715928-47f4-4fdc-9f7e-725d2eaa0433", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696116907, "uuid": "d3325a0b-5458-4abd-82d5-0781f844f13d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696116907, "uuid": "38085824-9254-4423-9f9f-bdfd4e66c1cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd73add-5f49-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696048189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696048189, "uuid": "1e8ad78f-cf88-4d99-93bb-08c9d72619af", "comment": "Malware payload", "value": "e4c9538ee2e50662bf7c2b701b8d1e57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696048189, "uuid": "2ddf99f9-bdad-4241-8dac-d8ec9a50f3b8", "comment": "Malware payload", "value": "da9556ef3fd609709cc07f635978b1d428cd8bd681ebbe1679b5f7c10fa0270e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696048189, "uuid": "5858ea62-d3ce-402e-a25f-8fc2beaa6cdf", "comment": "Malware payload", "value": "0be1f4fb075866dac9138b1aa3ab2e1586915528", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696048189, "uuid": "4851213b-0a35-49fc-9975-7c6bb11ae2e3", "comment": "Malware payload", "value": "ef9817d5e78ffac1445bba303af850f889af3c2bfd8c3d9bd10d18deb995ea06d3c5f43667fabd40ede84149db28036e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696048189, "uuid": "eef773d9-d99e-457e-98cb-943632677e8a", "value": "T145B52324B7F188BFE94703328A593EF251B9C3475B151DD373815F086E3D998A23B6A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696048189, "uuid": "6d9f3504-e86c-4c17-9956-fcbd2634c31a", "value": "4ba3ea0d6362a841ec66a1fc0a1b874f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696048189, "uuid": "aca1cbd3-e075-4d4d-9da8-861fadf9f247", "value": "49152:ufaq87bBVQ+dZWakWcQIDI5eYB7HiP9kqvpQ1FRjro:ZpzZTZDCPGiQ1no", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696048189, "uuid": "15b1f3b3-e7d5-4911-89e5-8e9ef60ee9f3", "value": 2323332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696048189, "uuid": "af0706ac-0a3e-4f45-93a0-f4cace785bed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696048189, "uuid": "e4179f20-abb9-40db-90b8-033d1f5291c6", "value": "SecuriteInfo.com.Win32.Evo-gen.4881.25839", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f19a78-5f95-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696080414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080414, "uuid": "fdce8c1e-cd8c-4e45-87ae-3a8480046752", "comment": "Malware payload (Smoke Loader)", "value": "cbc24c273d88cdbfccedf65ae3f984d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080414, "uuid": "867da097-1063-4144-b6a7-eff99959ecd7", "comment": "Malware payload (Smoke Loader)", "value": "db4b2b7994ed1cd49bea3181bf97ba163eae0c48f17a82586432d8cf2f9c0091", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080414, "uuid": "a05cbdaa-a691-4490-bc69-88891f271669", "comment": "Malware payload (Smoke Loader)", "value": "b6c04fc2621cd2dc4481f4a88f6be42442f8ddb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080414, "uuid": "87d6dd88-689d-409a-96fc-5e12afe64a32", "comment": "Malware payload (Smoke Loader)", "value": "8e0a56f0451a65e724b63e966a24fbe11fd5d32e4f93b8edd2212d736c3400e0823b7ae2b892f19fa446d5572883797d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080414, "uuid": "292b644d-41da-4314-b7b4-09aa359c75b6", "value": "T1D2349F3362E2BC60E56766739D2EC6E47A3FF461CE655B6A33145A1F08701FAC263312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080414, "uuid": "b7126259-ebec-4e78-81e6-58742a490893", "value": "5a388ef2cf242f40b496c828593b517b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080414, "uuid": "403a4037-b393-4117-856b-b4f0769b31f3", "value": "3072:QXjxNb5BwAEVCNnXfGB3VdgW20OG/R8Xp5Vkvi8i:EP6VC9GB3EWpNCZ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696080414, "uuid": "d68c1cea-52ad-4e3c-9907-5b53fc1f7073", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696080414, "uuid": "d96bcd41-b3c0-40d0-9f88-bcaae6f7a760", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080414, "uuid": "a0523b08-a62c-4a5e-bf8a-270e7d6efe61", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90df36bb-5f41-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1696044570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044570, "uuid": "1701dd36-81de-425a-bd95-d9ac30bc86e7", "comment": "Malware payload (CoinMiner)", "value": "9fa0492f671ae03b7785f7ada9a5ba8b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044570, "uuid": "c001f75f-4104-403f-8fd1-62104862955b", "comment": "Malware payload (CoinMiner)", "value": "db606ae120306c9bca7d9b71b4fadf487c2b751fd4490365e23eb1ff4f66a2f5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044570, "uuid": "f4542658-7bfd-42f1-b944-4923be82db62", "comment": "Malware payload (CoinMiner)", "value": "abb13c61df1b4304e35f97a250b3a0a36ea833c8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044570, "uuid": "c9e817b5-a8a4-48d0-8986-3ed530e7e68f", "comment": "Malware payload (CoinMiner)", "value": "05c45efd9e4dc28a45a1e03328841002f8a03d5652f88c7d89e283f1edc9f65e65117da94cc22ebc0d9c947b2d55cade", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044570, "uuid": "24049514-b7dc-4007-a126-87804386fc17", "value": "T135042514B1FDADD1ED82CA35AEA0DD91EDE36B7C2313E7688C4C84D1207B5927683C66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044570, "uuid": "528b9f24-7819-4cb5-b88d-f61a0d2b09c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044570, "uuid": "33f709d8-4ef1-4a7e-96b3-84538beb6540", "value": "3072:tdcnjefohKpFKK1OHg6MQ6hR66R4idQe4hhT8UW33kAqlZ0g4qqXZvYQavwNB95V:HEjKCKpFNEdN6HzRQFQUkkAhg4pZzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696044570, "uuid": "99faf83b-39ef-42da-beb2-529fba3ca85b", "value": 184688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696044570, "uuid": "d92bb0f6-dd7c-45d8-a238-1b317834a0bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044570, "uuid": "d8f9c81d-3fa7-407c-a7fe-58b5ba8661a4", "value": "SecuriteInfo.com.Win32.Evo-gen.13929.5108", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "917ebe76-5f41-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696044571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044571, "uuid": "ce805a29-8741-473d-ac2e-39c2ea7ac584", "comment": "Malware payload (MysticStealer)", "value": "4fec8fb51507384fbf2df512a9109915", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044571, "uuid": "7f49b333-39ec-4807-8cfb-7e3aae9d3c98", "comment": "Malware payload (MysticStealer)", "value": "db970fbede4952c1e2f41ad41931062704ad80bdec98b151c99d052d009e79f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044571, "uuid": "aa4b9246-50ea-41a1-a361-17f94b07b056", "comment": "Malware payload (MysticStealer)", "value": "bef50c7dcac43c05094ff13f5c6957c625d256de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696044571, "uuid": "60a86f87-f8cc-4877-9462-a040fd287eb0", "comment": "Malware payload (MysticStealer)", "value": "c6618e97cdd7315d5cec117c3a22328658366c389468dd72374ecad9f531562d88e42433b83b328a9f445a01fc5dfd00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044571, "uuid": "aa2951ea-011e-42fc-9eac-44b9a7936e51", "value": "T1E674C02130E6823AED33023514B5A7F69A7E743205506DAB6BDCAF3D4D71340F2A6B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044571, "uuid": "24c79845-9fac-46a4-b153-a4fc8979bbd1", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044571, "uuid": "2084cdf3-ed8b-4457-9858-2d63c753c673", "value": "6144:zEYZx/d5kbrcja0ecz13/i/vZAO22TTplo3gnq7+qAxDtYRZxd+CzrWs0BC+:RRzkbrceu2xJnoQnzKRZxzCs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696044571, "uuid": "3aac565f-1f68-4ed2-ac12-75a9f834f624", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696044571, "uuid": "0a44d80f-da9c-4a81-9e6c-bc863f096c52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696044571, "uuid": "5263b340-55c8-4318-a114-50ea9c6b7df5", "value": "SecuriteInfo.com.Trojan.Inject4.61512.31162.3828", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d0cd37-5fc8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696102696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696102696, "uuid": "58967182-bb2a-44d7-a3bf-1995aacfcb1c", "comment": "Malware payload (Smoke Loader)", "value": "f28c9e14645c05a6b68dfef735b8733a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696102696, "uuid": "8041bd16-3229-430b-b681-ff038488366c", "comment": "Malware payload (Smoke Loader)", "value": "dba0a296342528c83bfa00fc33f2e61961fb256e7363c1470ddf076d9bf557a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696102696, "uuid": "380aad10-53eb-4481-867b-06b6239c29fb", "comment": "Malware payload (Smoke Loader)", "value": "00b37d1d0c9dc94a9be13e469eafa03ee947431b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696102696, "uuid": "9eacb095-f802-481f-9de6-2b494a228af7", "comment": "Malware payload (Smoke Loader)", "value": "1d92b47a8153f14f7d62fe86814be8bfbd399048395645ef59f13720514f2f5a33aab97071a65905bd4ab45b91b3cc3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696102696, "uuid": "76e46c78-e57e-481c-8b87-8a654b85d038", "value": "T19FF3BF1674C0D072ED66F93609B0DBB18A3EFD340F909E9F67980B7D6EA02D09536867", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696102696, "uuid": "51e4b843-7d9e-4706-b5d7-6025fe230864", "value": "5b961e24b82512d2a00ac6c970dad1c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696102696, "uuid": "a6da96f9-04a8-4f5f-bd74-0a8a17cb566e", "value": "3072:WhWUos6V+E7NWgHEjwAuIASGGhNpIPMoCBaEsQaICnxdwE4gzj:WhBrksgHE8AKSGUVsQaKE4qj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696102696, "uuid": "a54289c3-7fd5-4474-bd20-ca2fdf4e9283", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696102696, "uuid": "29743dfb-54b5-49fe-8a01-5d971691b043", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696102696, "uuid": "f6ce0719-9a75-444b-b9cf-46fb72a351fc", "value": "SecuriteInfo.com.Win32.PWSX-gen.1851.19268", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "719dc94e-5f6f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696064274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064274, "uuid": "e5db347b-4afd-47ab-b6e3-4e917912aaee", "comment": "Malware payload (Stealc)", "value": "e779e5cb64c80cc368c4f4236cf004da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064274, "uuid": "697fdbbc-b0af-418a-aae2-8bc2051d3223", "comment": "Malware payload (Stealc)", "value": "dbbce2e0a97721f542dcc8f4acf48e867a9896e47ab1e8fa5ad9ede1caab739a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064274, "uuid": "3c6607bb-fbd2-4bd9-8ee8-eeaf0dc2e1a5", "comment": "Malware payload (Stealc)", "value": "f376b6c29f786c6c4dbcf066696ffd7bafb72daf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696064274, "uuid": "5a4e35c6-7297-42d8-9916-1875c15ddf05", "comment": "Malware payload (Stealc)", "value": "e43134f6283acce045f63a47ffcf6d16dd3acec84e7a05d91fff16d6c26c80b68597e5c7edbdfa38586394eb35b36a6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064274, "uuid": "6a534adc-cc88-42c4-af27-e6c0aa197a25", "value": "T13E448E2261E2FC61D527AA724D2AC6EC7B3FF4E1CE59676B33185A1F18701F2D262301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064274, "uuid": "68ca1658-5d89-4e50-96ef-2fa8b5762156", "value": "50fceee6f3fb6eb6577a605eb92d5359", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064274, "uuid": "55a45d9a-5d5a-4652-ab68-2f897f0c4f84", "value": "3072:6hXjS1NfBEHHKjuJEKeidzxXStOmS6yf5I15V4FkiTC2:6F0oKjuyKwtOmSjyPiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696064274, "uuid": "4f7fadb2-f91d-4b0b-8a19-070e91403599", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696064274, "uuid": "af6fc363-9999-490c-94d7-ddae8372a0e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696064274, "uuid": "0a986b39-6fb6-4c4d-8409-7ee803fec200", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57299218-5f52-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696051774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696051774, "uuid": "20ac1f3f-85f3-4682-acd1-449ae33ec505", "comment": "Malware