{ "Event": { "published": true, "date": "2021-06-28", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-06-28", "timestamp": 1624924982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "86da8352-9675-4d01-b115-b7fbf9955b39", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8882fe-d86a-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1624923664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624923664, "uuid": "8b738157-54fc-43c0-b656-21ece7423ab9", "comment": "Malware payload (BitRAT)", "value": "84d29a80deeda551f4a8ac2e2a16cf17", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624923664, "uuid": "950f7896-a72c-4eeb-9593-7b811455c61e", "comment": "Malware payload (BitRAT)", "value": "008b2da3638a7f6795bbc8017d3bec47d8e74a89eeeb1defe8c0475a32339211", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624923664, "uuid": "c6d0f036-10cf-4cd6-8b35-67b7af9f5b5b", "comment": "Malware payload (BitRAT)", "value": "9da705ae3115950777bfe577a5fa1a0736f3ad22", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624923664, "uuid": "7032939d-2159-4fe4-8947-adb89b546034", "comment": "Malware payload (BitRAT)", "value": "3974acbb4cb8dd4e6c771e5c03fabe594a60203699d170879f33a0d405927c15bf8dafca5ac1900fba9d17e2443933a6", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624923664, "uuid": "0833cff5-def6-4f06-87ca-2a94269498f7", "value": "1156CF02FA41C562D2670230E96E77BA057CF5344B2085C3B39C6A685BB66D17A37F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624923664, "uuid": "f83888b7-4ccd-43fd-9d07-9c7968757e1d", "value": "71955ccbbcbb24efa9f89785e7cce225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624923664, "uuid": "53a77e1d-a558-49ad-adc6-0dd9e7eec6b4", "value": "49152:gXUIEeZzdeh/c7p1rNdd+JNEj0ykdj21x1YhFlX4bA/Hg/11VzeLG/7wqNKB2VIJ:gXrEeZzdhjuV/gd1VzsGUqNKTHvQezRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624923664, "uuid": "2078f682-3956-41b1-8c62-3ebbfc834921", "value": 6443603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624923664, "uuid": "73917042-fca5-448f-99c9-a704da835627", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624923664, "uuid": "b2c99e7e-3dbf-4895-86d8-b99d1db9fe8a", "value": "84D29A80DEEDA551F4A8AC2E2A16CF17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3041a0d1-d821-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624892262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624892262, "uuid": "be7e76ec-b7ec-4daa-bd7a-2c2142087c37", "comment": "Malware payload", "value": "78c7c4c39f4f39ff3889ce7dc4d93b2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624892262, "uuid": "24c0d425-00a9-4aba-9384-4be896f4fc3e", "comment": "Malware payload", "value": "01bcf3e8880ff488b44247538c3fda538b586f6b9b222ea658d4fb8b68196803", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624892262, "uuid": "80ad91c2-e83d-4aff-84bf-1b0b1132f3a2", "comment": "Malware payload", "value": "d2caf1afda8218e75a7196cb10e5ee82c949f930", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624892262, "uuid": "375bc750-1099-41a7-8c0d-e5099af9132e", "comment": "Malware payload", "value": "210410f39a54948f308f69076c2238b186732d2efee8ea76097a14d829bc93cb6edb3a110fa5c70e9f5d46f7e477ddf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624892262, "uuid": "60ff600f-bd5c-4f28-ac31-f8fc5182935e", "value": "3FF46B80E5985B91EE78A7F51A72CC3143763DBE6838E11C2DC93EDB3BB6B920411953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624892262, "uuid": "eb2cee49-e7c8-467b-93f8-de41dda60ad7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624892262, "uuid": "e2b4fff0-4e7b-4b8c-a2ef-4ac4a295fa6a", "value": "12288:zubIiWMsX9fKs7w/I6OAdhDSV9bEOnrnifBbLiP7r9r/+ppppppppppppppppppB:Rtpd9cPNDSV9bRrnifBni1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624892262, "uuid": "edb7d464-fce3-4a62-b20a-f887be58b2fd", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624892262, "uuid": "476bf827-de21-4d0b-ab4e-3daeca2a0503", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624892262, "uuid": "170ecaae-18a6-4886-8397-cddab1e30e3e", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c14891-d800-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624878336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878336, "uuid": "5fa5eb56-37a7-439f-9ebb-821094b0d8c4", "comment": "Malware payload", "value": "3402c9373726396598011ef6ec1ea243", "object_relation": "md5", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878336, "uuid": "d4e2409e-fa66-4d84-927a-5c599a12ec39", "comment": "Malware payload", "value": "0243ac9f6148098de0b5f215c6e9802663284432492d29f7443a5dc36cb9aab5", "object_relation": "sha256", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878336, "uuid": "b50eb969-c490-4a39-876e-22bd98ea1e84", "comment": "Malware payload", "value": "919b574a4d000161e52d57b827976b6d9388b33f", "object_relation": "sha1", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878336, "uuid": "bb1b2d4f-8d1a-4612-b783-182a4e4c22cc", "comment": "Malware payload", "value": "3cd70ef183280d1e0c151e556337744d2c4d081177a2039e9e57cc7e5eada9c2451b96c9a4b83775c830cf913433609f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878336, "uuid": "a11a7012-33ea-46de-acbf-df953261bf5a", "value": "55B1307199993B39251CEC3999B0FE1CB75110FECA324628F1EE58D83F63830C9668D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878336, "uuid": "dcdaaaa4-b009-44d1-a770-cfa8065a74b7", "value": "96:3rRSrMvtMn2IbtGfMibe/WJdb7oc9pHb/7yZnubZQKKXVNJw/0Jw5kgpkf2dSF1K:l6WtM/btGBbe/WJd99pHb/jbunJwMJw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624878336, "uuid": "e00d6382-ce6d-4c10-acf9-d24ef9bed4d4", "value": 