payload (MysticStealer)", "value": "e9678fb4483d6f273d1be66c2a623f29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696051774, "uuid": "50e277ad-e18b-4484-b980-b744f202c647", "comment": "Malware payload (MysticStealer)", "value": "dd57c654286a1a4ed22dcd754e5066dccb64e16f5641137836c9225d5f32ad99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696051774, "uuid": "fbf5fcf7-6986-474a-a644-a89634ac2c4d", "comment": "Malware payload (MysticStealer)", "value": "e2b3511eb71d3b0f1b27071744081e88caccde94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696051774, "uuid": "72815b18-3cc4-44ee-8639-5709a75147ef", "comment": "Malware payload (MysticStealer)", "value": "02a8ba768454b4842d8b7e7eed925961b7520db4d1e740a29308f402afab59e3d668f22996aeee89ab210ba4da5fc811", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696051774, "uuid": "dde792fc-15d1-4ac4-bdeb-ecc3a9366f5c", "value": "T17874AE4575F28031C63AF13527E9D7F4067D3D300EF556AB73A8CF2D2E28381A56AA29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696051774, "uuid": "b876a007-b63a-4817-86cc-a8d4a245cfe4", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696051774, "uuid": "53e83806-c331-4b85-85d6-51aea6a3c61c", "value": "6144:gLTeW/s5GqrO5aXnfEGIXWPvZAO3yIb6q0ROrWvCcVs0BC+:TmcGqrOk86xzmOy64s0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696051774, "uuid": "e50ea868-cc93-4335-9f38-9dcc9d9d12d2", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696051774, "uuid": "9c474f76-ae9d-4741-9002-5eb51371c6a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696051774, "uuid": "2859478f-8e96-49d7-9da7-5b66015ed88b", "value": "SecuriteInfo.com.Trojan.Inject4.61510.847.14022", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b0fd940-5f86-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696074088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074088, "uuid": "bd630d53-0a28-4958-924a-656174a6b223", "comment": "Malware payload (RedLineStealer)", "value": "c03acd369f960d8aa3b1cbe71d2a785b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074088, "uuid": "7de9e576-6eae-4dc0-aa46-bba2a75e7a7e", "comment": "Malware payload (RedLineStealer)", "value": "ddb7185f7da4beef972a1188d55c722a924862eb97c2fd42e5bbbd8d9074055b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074088, "uuid": "e44cb50e-8b45-4a19-995e-9dd1f5cb9c62", "comment": "Malware payload (RedLineStealer)", "value": "e0d6e5b89d85880e9c8cdca0dc4968d7b7a3a2b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074088, "uuid": "9aacf8f2-ff8c-4c4d-b30b-c3ca8aa022f5", "comment": "Malware payload (RedLineStealer)", "value": "f4fcd309c4d7d0946e74611bfd93315517ca25e33e50e8eabb9b53380dcd70197478bdc28f36213d40a18f51e1eed5ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074088, "uuid": "29ca7cbf-8785-430a-a79a-02f580b2ed46", "value": "T134352303FAE90C72E8B057B01DF603870E75BCD16966A2BB1659E91A4CB39D01934B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074088, "uuid": "3ed8a007-065c-4f95-b09e-7dca8b1222ba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074088, "uuid": "5e360faa-bfe8-4d67-957b-846674f4f7e3", "value": "24576:5yx/Jd2O4LkmHoqlORp+hiRb4ZxfoRz6oC5SECnjBt:sNJ1OxoMhiRb4ZxoPCAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696074088, "uuid": "e241e20c-816b-4ab9-8796-79cad62c5679", "value": 1099264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696074088, "uuid": "0b0c5be4-29ae-445e-9cdd-4691f092c885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074088, "uuid": "f88b5abd-81b0-4623-be6c-e3081488333c", "value": "c03acd369f960d8aa3b1cbe71d2a785b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf3b5cd-5f4d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696049554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696049554, "uuid": "c13515d3-b9a7-43f2-a729-92d56128c649", "comment": "Malware payload (MysticStealer)", "value": "17edf16216f0aa67c072afb99b55c920", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696049554, "uuid": "b04d5d89-8af8-464c-8f22-8cde36adc0e1", "comment": "Malware payload (MysticStealer)", "value": "dfce875351d7810b7f0edfe552c36f964390f9dce91541727cef20a353ce1541", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696049554, "uuid": "b78690e4-6a3c-41ab-953c-7c647a7175eb", "comment": "Malware payload (MysticStealer)", "value": "de02e08ac2ec466cbdc5e49fe10fda402d4b9ba5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696049554, "uuid": "252e883b-0917-4212-a6a0-bd465b79ab40", "comment": "Malware payload (MysticStealer)", "value": "490d9d68f21cd77e4d0776bb634618a6ab7317d19aa52a881439cb8c32332a1145495aeb84b881a1b7d8a939e5d5d259", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696049554, "uuid": "ee40d850-221e-4ec2-8218-5c5afc60f904", "value": "T1F674AF0170C1E037D87134334AD7E76DEA3EF824CAC66DAB67A44FBE6A34550D192E26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696049554, "uuid": "acad42a2-66cb-4da4-a23a-54456defd68b", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696049554, "uuid": "f83b50e5-a065-4ae8-a047-4c9b03e7edd8", "value": "6144:ypTeW/s5GqrO5aXnfEGIXWPvZAO8yuyxTeXki5jYQhq5rXPQ9MocftzeR55uVs0z:XmcGqrOk86xWE6Xb5sjteRCs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696049554, "uuid": "d075d212-d1ea-42eb-9b7f-9e4c8e47b3f4", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696049554, "uuid": "1daae49c-7581-4008-86c1-85472da5ca37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696049554, "uuid": "1f2c58c2-fc77-4fae-8967-74aa36aa7bf6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dde20c1-5fb8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696095460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095460, "uuid": "d72c6ec7-3560-4e2f-9712-be3f2a7a61e1", "comment": "Malware payload", "value": "2f49305deeb365c5c006de68f1d59929", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095460, "uuid": "29f4edf9-5345-4e12-bdb7-1203eee2af48", "comment": "Malware payload", "value": "e07f514577072b02a9713552dc73feceaaa7fd256495468e24e7942216cabb85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095460, "uuid": "63f90511-7d66-4e5f-b42b-9a8151bdac16", "comment": "Malware payload", "value": "0ac95ba6c703096ff7aae9069563126856faa795", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095460, "uuid": "a54b5123-f93b-45be-b877-bc667507cfee", "comment": "Malware payload", "value": "41d71f343af9389fe39d684a56c8c38f40b7c22c078c968b3e57d55f92e250d478a933b738bec03b5af363b09baf0b29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095460, "uuid": "52e87ff1-da2e-42e7-8f87-b191ceedd398", "value": "T107B38D09F4D2C8B6E9C163BE05E61B76AB35D470073ADB938344EE769E52180B40B79F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095460, "uuid": "7ad7fc62-b6cf-4c6f-a7c4-844b694eec74", "value": "e29216111be8758f004d4ae8b6c1fd97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095460, "uuid": "af547186-b084-4cee-8377-c411f6593f17", "value": "3072:slH4myxwRpyUTujHOhwwXZ+MsYpxOM8fcvFhKYZ:slbyxwRpyUTujHrwXDVuwKYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696095460, "uuid": "f82c610e-7a63-4aaf-8add-2a8d0d9cbf20", "value": 110151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696095460, "uuid": "bf908607-9be3-4370-a6a7-b83b8a011c74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095460, "uuid": "1577f04f-199c-4de3-8fcd-821fa960b334", "value": "SecuriteInfo.com.TROJ_KILLWIN.BS.10762.24135", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb08e6b-5f6c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696062981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696062981, "uuid": "6f697a96-8b6f-46f1-85a7-2e980057c2f7", "comment": "Malware payload (RedLineStealer)", "value": "a416b0efbba05a275def97d561121402", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696062981, "uuid": "682b2230-bb17-4750-8b1a-d2f9e27268ea", "comment": "Malware payload (RedLineStealer)", "value": "e178781138199b0e5dd1210a53b0c54a8c7a036ebaf94371f681a05e3e0bddfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696062981, "uuid": "4ee41996-e9b1-42a3-bbf6-7117fdc4fdfa", "comment": "Malware payload (RedLineStealer)", "value": "218bf0b07c36f1d06e251d9a643a3afcef13b774", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696062981, "uuid": "2543143f-6b43-41e4-96e6-8b647ff644aa", "comment": "Malware payload (RedLineStealer)", "value": "42a6975dd041f423f4c47f30e7e4d65d5190e369bd68d8cbd786cf961d0f452d87fad3e4e74160f4d0a7ae75e74ea6b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696062981, "uuid": "c0d85ddf-3d20-40ac-bba1-f93226abe478", "value": "T1503523A392E8C062EE6D67752EFA03930F3AB9142C71425B3786B41E1DB1494D4337AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696062981, "uuid": "4a951caa-ba5a-4dae-8ac0-56d2a5ea6c2f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696062981, "uuid": "804e6fb8-512c-4bfa-82a1-39718976b564", "value": "12288:WMr+y90iLT8z9prtUAAiZHHy2acSmM9ZtPYC7/+65dVlzcmCMFb6+lf3FG5GFZ4z:0yRKCAnKj9YCiEflAgG5G37o3vtS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696062981, "uuid": "983f35b1-71ab-4f69-a464-8df27cb2380a", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696062981, "uuid": "a6f3b455-57c4-4bb3-a063-775a4a878b57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696062981, "uuid": "1851229f-61e9-4969-b139-d54e7fa703a6", "value": "a416b0efbba05a275def97d561121402.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab5ac53-5f61-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696058169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696058169, "uuid": "5ecc546d-3cea-4115-9bfb-41c1a0f5ed63", "comment": "Malware payload (RedLineStealer)", "value": "f5bf3598aac36ae17821a805cd54e058", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696058169, "uuid": "bf919394-9dc4-4c88-b81e-bda38026b058", "comment": "Malware payload (RedLineStealer)", "value": "e2221eaa1d2663fb09dee7ae326f9f8c0fd2d1b6582662e5762eea72073db371", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696058169, "uuid": "2b1dcc99-61b0-4532-a471-943582c3d453", "comment": "Malware payload (RedLineStealer)", "value": "3c79c47de16b9ee27fe1fdedbec9428ea6735b8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696058169, "uuid": "29672365-ffd5-4432-9fe9-780fd51ae88e", "comment": "Malware payload (RedLineStealer)", "value": "4b8d3a9549689963e3fff012986e19bb80af088e48c437033293e8a9026454914d2f39bf771eb12ec2ac8b9bf61764c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696058169, "uuid": "62003654-5633-4009-bd47-75d1374b9d35", "value": "T14C352347EFE4A4B3E4B217B04DF903930B7ABCA15C754A2B3705A8561DB26C0693537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696058169, "uuid": "03e9d823-baba-483b-909f-6718d799a7ca", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696058169, "uuid": "137933f2-db84-4d10-abb4-84d572a9e824", "value": "24576:uyEob7GWR+eaez/McOlUiPD4YDkGqtmwDKqSeZiv8ouL:96WR+ZG/MDdDjiQoKqSer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696058169, "uuid": "0166bd41-8106-4b4a-a7a9-a5e0a0a0b4a5", "value": 1099776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696058169, "uuid": "de91315c-dd4f-46a4-a0c6-9b4fc53618af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696058169, "uuid": "bf39479f-680b-49e4-86c9-a1c57acd55f2", "value": "f5bf3598aac36ae17821a805cd54e058.