5336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624878336, "uuid": "8bb762fd-4176-4af3-b154-9194de0e6743", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878336, "uuid": "aab7ae93-db82-4094-8bf9-63ba89caeeaf", "value": "0243ac9f6148098de0b5f215c6e9802663284432492d29f7443a5dc36cb9aab5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ecb38f6-d7fa-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624875643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624875643, "uuid": "4055c02e-5e5b-45d1-a8b8-05d864800b20", "comment": "Malware payload (RedLineStealer)", "value": "abe59288d20e185510f82f9d28746508", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624875643, "uuid": "76ceb450-5d30-4653-bc77-0c5408c52845", "comment": "Malware payload (RedLineStealer)", "value": "0410ba1c6980121fbe86cf986be765f6b8017a45a79cf7a1ed827ba4f6e337f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624875643, "uuid": "e23a383c-5b4e-4eda-99d2-b8276fea12cb", "comment": "Malware payload (RedLineStealer)", "value": "f95c98358ce7a66bf6fbad86011616481bd7173e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624875643, "uuid": "734c50c7-4723-4e09-ab4d-145dcb20b0c5", "comment": "Malware payload (RedLineStealer)", "value": "7ca4f33291f906bcdf1ceab5c4998a12e391173de2d5d21fd297a4bbd5c0e7b457cef27a20176639c3bc0aa1ca6481d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624875643, "uuid": "5ace4499-3d29-43b6-b44c-93cbe721f461", "value": "D4A4AD10F681C035F4B212F88ABAD3BC653D79B05B2451CB62D4EAEE5A746E2ED31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624875643, "uuid": "6d10fdc0-0467-4ee3-9ccb-db4b15210165", "value": "673279d8197077cff96b25624579e4d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624875643, "uuid": "7a890e19-1900-4b6a-bfff-6dce82ddbd62", "value": "6144:omI+nWrWM968Re8HOyUJLhML0xxr3SZ/BDjVRdgnEghZa6uokL4:o+8x968RROyUJCL05iRgXPoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624875643, "uuid": "ad7bbb95-3f0c-458e-bcd6-69573bcf9cbd", "value": 449536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624875643, "uuid": "924c45b9-e5d5-4ceb-a65a-68d7db009605", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624875643, "uuid": "4eb566cb-5edd-4d1e-a911-f1011b1e4659", "value": "abe59288d20e185510f82f9d28746508.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c192022-d7e7-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624867344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867344, "uuid": "05108820-83d0-4285-92ab-c125da91d6d2", "comment": "Malware payload (Gafgyt)", "value": "76103c7107be611f343b8a3d98fb0d2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867344, "uuid": "3194d394-e384-4b3d-9793-0ab193475e8c", "comment": "Malware payload (Gafgyt)", "value": "04f83eaacba5cf1751cd6ecd3b4d65a5b51550b07a389fb7daccca1035e69d3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867344, "uuid": "4210cbe4-8bd1-45a8-aef1-5f2fea8efe14", "comment": "Malware payload (Gafgyt)", "value": "e3a3a38b277471315fa43ec020e3bc5d68101a15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867344, "uuid": "be6fca7b-779f-4767-80c4-29b4a541a579", "comment": "Malware payload (Gafgyt)", "value": "152430a510cda9eddadd9779dda8c08dd8237a120cba248bcfd8df7812f9f32c1c0fd719a5585112f73ab6e4137efad0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867344, "uuid": "9b08d627-befe-45bd-96fb-9a00be2249f2", "value": "D1D32B05E8509767C7D227BAF79E428D73235B68A7C733115A28AFB42FC1B9D1E39021", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867344, "uuid": "8232ab6a-dcc0-417c-b43b-4d7865d10b1f", "value": "3072:nvddXUwHR3rZs7SX8Fas1wR9YxG/i51B45hLC8/afbEH9myCQCYEhgWg:dX8Fas1wRy165hLC8/bmyCQCYEhgWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624867344, "uuid": "f116b95f-6ab8-4bc3-bff7-2f90d907366f", "value": 142123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624867344, "uuid": "d4f28a50-c164-4f91-a66c-cc3800fca1ef", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867344, "uuid": "2c411692-f283-474c-b71c-769cfdd82acf", "value": "76103c7107be611f343b8a3d98fb0d2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec9e28a-d80b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624882944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882944, "uuid": "a5a3e60c-7db9-4c55-a874-f23388c6a678", "comment": "Malware payload (AgentTesla)", "value": "b0fd260fd8a4ab3745ab538ff3a71578", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882944, "uuid": "0da6fd91-f186-450a-8bc7-eaadc6030916", "comment": "Malware payload (AgentTesla)", "value": "05ceea8a97719ab46d9d2c369a69c4afcc0e57321ff59b20014c11802b052958", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882944, "uuid": "58df174d-7391-4f5b-9700-82f25ec52106", "comment": "Malware payload (AgentTesla)", "value": "fc6f18f19eda01ade53191e1bcce9f7628661dfc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882944, "uuid": "66fb8395-4c3c-4f5b-be24-1e94592f3abd", "comment": "Malware payload (AgentTesla)", "value": "a7cc3c4a62ef1259a0985bd611ac338f8595f45591addb05583ecf25145e368d222