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a81a01-5f9c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696083664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696083664, "uuid": "709cf4ee-07f1-4267-b8f1-1a5990729253", "comment": "Malware payload", "value": "83540b5a4f2ed7e628e9c1f01743c88a", "object_relation": "md5", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696083664, "uuid": "a752a5ce-faeb-4156-a976-cce9d8cd3ff2", "comment": "Malware payload", "value": "e258fb05f2f84435c3aaa7a94eba75a117dc8b6decdd9fd7e0910351b9c6ee14", "object_relation": "sha256", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696083664, "uuid": "de2057ee-e821-4756-8d64-534d402a915e", "comment": "Malware payload", "value": "9ca44fc63ae8749a7bbf98541219243cd086bab5", "object_relation": "sha1", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696083664, "uuid": "57381f35-f858-45b7-bf5a-8851924b24e3", "comment": "Malware payload", "value": "5c87f4cf725a11d28af32bcc031a8078d974cdebc3ab1b388593a0976ad92e45087a99f73b68a51228868f99bf4c571e", "object_relation": "sha3-384", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696083664, "uuid": "0feb283d-e3f1-4733-8917-6d6cc81a9629", "value": "T1E913A40B77248FF7D04FCC3B447A8F02045E990572982BB67964F408F7AA65F6AE646C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696083664, "uuid": "087a73ec-0c6b-4e1a-9963-3e8653a4a26d", "value": "768:dF50uiHwjfZ2UOUdOIbFBtbu48u9+gxR:Vv/OUdOIRbZlR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696083664, "uuid": "f2de2f1a-a997-4ffe-b735-7d12ec3574eb", "value": 42616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696083664, "uuid": "a08f5d75-1fc9-4298-93b4-1ffceae96ec8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696083664, "uuid": "a4c3a7c5-6528-4048-9e0b-4c7385b1b654", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3a6f65-5f38-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696040749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040749, "uuid": "b884831b-4a05-421e-b99f-e70f211d851f", "comment": "Malware payload (RedLineStealer)", "value": "a7fca5e75d2675826518bccb69750b5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040749, "uuid": "7ab70175-6aa4-457c-85a5-7b25bc254d13", "comment": "Malware payload (RedLineStealer)", "value": "e285cdb49dde88ce2720d40646a17520d959dd10613016fdadf93ac42c2d40fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040749, "uuid": "60c1630c-8460-40a8-abdf-b2e583d94346", "comment": "Malware payload (RedLineStealer)", "value": "b9b9740c4df08e2a2132541d461950e1503bcc8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040749, "uuid": "aaca3f0c-8f37-42e2-b84d-fbb0cdf55fd0", "comment": "Malware payload (RedLineStealer)", "value": "3c01d0e2acd5fb34d9c496ed0065cf41baa84acefc5be68063491feada76d968810f4d893157b12f3f2e8f9ec40c37c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040749, "uuid": "3d118487-6528-48e6-9723-31a32fa6319d", "value": "T187352315B6E98132C578677088F703C71A36BCF54AB06B2B3B93646E18731C4D4B67BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040749, "uuid": "1afb13eb-b67f-4c92-883d-92710bcabeb5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040749, "uuid": "0b21ce7f-510b-401f-8061-bd6ab6381ab8", "value": "24576:Tyk8gI1yw3QduoVyXKhExnfWYbtdYqzapSE7xBodsg0:mk8gCp3Q00yXKhkfWiapjuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696040749, "uuid": "8469d278-2736-4b05-b336-a1f383b82dc2", "value": 1099264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696040749, "uuid": "ad7f25e2-b362-4794-b43a-2845e2c58bb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040749, "uuid": "b77c06e2-afdb-4cbb-86a9-2d3cfac32445", "value": "a7fca5e75d2675826518bccb69750b5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe7fdd8b-5f49-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696048190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696048190, "uuid": "d6fd4f19-ac05-4bbb-a761-ad5a1adaf42d", "comment": "Malware payload (MysticStealer)", "value": "eee483531e1ad411935f8d345d9492c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696048190, "uuid": "bbfbb211-3bd9-45c1-8f46-1d1c8e324bf2", "comment": "Malware payload (MysticStealer)", "value": "e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696048190, "uuid": "2e247afb-c69c-47c0-ab61-05f3379630fb", "comment": "Malware payload (MysticStealer)", "value": "c7f69aade6bce67a54c768b6ee078fb3b294ce5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696048190, "uuid": "6a76d41d-d7b7-4803-8e21-fcb718703ccc", "comment": "Malware payload (MysticStealer)", "value": "c6e772cb56379b759efac36e2b61d8d5c1347bfccea65be45e62067647bb2e2789d83c2603bc9a899adf6cae78b3763f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696048190, "uuid": "d44a6854-8c4a-4494-941a-c1e12e8a6e35", "value": "T1AD749D61F8E3C0B3C8B10E354DA5EB78597ABD2406524E9F239D7EFD8E91142C22257E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696048190, "uuid": "9c58f9c3-b551-4670-8e5a-26f014934dad", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696048190, "uuid": "6517a726-e70d-405c-8517-277df24466e0", "value": "6144:UETeW/s5GqrO5aXnfEGIXWPvZAOXyftjXQTUr5cA72b857mML2GVs0BC+:cmcGqrOk86xutjXQTDjb8D/s0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696048190, "uuid": "9029aaea-b892-49f1-aa17-a1694febde76", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696048190, "uuid": "1fbd6c06-1083-4fd1-b101-9f93ff2a8551", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696048190, "uuid": "e78045b3-8ef9-49df-987a-8adafc4f8c91", "value": "SecuriteInfo.com.Trojan.Inject4.61510.5652.26217", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc8a941-5fe7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696115811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696115811, "uuid": "213d0e6d-114e-4381-8f3b-da3fbf416816", "comment": "Malware payload (Smoke Loader)", "value": "633dc163625079c7bd31f08647ac4076", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696115811, "uuid": "c8a248ac-0bda-4eb5-a524-2b8fba53ea4c", "comment": "Malware payload (Smoke Loader)", "value": "e40aa48bbd379996e93f19561ea54e5f0059efb319fd68b7fcabbb0ee4f92a26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696115811, "uuid": "e1bb4477-fc2c-4490-b757-8ad61db00a36", "comment": "Malware payload (Smoke Loader)", "value": "8d2fe572c3d6c21736c02cf0f0c50a912260d5cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696115811, "uuid": "6f28fc71-7922-4e2e-9b4c-6bdc0250e4a1", "comment": "Malware payload (Smoke Loader)", "value": "65cad8500fcd966c2f4d36f661426aad506decac015b7f8060571f1e1138653f701e435c322631752549b2c6e85022e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696115811, "uuid": "f2bef7e6-f57a-4ac4-91cb-ca823cffe00c", "value": "T10D348D2362E0BC51E5676B728D2EC5E8362EB852CFD9675B32146B5F18712F2C273312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696115811, "uuid": "6a9f101e-c94a-4d44-a79b-0f9bd4b89277", "value": "eb89aa3fcf43b156dad667e281a2675a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696115811, "uuid": "ad71ee9b-7750-4628-bda8-1bacc38dc6f9", "value": "3072:naXRAEsNvj8CgI8QMjXQTzlkK2scS5/Im8KpATO3:esN+uMWAgIm8KpAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696115811, "uuid": "4efcd5f4-ddce-4746-a20a-49f895dd3e0d", "value": 239104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696115811, "uuid": "7cdecec8-3d7e-498c-b542-5bf519fa0f13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696115811, "uuid": "cf2db557-1299-4695-aeec-e19e9ea1ce8b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "068e3c69-5f64-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696059370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696059370, "uuid": "25dd62bc-043e-49dc-bd75-04d9c8a20b87", "comment": "Malware payload (RedLineStealer)", "value": "6624430951e49cd604be63dfcdabe00e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696059370, "uuid": "30c9ca18-1b0a-4f44-8c77-92c6f6306ecd", "comment": "Malware payload (RedLineStealer)", "value": "e4db80c19fe012e19c27eac59bdaa07f2e5fd37528c51102abc8b20a0e9c4d8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696059370, "uuid": "7c7a6e24-9f46-412a-8b9c-0d0792a6eac5", "comment": "Malware payload (RedLineStealer)", "value": "22a5e960b9546ad9d4522aa66069b82bb5b90dbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696059370, "uuid": "ceb41b23-ee9e-4841-856e-c249299768c7", "comment": "Malware payload (RedLineStealer)", "value": "bad778b3c15ad57913b51be9025fe3be670870e9d29533b40c86cf2845bdc88e01388f1660b71e9fc5c4582036c1e582", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696059370, "uuid": "e32136e9-315f-4725-8774-cab0e227d5fc", "value": "T10D3523529AEE84B7C57A0B7059F70B830728FC666A74C3AE3747A94A4C33694C07176F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696059370, "uuid": "8459de03-2707-4598-a12f-46c6754eb047", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696059370, "uuid": "fd6c3dc2-69ec-4786-9e57-e8a300667e5c", "value": "24576:1yHdXiIuMqSBeMjA6LzyxPKL1OgwZ4at:QHhi7rMjzexioN4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696059370, "uuid": "808fa674-2b0f-4799-b031-3fd9d9a28c64", "value": 1090560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696059370, "uuid": "f31bd234-17fe-4eac-a667-34d0ed0719e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696059370, "uuid": "d4d204d0-2243-4d69-9ab4-778804a9234b", "value": "6624430951e49cd604be63dfcdabe00e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "711df91b-5f57-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696053965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696053965, "uuid": "655722aa-be48-485c-9663-3acdfa8eb147", "comment": "Malware payload (Amadey)", "value": "4234da38694016d13cbd4512435667d2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696053965, "uuid": "968b3f13-7708-4a1e-af5d-a02c4f9a34d4", "comment": "Malware payload (Amadey)", "value": "e51fcb75550cc995d553e9e5ff495438fb8f5c93b27570925a437f695f8cbe89", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696053965, "uuid": "99555bc2-94ab-49d3-8ed1-f6e35729cc2e", "comment": "Malware payload (Amadey)", "value": "5234a9850d95c38c465c9923d91349af0eb8b42f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696053965, "uuid": "32f82570-6b0b-4741-837a-5b8d238bd951", "comment": "Malware payload (Amadey)", "value": "2c8972ce1371786dba7e8906ad00892c05c5c2d7707c33e4a3101401a93e098a117243a934326567e27a9f6fe19461c1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696053965, "uuid": "80f84aec-046f-435d-8d83-57f0c5134008", "value": "T1E82408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696053965, "uuid": "370c10b4-6803-4a47-ad7b-c975125b4755", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696053965, "uuid": "e80e2c92-ffa2-4e52-a8c2-a7cb4b3866b8", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696053965, "uuid": "003d6d87-70cb-44a5-9386-2e087993912c", "value": 224391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696053965, "uuid": "3bd95d38-81d5-4d2c-89eb-8c6032fef219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696053965, "uuid": "aba688a5-c01f-42c1-8b58-5dc34be14c10", "value": "4234da38694016d13cbd4512435667d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c012236b-5fb3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1696093612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696093612, "uuid": "5a23bdff-1598-45d2-8ba0-07ee0d371e10", "comment": "Malware payload (AsyncRAT)", "value": "17f89183d951f5ea258d8d242368a3d8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696093612, "uuid": "ba3d00b6-40ae-49f5-88f7-6f83793843c9", "comment": "Malware payload (AsyncRAT)", "value": "e54c38c8d43f2a11ac1c997438d4586a3270f1545f8ef02b8992ebc35005823c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696093612, "uuid": "a37e1f2b-6f76-44a7-bfa9-7dd9752b7b7f", "comment": "Malware payload (AsyncRAT)", "value": "41d7143f06a9fe53b6d8fda2b6d7c629c7a7a133", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696093612, "uuid": "c6e35ab6-114b-472e-b8fd-6e13f187bb68", "comment": "Malware payload (AsyncRAT)", "value": "8cd3c6579ecfb2ac1dfb958c09270f3d9ab576676ae173c17d884756802bc180841ef419c9fa593caa0974d9fbb40c80", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696093612, "uuid": "00a04f53-f776-4731-ba30-c3e3412817ff", "value": "T155D4F102F7D684B2E5730A354939BB10697DBD201F34DA1FA3D8796CDA32191A231FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696093612, "uuid": "c2d8249e-9fee-41e0-9ca7-e98a6c0fe6bd", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696093612, "uuid": "25552e2a-4b4f-4a32-8971-22a1eaae0f7a", "value": "12288:NcrNS33L10QdrXjZDnDLRH6/cOOScBEcmJE28syNM34odu+K:wNA3R5drX1DDLRHMncBeFySIodrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696093612, "uuid": "8fb7ba60-c26c-481f-997e-f638fa50a56b", "value": 626772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696093612, "uuid": "bb3276f7-09c3-4804-aa54-4cf103401870", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696093612, "uuid": "ff2a4884-ceb5-496e-bee0-4fdf20d106de", "value": "17f89183d951f5ea258d8d242368a3d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68003e5d-5fed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696118375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696118375, "uuid": "ae5bf5c9-2708-493a-b788-dbb7c822ca6e", "comment": "Malware payload", "value": "5ae3ad3af91de0a5a47a42d39fc2561a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696118375, "uuid": "88989d27-8b26-4fa8-9b9d-a899cae7a1e5", "comment": "Malware payload", "value": "e68fd4f565a2dbbe16812c3cccc33e5bf2fe226ca51a6785351d778768b96663", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696118375, "uuid": "5695bb1c-d71c-4590-94a1-8b5859eaeaa9", "comment": "Malware payload", "value": "7beafb9251fa3f8d494343c514944145d1e469eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696118375, "uuid": "489797f5-9559-4002-bf64-73aa3ae74bd1", "comment": "Malware payload", "value": "fa7fef8692a931ce3c93c19b622796e344454843b31849fbdda9be950067c58758c47982510edd7da4e8ae6a2bc1e652", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696118375, "uuid": "a7fb5fc9-d74f-44fa-a47a-e074b0e20360", "value": "T169B533783BE584F6D0827A30961CB7B66AFDC36C4F1099EB7B64DF5A0E1CC608325529", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696118375, "uuid": "8751c221-409e-4616-88b5-f6e670fedc07", "value": "1d0e3506c01cb61e9312cbea4911e92e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696118375, "uuid": "4fa05449-18b5-41cb-9c41-4a7059626ac1", "value": "49152:WfO8oIltePw9KVxxaU1X4yqqD+ii3PQIdr37626LQb6KF84ev406:Wm8jtXcxxboyqqD+T/Qu762+Qb6J4evQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696118375, "uuid": "34e92b52-3408-4eb9-899f-d70d43f60ba8", "value": 2320037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696118375, "uuid": "59216685-618b-4161-885a-7177a0cfcc35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696118375, "uuid": "f4e21689-5517-4684-8e46-2629f5e77203", "value": "SecuriteInfo.com.Win32.TrojanX-gen.26990.19494", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a595c6-5f99-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696082426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696082426, "uuid": "5aa47335-7ebf-4973-881a-949f5c8cb7a5", "comment": "Malware payload (MysticStealer)", "value": "3e1eb53dcf1c0378f4afa2eed59ae817", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696082426, "uuid": "36efca4b-8e26-47f1-bb7e-57af77cbac07", "comment": "Malware payload (MysticStealer)", "value": "e75a7da5d11515731f461a52d8e083e2f46b7101d2d70077ba4a83e5757d9f96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696082426, "uuid": "81964344-b91a-4297-b205-ab6b82d48a2f", "comment": "Malware payload (MysticStealer)", "value": "f40b80d228806d4ce1380737eace3d82bf70ec8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696082426, "uuid": "1056a4a2-7800-4b4c-8168-b4dc45810401", "comment": "Malware payload (MysticStealer)", "value": "2a546c25fcbe467587a7c139b84263d96a22664bf153cca36e5a814fa0053792e0e967165446c0bf475e8b27b800c2fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696082426, "uuid": "2b88e69e-7a30-494b-9b45-78d1f69e081f", "value": "T10554C06279D18C3EE921E43B8630FC90457AE4BB0BD259E7827C353A7EB42D5047BD62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696082426, "uuid": "2f9a951d-66aa-4b00-ae68-c8b70c9c21f0", "value": "5b961e24b82512d2a00ac6c970dad1c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696082426, "uuid": "4afb981f-db88-405c-9285-e63e89bcd87d", "value": "6144:WhZk644xW4P8t6qe0lNvLpVYC8W9SXowf9Sj:W4644xWRlZpVYCD9SY1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696082426, "uuid": "6a1c7dd7-e663-4e5e-a812-acfcdec5deb6", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696082426, "uuid": "e02bfb9e-e189-4b55-8fa9-d1d04eea8662", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696082426, "uuid": "89f53489-272e-41b5-819e-0bdb4ee1b1ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94679c09-5f28-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696033838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033838, "uuid": "f27bd064-d8e3-4a26-af1f-e2825571984b", "comment": "Malware payload", "value": "5e403aaba5cde3f98d71d0b94c0538b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033838, "uuid": "2bfb16d5-1dd9-450a-bf49-05750c487222", "comment": "Malware payload", "value": "e7f0a03d34cf93e1dc0bc78b4d08436de180e22fada1628810873683b9b2ee73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033838, "uuid": "43e0afa8-8f59-4c2c-90de-1fc42801970d", "comment": "Malware payload", "value": "1c3a1f3e360d23a50dc2c2ade840cace7ef237fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696033838, "uuid": "67f54d83-b505-4905-b617-30f8582b1ce1", "comment": "Malware payload", "value": "c7dfefb86469817d86753e12e910b5f0d7d5c0a17f1a33c67401b1e62a4fdf03f6d91a80b1583466161ddfe4f9b81eaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696033838, "uuid": "2e33ee2d-4ee8-4806-adac-10b9e069a986", "value": "T1C7B53302B7E4847DE52635318E2427B685EEC35E4F366EF3A348C66D0A34DC2533676A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696033838, "uuid": "130ace6e-9855-4986-9879-add601a0d8cf", "value": "1d0e3506c01cb61e9312cbea4911e92e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696033838, "uuid": "0f0055c4-a87d-496b-b1e4-99d6de356bf1", "value": "49152:WfJPU05snBtsnHtkMJqk5DxXkFXMnaZKSMUxMdKxk0/R8T3BN:WClsHKM4oyFIWK+mlTRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696033838, "uuid": "c42659bb-7309-4f87-8486-79acfd9cb192", "value": 2329403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696033838, "uuid": "0bd94369-195e-4e35-9e55-ac1e9af4310b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696033838, "uuid": "c144b52a-3ed4-4054-ba10-1009e69ca32a", "value": "SecuriteInfo.com.W32.Kryptik.KSH.gen.Eldorado.16539.23365", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e837c1d-5fbb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696096911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696096911, "uuid": "3c44362c-bdad-4c1d-a25f-6a0b183278c8", "comment": "Malware payload", "value": "1625aa2e11acb7ed85896a5e5ab2d3ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696096911, "uuid": "a6662bde-5139-4aef-8edc-7f0b6c873fc7", "comment": "Malware payload", "value": "e8c975487099db4ca2b7d9a1f0c3901d22ffa6c476ae796a100db99945c63620", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696096911, "uuid": "cdcef68e-20a5-40bb-864f-395990ab7d53", "comment": "Malware payload", "value": "a1cb196ef1a86350f3a322d4d4d100c46d43d0ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696096911, "uuid": "28b76b4e-c42e-439a-b6f8-4695d2c00acc", "comment": "Malware payload", "value": "2a9005660c363ba2f636f490214c3edd59d91cf90af63e61483fb55f977fdba4fbda0db579bd1c1ea40336692ec06b4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696096911, "uuid": "5789c903-c257-4bc8-bde2-271d376206f4", "value": "T18B940253EBE88433ECB12BB06CF616931A367C615E78836B27455DAD1C73295A43233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696096911, "uuid": "4e0b785e-0d44-4045-a419-da5e853e43b4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696096911, "uuid": "11e118d0-c877-42ba-a2f4-5eef4878399b", "value": "12288:NMrHy90viXrioUrk1pG3aB/ptqsNUxugXb3:yyyoUrkcsKwgXb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696096911, "uuid": "86484a64-c2cb-4f9c-82ee-1072cb4f4e5f", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696096911, "uuid": "9939d1fb-92c3-4730-baac-a5d90237b0fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696096911, "uuid": "b9f59d2d-e68c-4291-b60b-dd531b71886d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f648204-5f29-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696034152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696034152, "uuid": "c6cabb16-ea79-4223-aa75-ded67873e7ab", "comment": "Malware payload (Amadey)", "value": "535b505642f561753d0600f9937ce07e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696034152, "uuid": "d89162e0-7947-46f6-b6ae-4b150a8ddbf4", "comment": "Malware payload (Amadey)", "value": "e8d9168072dd63b984e2f2113ddb1988efea60c9cc037aacde8723823088c59e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696034152, "uuid": "d8f2f0c1-c336-4c4f-ae89-814df6d7ed2e", "comment": "Malware payload (Amadey)", "value": "6c234f6baa3a4b88ae608feb2b21cd6961f48a97", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696034152, "uuid": "05f0cc60-ded0-494e-9a8f-f34547efa5b0", "comment": "Malware payload (Amadey)", "value": "56dcdc736e3e648ed1821556baaa22482d4e04aeb794a998838f2da760e4230ce507d881d3026a8adbb9ed0b4029b51d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696034152, "uuid": "8643bdf4-7942-493b-84a1-c0a9a955000e", "value": "T100152303F5F8C562D9B91B7058F21BA30A727C929EB8436B2746594E08F27C0E87577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696034152, "uuid": "b3ce25de-c226-4e9a-88ef-8467aa3d033e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696034152, "uuid": "ffeee7f3-1cad-482d-af5b-104450a48ecb", "value": "24576:syADpUa/4ZhoiiLPm+MvOBj1E7hrAVpAizxRi:bWuLZaiAPAmZ14FAIizx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696034152, "uuid": "aa0bf5c8-20e6-4c15-bb79-d010cd154d1f", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696034152, "uuid": "85056998-18b5-4aba-8adb-3060e2863ae0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696034152, "uuid": "1dd194c6-4568-4bb1-b0c8-bd68c941b39c", "value": "535b505642f561753d0600f9937ce07e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cd528ba-5f37-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Meterpreter)", "timestamp": 1696040161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040161, "uuid": "d84cf4b9-f5cc-43df-b02f-3e021288ce43", "comment": "Malware payload (Meterpreter)", "value": "e48556dfdcbfa33e4b5e15d7e462f95d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "msfvenom", "colour": "#1A541B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040161, "uuid": "af01d25c-5edb-4174-b663-d0d56cec1866", "comment": "Malware payload (Meterpreter)", "value": "e9df4a61a9bdfc03cfba5f03e7f0de75d40c5cc9c2d701d7d296f424265a86b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "msfvenom", "colour": "#1A541B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040161, "uuid": "950a8173-6ebc-4ad6-9626-42a75e8c0efd", "comment": "Malware payload (Meterpreter)", "value": "4a480627d858fb88bc90acf241c091c0568fc78a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "msfvenom", "colour": "#1A541B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040161, "uuid": "ecf4b57b-26e0-43bb-b1a6-7bb4d69102b5", "comment": "Malware payload (Meterpreter)", "value": "50f4d22973ae08582c16363b8b9c8d0bd45ba1d81a40f4dfe8f64937f167499a5f9d552a11bfd5f8ecb3ee56ad23c3d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "msfvenom", "colour": "#1A541B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040161, "uuid": "69efe3a7-5556-4aff-b405-e469dddcda58", "value": "T11E73AE82D9C85422C1A6127D2B753BB99A35F4FB3612C2DB354CCCE5DBC18E0526B3CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040161, "uuid": "4c671c16-504f-4f0a-a4c0-1c937d1c7616", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040161, "uuid": "f3f8fa17-8fd5-4de5-9fe2-b3a68b79df38", "value": "1536:IE9HQPZ6wVYTcMh3ln4jkK3PEpH8CayMb+KR0Nc8QsJq39:N062Y4s8CJe0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696040161, "uuid": "c42853cc-569f-4fe6-ab29-36fa58f0d186", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696040161, "uuid": "ea65d381-49b2-4cb7-8a8f-1a2ee661f01e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040161, "uuid": "575b4a3d-9660-4966-b9ed-92c2ed78019d", "value": "mw1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19bc757b-5fc3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696100205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696100205, "uuid": "c0f86a09-bbc4-4ea1-8cdc-1ca87bd6a229", "comment": "Malware payload (Smoke Loader)", "value": "3fc7f71d8e5c800b8ceb1883cff6894f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696100205, "uuid": "c29f86fa-d807-497a-a9a9-e87f65d4b538", "comment": "Malware payload (Smoke Loader)", "value": "ea52f94f1aedcff956e82d563464d6e18c6d7764e06696730da58f0d20bfd927", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696100205, "uuid": "b8831684-9ca1-418a-9890-5f1f319e9841", "comment": "Malware payload (Smoke Loader)", "value": "cd2dbcc5faaddd9a1c18e1eaff789ffc9dec9e6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696100205, "uuid": "18552089-11e4-4e80-bff7-7d3f8be7abf1", "comment": "Malware payload (Smoke Loader)", "value": "b90469b08b17144468a50a6b902d8f0bef10293726f9d69374eea686d166786dbc79d72367857abc38887da34da19848", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696100205, "uuid": "a12e0cf6-28c5-4c2d-bf94-adf10d996a2b", "value": "T123248D2362E16C63E96B6B718E3EC7E43E2FB551CF69579A3218561F09701F2C263312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696100205, "uuid": "8f70d1fb-7892-465d-b4d8-4bab2ee973de", "value": "d323d1063364fcdde3ec2d7fc616011e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696100205, "uuid": "2052e29d-7f54-42ae-9450-ae340c7db1f6", "value": "3072:9LGRvcUika7HWgp9P+bnKR6zL+mnCi+pTE5T4eOd55/jbagx:LH2gpR+rKYvYi6TiMeO96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696100205, "uuid": "3e6ab0cd-63c1-4da8-a731-9dfa46dc7249", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696100205, "uuid": "301bd4e3-b1fc-4e6d-abfc-1b9dde19637c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696100205, "uuid": "3ec73cca-a9aa-4f86-93bc-aafc9e93ce62", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f7bf346-5f95-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696080565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080565, "uuid": "a3d4e9cf-8bb0-402f-a889-a4921c1b3607", "comment": "Malware payload", "value": "4fdbfc428c73c88081e316131d31c8f1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080565, "uuid": "8ef5dbd5-dddf-45c5-9676-00e9dd684f85", "comment": "Malware payload", "value": "ec082b19afe88d9825cfc9b4c860ddfe40f1f46272fa13f46085b50612513b14", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080565, "uuid": "1cdc61dd-beb2-4db6-8f45-69df27885613", "comment": "Malware payload", "value": "e8468eef065f2fcd6a91d5e4290db026c16605fc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696080565, "uuid": "b1b304a1-f1ce-48ed-95ea-56d575ec5b01", "comment": "Malware payload", "value": "9d212dd28da9781ed31aebb5e068d710a746d65717a2930ae80133cf1173966f5b05989ab4a4c3d577d5fb1e094e66ac", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080565, "uuid": "af428dc5-229d-425b-8567-f9e7d8fa94a6", "value": "T1FBC4239867232FDFD30066F158C76CE85CF075EA823469264A4A08FE685E91E75FC1CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080565, "uuid": "4012e201-b768-40e5-a02a-04df61e2a032", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080565, "uuid": "d8ef5047-473f-4eb3-8edf-6b925e2d0657", "value": "12288:+R5nWFpPoSmriXio2SJ9IPTNbR7w5wImXIExQTQwVbB0+:Vb8iXjZG5VZHIkIVbB0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696080565, "uuid": "ef8c6b74-1181-496e-9e3b-444be36c09c4", "value": 588861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696080565, "uuid": "7f118d89-9448-4414-b25c-ae029c09aaa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696080565, "uuid": "e27c0b51-2d4c-4288-9ccd-8a8036ecdba7", "value": "SecuriteInfo.com.W32.Agent.CE13.tr.26610.20189", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594df924-5fa4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696086997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696086997, "uuid": "e192c702-1316-4232-92a3-a07061db07e3", "comment": "Malware payload (RedLineStealer)", "value": "e21b7afdeb96d1c7ab452794105ee343", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696086997, "uuid": "48650295-44fb-4c4a-8bea-4b9fd6b8f43f", "comment": "Malware payload (RedLineStealer)", "value": "ed067e1d3a1df58da03c77e1bfba668fc9f4aa81e6802ae2626c6fa87de0a788", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696086997, "uuid": "4c9ad21f-f663-4231-aacc-e2b85c00ee14", "comment": "Malware payload (RedLineStealer)", "value": "03f0176dafd9f4abc84381b4bb4a721da5626f0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696086997, "uuid": "c36cf062-daea-4688-9938-8aa65ec3c088", "comment": "Malware payload (RedLineStealer)", "value": "ade10a6deeb9df81f2ed6076c07a2501af107d00c7cdf4532e7e121b8c0f52d10e0065e908f171ada1c7b8f25ceb1cac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696086997, "uuid": "1ad27933-5d87-40a1-916d-d0891fc5f138", "value": "T1DD2523576EE541B2EB7103B044F661830D3B7CE258BAD2AB5767AA474C726C02E3173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696086997, "uuid": "7af2e61e-2885-4e7e-a8e2-3d7c511b0a2a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696086997, "uuid": "9da56a60-e2a7-47b2-9ba8-dd797df33e26", "value": "24576:QyRyqLjY0wDw8RzIZXPFgWuTvQ5VEq7WQ41/9A8Wi6UM:XlL80wDw8CZXPFbEvQ58Q4N9qU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696086997, "uuid": "e984fbaf-a3bb-442a-8a15-a73d8073a50a", "value": 1017856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696086997, "uuid": "d938039e-f47b-45e2-a5c0-e72fba293010", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696086997, "uuid": "0a006d9f-af79-4abf-9dd3-214a1e67f2a5", "value": "e21b7afdeb96d1c7ab452794105ee343.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2bb31c8-5f38-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Glupteba)", "timestamp": 1696040734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040734, "uuid": "510a5974-b195-4c3d-87f0-add2f7d111da", "comment": "Malware payload (Glupteba)", "value": "e90424aede26e1dab377e4fa67d993bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040734, "uuid": "96e11057-cc3f-4b6e-8ed8-fafef7f7f24d", "comment": "Malware payload (Glupteba)", "value": "edc7a1ca30b7dd9e8eccee42f47121d144f2bd410ae6cb522cc9b52902a1d74a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040734, "uuid": "04f9be40-84bc-4490-a28a-e4bd077300cc", "comment": "Malware payload (Glupteba)", "value": "beaa664c8ae8862d51a38aad3274213c3392ab8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040734, "uuid": "e6bae999-56d5-4615-8312-68ba91011548", "comment": "Malware payload (Glupteba)", "value": "4187fdaaf2f2fabb72f6b3f4f2d49b0c1acd175f78b658b8d19e6a2d1ce025fda547efcb002e6c072bad803220d2ec77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040734, "uuid": "6d5432d7-a109-468e-8797-b3c73989fef7", "value": "T19816330721B27A60D5358674685CCBE4AE6F34718E3E5F8B2298AF5F0C32353D553BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040734, "uuid": "53cb4ce2-64f7-4cc8-be62-dbafc4f31b3a", "value": "a59b93a815ea9713a41e16c8d0248e4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040734, "uuid": "cead752f-d77b-439d-96bf-134b7c8a83e3", "value": "98304:oRTkDuHgmYx/lUN44oPlaFTRDd8Vl17ZH+qKHzyof587dicDjg0:SumYx/lUN44oEJmBCTyoq7dicB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696040734, "uuid": "e19480b2-da9a-4dfc-b944-aeea90581e51", "value": 4339584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696040734, "uuid": "3257487a-f446-4606-a2c8-74e89d56d4eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040734, "uuid": "a52af648-dd2a-435f-ba7d-96ef30799b87", "value": "e90424aede26e1dab377e4fa67d993bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a514bd-5fb9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696095990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095990, "uuid": "2b6796a7-bd31-44de-aee8-b9610367d204", "comment": "Malware payload (Stealc)", "value": "545e1d6fa4c9d7883b198588e675662f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095990, "uuid": "b3f9a08c-b9f9-4641-8556-c94bb4202758", "comment": "Malware payload (Stealc)", "value": "ef26d97e748a6dfbadff05c1de384afc015cbf16fcfa3052f533c0827077198b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095990, "uuid": "adf9ea2d-67fc-4912-8d2e-3f248c5f8aee", "comment": "Malware payload (Stealc)", "value": "793fb682104366722edec64e51a9d7272e3fae47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696095990, "uuid": "ac33f2c2-94f6-4cb8-8893-037f56471fcd", "comment": "Malware payload (Stealc)", "value": "7c8e581053eddeebd4930ea869717ce595a123082eef0b0c8d8d0c77358f26ae3820d84bae8cbd8ad078340ffae6e53a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095990, "uuid": "577840f6-2dd1-40c2-87e9-16b782afcc18", "value": "T1EB249EF362A07C60E5676B77CE2ECEE83A2EB551CF95675A3218562F05701F2C263312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095990, "uuid": "9a6061c7-3f5d-48b9-bdbb-cb13a6630b70", "value": "d323d1063364fcdde3ec2d7fc616011e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095990, "uuid": "e389bd7b-6031-4783-86f3-c5c63baf9804", "value": "3072:9RlRLNzScIb4tWjX5I4krpRvyeMTIC9zRCLlPqG55/jMNBYJ:VzScyTJIL3qYC9zgpCyjMNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696095990, "uuid": "ee6c1abc-e920-463b-aaa6-aa461a8553d7", "value": 224768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696095990, "uuid": "ab7fce31-4033-4bca-90f6-fb90090a8596", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696095990, "uuid": "709ddaaa-18cd-4eef-91d1-b634c11cf6ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9d5196-5f87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696074738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074738, "uuid": "beffbb9e-d9e7-4a41-98d7-9a84e4cc3b67", "comment": "Malware payload (Smoke Loader)", "value": "0ad9bf34a01a29d5f66517bc6a59ffab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074738, "uuid": "2fcaa293-ec23-4715-9263-ed496ac8f69d", "comment": "Malware payload (Smoke Loader)", "value": "ef590d00ec93a93bf1b0b2a7cf86b7b39b03072fb323e45e7a3a270bdb56c4a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074738, "uuid": "084be11a-d0b2-4196-b6f7-eec513a9ef7f", "comment": "Malware payload (Smoke Loader)", "value": "be5e512168f76d127697edfcd2d380b8eb7a4d04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074738, "uuid": "a03f4a55-586e-4a94-af2a-67db63a91dc4", "comment": "Malware payload (Smoke Loader)", "value": "6d32a37f48b70cddc1bf2549a23b1bf5ecce17aa6ce7e270fec79b9bece3395241c0ded8f8567235ac5349379a3a85ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074738, "uuid": "7bda83d9-cccd-4c38-b3f3-ef21fa16261c", "value": "T19534BF11B4E1C072DC7A94360AE4DBB99A3DB83009A15AAF67F40F7D4F30281D676A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074738, "uuid": "d7c72eca-a8f0-4027-b7d1-41b627d42001", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074738, "uuid": "75b4b60a-75b9-454e-a977-68f74c6e0cb8", "value": "6144:1jz4SHy5uoBMFGV5PEkIXEHvZAOXrfcvZ9niZuVs0BC+:yCmuoBMUOMxda9iYs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696074738, "uuid": "50788f85-8d73-4708-aa09-bd60a33bed36", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696074738, "uuid": "100ce5ab-1eee-4360-a123-6d764e698598", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074738, "uuid": "88edfdd6-8608-4a53-8c29-b9f61a3a05c2", "value": "SecuriteInfo.com.Trojan.Inject4.61510.21538.15295", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf867568-5f87-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696074740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074740, "uuid": "eacb7fe7-9f73-47cd-b584-9a017f7963fc", "comment": "Malware payload (MysticStealer)", "value": "5b392134568523d7de5498417ad2f883", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074740, "uuid": "19bab1eb-3e61-4a32-8e07-b00744f5baab", "comment": "Malware payload (MysticStealer)", "value": "f03109e36a0a2d9a3b69ebd4cdbb14b6eb7e9136361e1a8dcaeed47cdeb2ae22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074740, "uuid": "1b8cbdae-adb0-4dfb-8aa3-98d98a00c7c4", "comment": "Malware payload (MysticStealer)", "value": "25a6a14dce9bb213543c4a05c6a6252b798154ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696074740, "uuid": "0078c0b5-3141-4e8d-9b41-5f92b7fd342b", "comment": "Malware payload (MysticStealer)", "value": "4ff67d043e099c58f84bf1ab303d3898ba9e688b346befd1f5282e36e82d1a00c02a001aa95ae1ef225c67ae256a0882", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074740, "uuid": "3bf69cf8-df37-4442-8945-0f6ceb9f6c15", "value": "T18174AE5C74F284B1ED3225315BA4EAB906BCF86008558B7F97E81F6E4E3C280D365B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074740, "uuid": "d96e2359-3645-4e87-bf4a-36c2e4589136", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074740, "uuid": "c7841c92-0df4-4641-8052-582e6a06ce22", "value": "6144:cGTeW/s5GqrO5aXnfEGIXWPvZAOzymnWQD7QVs0BC+:qmcGqrOk86xdWQ3cs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696074740, "uuid": "bb5dd695-9715-4787-9566-24a6722874d4", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696074740, "uuid": "8c8f8d5f-94d3-43e7-9b56-df87d09079e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696074740, "uuid": "6c8a006e-6a82-4cb5-8c17-9c3c3315abf0", "value": "SecuriteInfo.com.Trojan.Inject4.61510.13484.14265", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89abb5f-5f58-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696054569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696054569, "uuid": "f0352458-7476-400c-b4c0-a2a1c7e338bb", "comment": "Malware payload (Amadey)", "value": "e8b75b83c566d130c39af2e4f348f4a7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696054569, "uuid": "67315fe9-43b6-44fe-b7c7-2f3f86a4d9df", "comment": "Malware payload (Amadey)", "value": "f05fdb9bef0a2ab691a48a497951eb40f9451f83071bf2810e9677333fca0300", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696054569, "uuid": "f7835229-383c-4952-ad06-a5844e7b5100", "comment": "Malware payload (Amadey)", "value": "3fcccbc19797d7f7ca7f8927c018be69c50feef5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696054569, "uuid": "18f34fc4-2fb6-4046-aae7-b45bd31a7eb8", "comment": "Malware payload (Amadey)", "value": "4e1cdd7b7067d1343c4adf8aecc2ffaae036c4d8cf8a68cae505e29d45e1ff68c03ddc5697758f8eff7accc54b721d13", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696054569, "uuid": "31b8f13b-ddcd-4320-a35b-71a219b47d5a", "value": "T13C34BF19B5D1C472DC7215360AE4DBB99A3EB8300D915EAF67E40F7E8F30280D636A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696054569, "uuid": "792c4bcd-4acb-4292-a519-e2027976b8e4", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696054569, "uuid": "58395417-4c45-4e18-be0f-198e94f6707c", "value": "6144:4mz4SHy5uoBMFGV5PEkIXEHvZAOpm+sXYAurVs0BC+:ACmuoBMUOMxzKXos0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696054569, "uuid": "01d8dd0a-4e69-46bf-a1dd-d24a0e403df5", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696054569, "uuid": "804b4e98-877a-44dd-8885-d785aa56e7f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696054569, "uuid": "2b0944f3-b6c4-479b-8a27-d311d255474b", "value": "e8b75b83c566d130c39af2e4f348f4a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ede22f-5fcf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696105431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696105431, "uuid": "a86e51aa-19b9-44e9-b4d5-3befea4683b9", "comment": "Malware payload (Smoke Loader)", "value": "325ab212c5d7eedf0706fc1d3667e1b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696105431, "uuid": "a9d89772-05a0-45be-8c60-622e670c263a", "comment": "Malware payload (Smoke Loader)", "value": "f1fe205719d6a3d54daf0ce295917867a243cbaf4b52a25d605a9991249869c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696105431, "uuid": "6239564d-4fb7-4aca-a7f6-60138083c49d", "comment": "Malware payload (Smoke Loader)", "value": "767fe89bf7c14a395b88e8f5df908517859d4c40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696105431, "uuid": "0c7b0031-d0d5-478e-904d-4d21fe75a68e", "comment": "Malware payload (Smoke Loader)", "value": "1bd74e2e2550288636375169ea62d333f1c53b5e0ae50183da936eb5f0a46de8b4254ff09b4df67c2bbea5883275117e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696105431, "uuid": "e45a1752-d559-4b91-b507-a284a5035ab9", "value": "T1A5940113B7D44033DDB527B069FA07870F36BCA29D74934A6785AC5A0DB3294A930B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696105431, "uuid": "96840eba-c859-44ce-addf-90b3792be5cc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696105431, "uuid": "51dea76a-4abd-4c79-8102-58728d6f5ea8", "value": "6144:KZy+bnr+bp0yN90QEj4fWKdSuLafw2U52GFEt3s4zYtOpAgwwd0aORIZyp8Er7:rMrby90J3OSuL35+2GYtOpAgwwduaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696105431, "uuid": "4ce3a77e-9e45-4f70-bbf0-ad1801deef9b", "value": 436224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696105431, "uuid": "e07dcae2-d524-4142-aacd-303b1c2cb0fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696105431, "uuid": "89b0dc1e-e2d9-44f9-9b41-b9f97956b98f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f0fbda-5fc0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696099074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696099074, "uuid": "18ef3c44-6cd0-4a48-8160-17b9ef44dc70", "comment": "Malware payload (Amadey)", "value": "505c7d5323e47c3676f35667149a03bd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696099074, "uuid": "87b3829d-062f-49bd-a77a-a34d19282e8c", "comment": "Malware payload (Amadey)", "value": "f344d608c3c59361f1a3d9b4ba9d61cee19dc80705659686a816b19326a14008", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696099074, "uuid": "05d6fa14-4333-4068-a124-a76a400fd2f0", "comment": "Malware payload (Amadey)", "value": "8b34f0f3b2bbef7c97fdeecc154c76f76b32e5a5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696099074, "uuid": "db994e19-4179-486f-8dd9-5b92250670ab", "comment": "Malware payload (Amadey)", "value": "aa8f9a8ce2baea361b5169dfec77de92e903234a6c636a53a1afff2b331b67b691717801cb4366095a6f4c3d60ac5fdd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696099074, "uuid": "f4fb8946-181e-4f00-835b-eed80778bdd3", "value": "T1F4F3BF1675D0C072ED66193509A0EBB19A3DFC340FA09E9F77C80A7D6FA02D0D9369A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696099074, "uuid": "055f3052-be5d-41ba-84e5-883c3d989016", "value": "5b961e24b82512d2a00ac6c970dad1c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696099074, "uuid": "650fccc8-de5f-448e-bd56-9eb5f7eaedb7", "value": "3072:WhmUokowo7h0BEYmbuw16GVuiIPMoCHTTtOIjzBB+Ffzj:WhRNiOBEBbx6GJdOwBMrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696099074, "uuid": "8da22119-730c-49a0-a415-07d57046e8ca", "value": 169984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696099074, "uuid": "305f4273-f113-4380-99e3-15bff5bbd120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696099074, "uuid": "00886135-b74e-448f-9509-eeeade5e87b1", "value": "SecuriteInfo.com.Win32.PWSX-gen.6228.24168", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0a1b93-5f38-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1696040807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040807, "uuid": "fa0539dc-87f4-4e63-a925-513b1fb4bacb", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "9aff83cbb1657a305d1b207f3ab65583", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040807, "uuid": "82e8d1d2-df14-4200-827e-cb27854f438e", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "f4574f82197dc059321fafbccef9e44ab6af487616947c9120b09b5f90733e29", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040807, "uuid": "5ab9bd8e-4970-4dc9-84a3-446352e92613", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "9070a9d5ae807835fe33d39fe5717fe1e52af564", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696040807, "uuid": "eecac235-0a05-4e80-8bb5-8e9151a94f4d", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "a47d749d972ad659d6bc6a8f18886ecde358ebc4ca6fabd697ac837ece0844e744a10c0ea219e861108204aa9f80c5b8", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040807, "uuid": "7a6fc730-828e-408f-84d1-84bedeefa719", "value": "T13F349E0A62E2ACA1D66786718E2DC7E43A7FB4614F796F6B23185F7F08702B1D163701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040807, "uuid": "6f6d00d0-d368-4b75-82d6-0ef4ea6c8d6b", "value": "a59b93a815ea9713a41e16c8d0248e4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040807, "uuid": "9dc2998e-cbe8-4803-bd7c-0f481bc16470", "value": "3072:MXre6crwaTBOk+myLOzEJnjbS+6528Vgale8YTpp:Ii6za9AOzEJnNSk8YTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696040807, "uuid": "12eedd73-1e92-4f5c-b2f0-80503adf6740", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696040807, "uuid": "285a71bb-5d6d-471d-883b-66860e0de7a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696040807, "uuid": "ecc4a69e-c7c1-4e1d-9bee-2081c914363b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ee1d17-5f75-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696066882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066882, "uuid": "7c731547-3efe-4b0d-a215-bc1abfdea65f", "comment": "Malware payload (Amadey)", "value": "c8da4cedef4173a4ed7b8037c5f34fe0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066882, "uuid": "88de2297-48eb-4acc-af4d-d857d04a90a9", "comment": "Malware payload (Amadey)", "value": "f5b96b21c633cd44ac3ea08a92935caf13e70be7835587b622277d4fffd73bf4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066882, "uuid": "1625422d-3877-4356-be4d-eef2be08f459", "comment": "Malware payload (Amadey)", "value": "7d0fa1e578846a3ea02b6f5c9d7f6c426050ac15", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066882, "uuid": "a0a00638-5b83-41c8-b8a3-47410f0632d3", "comment": "Malware payload (Amadey)", "value": "6d0c2671d32ce1f883f1ec17790fadf0584d7cfcee3b5710d3d2f981608f7985ff1f904c3740efc618de7ec271346fc5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066882, "uuid": "cde122b3-1f1e-4c88-86d4-dd021e130448", "value": "T12134BF11B5D2C472DC7225360AE4DBB95A3EBD3009A15EAF67E40F7E4F30280E671A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066882, "uuid": "552e594f-e6f6-4585-a813-e906870edc3c", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066882, "uuid": "62e8fd33-7ba3-46a5-8531-d50bf0ef640f", "value": "6144:6Zz4SHy5uoBMFGV5PEkIXEHvZAO0sGvZVs0BC+:tCmuoBMUOMx+bs0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696066882, "uuid": "461869bd-727d-4542-92c1-2dc31b10eebb", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696066882, "uuid": "2e3ef0ad-52ef-41f9-889a-1ce5810102b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066882, "uuid": "92de44c6-3f0f-46ed-b9b3-5490245b9b0b", "value": "c8da4cedef4173a4ed7b8037c5f34fe0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96fd4bcb-5fc3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696100415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696100415, "uuid": "68f24bdb-9a8e-44e9-8a5c-41a5f2b1e8a5", "comment": "Malware payload", "value": "4837cfce876aac460f7a8f51172059e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696100415, "uuid": "29568158-2da1-4068-aa35-028e145962e3", "comment": "Malware payload", "value": "f5d2100f68ce959540e938b39e31e752575127d2f09f3af87ad8e37f7bccd057", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696100415, "uuid": "53a73b19-4803-4358-9946-a0534498020d", "comment": "Malware payload", "value": "af14c50b46ceeda60de3a3802061490afab4cace", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696100415, "uuid": "d784b742-b607-48c7-86eb-7364d7334b66", "comment": "Malware payload", "value": "009f9d422cf30db78baaabc173794b24d4da68a6fea33f3a4eedd5e8f304a8d3b0464492eb8a3cc7f1bbda4931454274", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696100415, "uuid": "293adc1a-1b78-423f-9d6f-ff3e8f0aca1c", "value": "T10B43D74CFCA8533FC3D167FBF65902CE7B3A1A54A787331255282EB52BC57656939020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696100415, "uuid": "b6aeb8bc-340d-40b8-9c35-a19e8da65fc0", "value": "1536:2FFhyfQG1XjgJ97Vxbnfi9tJXcDnnA6w+nVwZc8rA:UFhyfQG1XjgJ97VxDi/h36w+6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696100415, "uuid": "b518c0c7-3dea-4584-94a3-4ca869367c9a", "value": 60357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696100415, "uuid": "6446c6fa-2f15-4f7d-b8f6-f96c34d43b3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696100415, "uuid": "9d67b850-adf8-4986-976b-be38f09ea57b", "value": "4837cfce876aac460f7a8f51172059e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620838cf-5f39-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696041055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041055, "uuid": "05e1b4b3-0ca1-4e14-a26a-765f94b44e25", "comment": "Malware payload (Mirai)", "value": "86e58ae5a720ead05affdde1a23180f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041055, "uuid": "c20460f2-8c40-4039-8109-c1f592021688", "comment": "Malware payload (Mirai)", "value": "f5d503f042cb8929834ea5c970556dacb3bb4f99ad94324d545104315ed68a01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041055, "uuid": "e87d6c0a-4f9d-4e1b-889f-d29c436698e6", "comment": "Malware payload (Mirai)", "value": "84788a6c8308ba8a12af415b6864eeb0d8519574", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696041055, "uuid": "8571ba4e-7da8-434c-8a88-971dd80db65d", "comment": "Malware payload (Mirai)", "value": "a406556d396f10be2bda282fede6cbdc06400844d0958efdf83a0ed014740b821e06570c050371d7a09b0fcc7c4e2358", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041055, "uuid": "38677a12-a6a4-4bca-9c6e-078de2621ad4", "value": "T1BE73C71E2E219FBDFB69823547B78E21935833967BE1D180D19CE9011E7034E642FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041055, "uuid": "4d7c8975-8392-423a-a6dd-2946671efdb8", "value": "1536:1Vw4SL7Q3OBoxUlLsSY+vKp3XL0Fg+WAF2+OC6zBx4/OFcCr:1VsL70OS7tb0W+NObo/61r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696041055, "uuid": "3ff3b12e-b900-425b-b347-d94e0d3ce453", "value": 73504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696041055, "uuid": "7dc12a16-e332-43e0-a817-5682b459ba5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696041055, "uuid": "c1d1d0ff-2786-4987-8949-6dc6f4100b4b", "value": "86e58ae5a720ead05affdde1a23180f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c548817-5f78-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MysticStealer)", "timestamp": 1696068050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696068050, "uuid": "8556bde6-3814-461a-b6ad-25758dd0cfa3", "comment": "Malware payload (MysticStealer)", "value": "87f37631a05f33d93d78dae9d1a462fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696068050, "uuid": "6603b7a6-88b4-43fa-8a63-867c7d513bb8", "comment": "Malware payload (MysticStealer)", "value": "f7f9b5e8857de83934732e943bbb0d9d996ccf596dd20069201e0d9e20f7cb79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696068050, "uuid": "a11f2577-12ab-422b-b920-25fce9bc492d", "comment": "Malware payload (MysticStealer)", "value": "a7b494439526e024bda21822de59f4f81042804d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696068050, "uuid": "f77197a0-0081-4805-97b4-b31088a70c98", "comment": "Malware payload (MysticStealer)", "value": "b3a922851bd77969dad1c14d6aefd0a285a6fec1d81ac3e12a7b0870c9f43d3801b5a20a3ffec558b3fdd81fa2cc3298", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MysticStealer", "colour": "#803A9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696068050, "uuid": "27149f94-6eda-4c16-80f0-71f0b4689071", "value": "T1AA74BF0279D08073DCF620311DE1DEB50A7EF57005A89AAF67991B2D9E392C1B63366F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696068050, "uuid": "aa3d8600-a089-4dff-83bc-b82e740a1fa7", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696068050, "uuid": "c68ca9d2-473f-4080-86bc-1d247edcb188", "value": "6144:CkTeW/s5GqrO5aXnfEGIXWPvZAOfyECo6wbG+22Ov69AC9K7B180X6ZFB2iPIPXT:amcGqrOk86xLCoWV8iwQPXKT9k5lQss2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696068050, "uuid": "a3065f99-0aef-4e3f-83f8-63c4c802fa1e", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696068050, "uuid": "1ec7bce7-a30c-4410-b3e3-9d972fab715d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696068050, "uuid": "d07750fe-367f-4214-8a26-4174635b473b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4080444-5f8e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696077807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696077807, "uuid": "1e881767-13fa-42a0-90a2-0af917d995b6", "comment": "Malware payload (AgentTesla)", "value": "2e375e9ad2e1b3a51e34e79f44db5112", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696077807, "uuid": "6353bdcd-ab64-4053-9f0c-aa7f8c5274cc", "comment": "Malware payload (AgentTesla)", "value": "f802b57b2cd3b8df6bf786442cdccff7751a42d46d4e900a66825e293dd0521b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696077807, "uuid": "608501fa-2686-48a4-9bd4-0ff843f1460a", "comment": "Malware payload (AgentTesla)", "value": "3d88fa9c485a1725d58ee537c5b47a8d1ccf8bc2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696077807, "uuid": "2359d962-d1ea-4a70-b732-a5f0bcd785ac", "comment": "Malware payload (AgentTesla)", "value": "5a7b1bd15842365677606405a5c906343bef01a8a5d1f3b23368130f0c6df2dc217d5c3f6da16307ec2fb2c2fe79585b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696077807, "uuid": "8a11bf12-3641-4d46-a86a-801c592c3c9a", "value": "T1E0C4238585821F05D0A6FDA3D341CB6C3EEC2B7AD66B7210EB6CD8D831EAC350564B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696077807, "uuid": "93028e83-0a2e-4ef1-a506-bac0904cf1f3", "value": "12288:AwluEKj0Hr2DbZ+5yLPq91dluLuKKggfrBm9mLP3W5:Awlurj0H2t+sU5u9FErBJLO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696077807, "uuid": "0ad8786a-cbb8-4892-9b39-a273259ee06c", "value": 571720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696077807, "uuid": "3c8c8041-1632-474e-94ef-fe3dbea4258b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696077807, "uuid": "a783b185-cc9b-4f37-a9e2-cde1ee6d0d04", "value": "PAYMENT COPY.pdf_________________________________________________________.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d541610-5fb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696092184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092184, "uuid": "a8954353-11c4-4f7d-95e8-8f723ed57b46", "comment": "Malware payload (Mirai)", "value": "259b5dd05e01a4785b22d6cf430be69a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092184, "uuid": "2e9fb95a-9d03-45a5-9ed1-9e06d6bf5c10", "comment": "Malware payload (Mirai)", "value": "f93419c36b5ce2e0435a84f9bdef4ef678567eeace21a9dca653387316c86485", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092184, "uuid": "151f6fae-088e-4665-b872-153a25b9dd45", "comment": "Malware payload (Mirai)", "value": "1d8adff480c6b590754dabb69995d7b61f06a577", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092184, "uuid": "d80821ac-8446-4c92-98cc-ec4351cc09e8", "comment": "Malware payload (Mirai)", "value": "b66c7099af788ba08280882ab89a1d64f216d23c7992cdf718a8d71ac76f102888979a35d8202f5845a0376ffe550c0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092184, "uuid": "80fa2734-0dba-4086-b78c-9646609fa437", "value": "T1D163F682BC80E616CBC01677FA1F508E331567D9E1DA3342DD165BA07ACEC1B0D6B746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092184, "uuid": "d1556a15-c94a-44a6-9cb0-cc2bf6778736", "value": "1536:b4blEKw06Z1XjuxfEQPqm5YB8t46zHMeJcy:b4bllw0W70484EHzJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696092184, "uuid": "a09d1a22-3820-419f-9468-025d566f8c03", "value": 70652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696092184, "uuid": "2ebf16fa-3db1-48e2-a4fd-5342526ec37b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092184, "uuid": "8ac38e71-6cd0-405f-8717-b1a2a47bc92a", "value": "259b5dd05e01a4785b22d6cf430be69a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b13b2fa-5fb0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696092181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092181, "uuid": "d7db94a0-5abe-439d-a528-20b9933f77b9", "comment": "Malware payload (Mirai)", "value": "01189a47521349fa130704df96ae93a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092181, "uuid": "d5d2d400-7f74-493e-b982-c41b5c16c285", "comment": "Malware payload (Mirai)", "value": "faed334a47f238c25eaa1680bfc71f10034c00a0c3cc55bb89c755d52f6fc653", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092181, "uuid": "809d9726-2a32-4d53-b31d-585a0a0e182d", "comment": "Malware payload (Mirai)", "value": "26b4cd1149e90a52c657af0ce293ab2b60b365cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696092181, "uuid": "85041d8f-83cf-4444-ab50-bc876839f4e8", "comment": "Malware payload (Mirai)", "value": "a491f279560c52eb2a8077e1ced3903ccfe4e09923b7dc8240e43f8e25386e23a002b6900477c30fd402dd67433e3bc6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092181, "uuid": "e3e0cee2-247e-4130-b8ee-a371d2504c62", "value": "T1EE535C0073948F07E4AA5EF5283F17E483BEEE5016E5F184660FE74A8235E33595AF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092181, "uuid": "916f3b93-f90c-4761-9f40-963132489a7e", "value": "768:H3qgPVuEmAJZawkRS74xODerdz+AaWtGTPABaUxn69YCExIj2zGU5d+qenx56orG:tVuLLjOD/WYERTCExIj3qebk3ePVnX8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696092181, "uuid": "a5078158-d2ac-46dd-916b-02ed43abc58f", "value": 66656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696092181, "uuid": "eb44ea15-b18c-4469-9f39-1970401f89c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696092181, "uuid": "babcc5dc-aaa1-4308-9ebd-7c599349d748", "value": "01189a47521349fa130704df96ae93a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8812a9fa-5faf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696091800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091800, "uuid": "a142667f-d624-4329-83be-71a05f97fb42", "comment": "Malware payload (Amadey)", "value": "208fb1accd713d44963763936ebcd36c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091800, "uuid": "ea696326-b5a8-4ef9-aedb-16c3941889d7", "comment": "Malware payload (Amadey)", "value": "fcadb4723c942756c4566bb637b4bc54a5069f5052911f3b13f76a365a63a920", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091800, "uuid": "6511def1-c65e-446c-bef3-d68b7a6f397f", "comment": "Malware payload (Amadey)", "value": "6a43420aa7f843c2d3b147d23a7b0f9b1bfd89e8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696091800, "uuid": "7d68c6eb-2884-4206-8077-209a1698ea88", "comment": "Malware payload (Amadey)", "value": "a0c5bf55a6e1c994a41e3b67a7b6077e4c513148ee713ff1107ea73aeb5388cf3ad171b88a602e8a7332c66f0aafb607", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091800, "uuid": "e929082d-9569-49fe-bf5c-882e2479cc2e", "value": "T1D62408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091800, "uuid": "3bbb7e44-d177-4609-83ce-476cd2cdc627", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091800, "uuid": "8bd25aa1-e221-4439-acae-3bad0b1dc93f", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696091800, "uuid": "b7e30988-ac13-432c-aba8-3f78c1d83459", "value": 224393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696091800, "uuid": "d1302e49-126a-4ae1-a352-27b833a38b99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696091800, "uuid": "537ca280-d60a-487d-82b4-5e0dc93121aa", "value": "208fb1accd713d44963763936ebcd36c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1540500-5fc3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696100513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696100513, "uuid": "20b157e5-b093-4610-8bb1-e9e3b82da329", "comment": "Malware payload (RedLineStealer)", "value": "bb6e6cf1426e59e8443773af3be850f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696100513, "uuid": "dfa1e754-cf94-452a-825e-9f75d5d1ca31", "comment": "Malware payload (RedLineStealer)", "value": "fcb370162c92f988427f2b2b7df240f44a01f7cbf09a6e90a20988a1f28424a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696100513, "uuid": "7f40d51c-3112-4311-a765-7f7dfc37996e", "comment": "Malware payload (RedLineStealer)", "value": "08319182ab74c0f09652e55a7417b6597e0ff7f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696100513, "uuid": "6c934351-eb6b-4b7a-a122-bc3e8998480e", "comment": "Malware payload (RedLineStealer)", "value": "d19b104946647d0fab6051e686fe9b8fab9f028c62c821588912cbedde3b9a4cedd5df843d17ade86040f22705bdd4a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696100513, "uuid": "66bcc2fb-b8fc-49cc-b191-fa2d12c21b08", "value": "T17384E02361E17C61E56B7B324E2EC6E8762EF561CE296B5A3314DB5F09701F2D263302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696100513, "uuid": "b95b2bbf-ec2f-4b05-b325-010c4231de3e", "value": "d323d1063364fcdde3ec2d7fc616011e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696100513, "uuid": "d589b23e-bcef-4c29-8c15-7c483220c992", "value": "6144:wmGZtQs/ozTP3AYZ3VHarAjwviDw5MbJmAdjAWHFbz+V:wmGxKD3AYZ3RarOZUMbJLs4bz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696100513, "uuid": "f9b87f07-5558-45dc-bef6-26e8b09b3710", "value": 381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696100513, "uuid": "fd5c7030-0ca2-4d38-b299-1c4482cfdf13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696100513, "uuid": "933f649e-ec5c-4d9a-a1a7-f1b6b1fa2d24", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb80907-5f73-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696066148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066148, "uuid": "78b4622e-0da7-4467-9293-a66211be5a53", "comment": "Malware payload (Tofsee)", "value": "750580690fdb6962ccb68b1a08e50691", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066148, "uuid": "e1a587c7-54f4-4821-bdfa-f42132c246aa", "comment": "Malware payload (Tofsee)", "value": "fcf97fff84f547e402dd4d100fc71dfd062a1b3cab7e7260bad97eaa6279d346", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066148, "uuid": "5688807f-f9f7-4a3c-9c01-08a0e3ef9078", "comment": "Malware payload (Tofsee)", "value": "2b982da8ec216d0f8e803001c7e97060f1908fcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696066148, "uuid": "7ae28101-5666-4bc7-970e-062111618719", "comment": "Malware payload (Tofsee)", "value": "45601adde732e91ece902b3cd0c882e1a6e954440cc7cf8d0599524b68d61d9c722f605acf46fb7bbb422ade804e276d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066148, "uuid": "7eae76a1-f7e3-475e-8c1b-4930c4407631", "value": "T1DE349E2362B1ACA4D57766724E2EC6E43A2EF861DF54E7673318DB6F08701F2C262741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066148, "uuid": "e21fdbb6-02af-4363-8fe7-4acd4e4179ec", "value": "50fceee6f3fb6eb6577a605eb92d5359", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066148, "uuid": "35818fa8-36ad-4b24-8cba-985f87e5f1db", "value": "3072:zXjVMCgBaScM5IML8HkMZYEheXcf4B/EuFCP1rZ+Cy115VuiTC2:r+2M5IML8Hn154Jfw1rZ+CyXuiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696066148, "uuid": "680e6bb0-5f58-4a53-8aaf-d6d70b7690d5", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696066148, "uuid": "7c2fa4b6-342d-45e4-b9e3-63ba764f7fd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696066148, "uuid": "99bd94c2-b336-48d0-9242-e0442a0f5e85", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf57a609-5f7b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1696069585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696069585, "uuid": "a4016c8b-20b8-451d-a432-0b68d2a07654", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "e39c902f0cfc87d5562f99105f09771d", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696069585, "uuid": "05640415-7c65-4318-95b5-f7d4d61c27b3", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "fd1953f17b133bbfd9011721a515762d3a866f2ef9e54ba29446ee76993698f5", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696069585, "uuid": "6a23b225-460f-46fc-8d13-2f6363186861", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "6d9f0c9518f2f647beecdaa06de231443ff8894b", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696069585, "uuid": "3a2b757f-2c5d-4d70-a7a2-855b937a8dd4", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ae4db394cfffb6aea375393e922b784d641c70ab8f46b02121860e9ebe1866036f6ad402f583eeeb3875d0fade6eef82", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696069585, "uuid": "82047052-0dc6-431a-ab9f-606df4b0a42e", "value": "T10534AF11B4E1D072DCF215360AE4EBB99A3E78300A915AAF67E60F7E4F30381D621767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696069585, "uuid": "abbf4406-bcfc-4059-b4a1-d709fa0f0970", "value": "96baacc90461fcd4b5d9fcc50047c098", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696069585, "uuid": "65f854ab-cb0c-4f2b-bcea-c218f8f19e2b", "value": "6144:kCz4SHy5uoBMFGV5PEkIXEHvZAOMxadVs0BC+:sCmuoBMUOMxn/s0BC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696069585, "uuid": "aeca3f8d-5e7c-4994-9f72-84779e72b24b", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696069585, "uuid": "44698c78-4187-4cce-9335-f2287816e67d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696069585, "uuid": "681acb02-b28e-4fef-8d01-372371abf97f", "value": "e39c902f0cfc87d5562f99105f09771d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cef4a8c-5f32-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696038040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696038040, "uuid": "4e14e09b-4469-4656-8889-48c17f33aabe", "comment": "Malware payload (Mirai)", "value": "7548baa7ddfa143d54b3c4aac228348d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696038040, "uuid": "c32d5b76-3198-40f3-8e31-220312078244", "comment": "Malware payload (Mirai)", "value": "fddb1dbb4a97f757aabed0aca51a5a3d452222f7a91379e49220546c716dfe9d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696038040, "uuid": "50201f14-420e-4654-9e3d-c1a38f371c0f", "comment": "Malware payload (Mirai)", "value": "b92bd293548c1be1164e29ef2726b981c18436ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696038040, "uuid": "79c4b623-4499-4861-8044-5253fb6165a5", "comment": "Malware payload (Mirai)", "value": "a74829c8759948a89dcf75234173e8ac38a5782cd01e07121f829c175c2216b19eebaa2444f61627aad0f7618424afbd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696038040, "uuid": "9cdc22a5-ffde-400e-92b9-1c0e013c1d81", "value": "T196D33B46FA808E13C4D5177ABAEF414533239B64E3EB730699285FB83F8669F0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696038040, "uuid": "ea8af37a-0da5-4ddf-b84a-c83f04d48cf0", "value": "3072:ZcDFg9Kb3+k6aR7QRL1saempdi8xJ6hA7AVnM/99cD:mFg9Kr+kNe5saempdLxaA7AtM/96D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696038040, "uuid": "74d861e5-e46c-4ad6-a493-d97550cbf4e5", "value": 131066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696038040, "uuid": "16fca5cc-bfc7-43cd-a893-396fa534fc54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696038040, "uuid": "83660ca1-00fc-4417-bb27-b4f964d46e1b", "value": "7548baa7ddfa143d54b3c4aac228348d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea28e38-5f56-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1696053371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696053371, "uuid": "5b47527a-82c3-404f-a8b2-b10e86dc383f", "comment": "Malware payload (DCRat)", "value": "bbff3ebe43002725905f8b4b5aff5463", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696053371, "uuid": "f45710c6-3c8d-40f0-afa6-1c9ecc2d366c", "comment": "Malware payload (DCRat)", "value": "fe7810842bbbb782535b952dae0672f815596277c2aba9b643454501c5c088d4", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696053371, "uuid": "f6a1a4ee-479f-4686-9b23-5278d4f5354c", "comment": "Malware payload (DCRat)", "value": "a5a3b6eef5a0ed67d84a7d6cd7c3d301bb9a4fc9", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696053371, "uuid": "3775e540-f9a0-4c78-9e7f-15c4e6aeeff3", "comment": "Malware payload (DCRat)", "value": "502f3ce11ae9c0b00e0c36d275a88a98f51492f2975f5b3cc769a870a7a15f8fb4486c6c560a0ede66ba81c742e74f45", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696053371, "uuid": "2d62e4e2-1825-48c6-8581-8050e93b367d", "value": "T1A8563306FA891CF5D0112633CA30FB25B06ABF2016AC5D87AB70391E9F325D15776E9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696053371, "uuid": "9cacc1c6-a113-4b12-902a-de5417c0f87a", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696053371, "uuid": "cd7e5e7d-0754-4313-bf76-1be9bbe584fd", "value": "98304:WXjJhhjdxsLUJhpU+yIVMGz/b2oTFYHUoiwxr9rl3oYdkslNHQNFSn43APL:O3LtRGcY0JwxrLVva6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696053371, "uuid": "5e041ec5-ddf1-40ae-9a56-e9986b2256a0", "value": 6007317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696053371, "uuid": "f24f49ab-e59f-429f-8ca6-e4f6de3d7ce1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696053371, "uuid": "71bb196a-ebf1-46bc-bedd-711c9575bc00", "value": "bbff3ebe43002725905f8b4b5aff5463.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe07233c-5fb2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696093286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696093286, "uuid": "a16d0e22-4a0d-420e-b609-107330e5650f", "comment": "Malware payload", "value": "6ec18ed73f75bc85260584df2916f131", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696093286, "uuid": "c07e422a-1958-4bbd-87d6-11655c4d71d3", "comment": "Malware payload", "value": "ff5f94b35f1592e81b98abadc7e80479636ffc481083e2b678cdcf1c52d59376", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696093286, "uuid": "b4d0e8db-daff-42f1-aa4e-5a186665b6cc", "comment": "Malware payload", "value": "5c3063f8e2271b1b6842001fdc63b4312144a502", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696093286, "uuid": "259df0ca-6767-46e5-ab25-589722650faa", "comment": "Malware payload", "value": "fc8d2b52ee24c36e9e292fb88ee49b66b407737782c94c39b842377dada5214e863556206284b474600f26ae01170e58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696093286, "uuid": "45a4fc85-3324-4b00-ad32-5911af41733e", "value": "T1566733B1B4CD2294C4F2CB30F7CF8399A1916B3546DA8D4927D92C122B1196FF742A9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696093286, "uuid": "7d3a56d3-ba16-4bff-8211-ed6df2f07001", "value": "60ead76be6d61b972f4f6f2ef0c6506f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696093286, "uuid": "948edce6-be01-4670-8da4-44352f07f62b", "value": "786432:jIvFEioRQzLrZXFun7HxJoBtuugZYyW4:joFVo0QnrEzgZYyW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696093286, "uuid": "43b0818a-63db-4719-b1e8-8fd5335a5580", "value": 30131712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696093286, "uuid": "f04642cb-864d-4f23-b916-c1b585d4c975", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696093286, "uuid": "c16e8abe-7347-4bfc-9350-f7c3db38beba", "value": "dsrsdrrrrr.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }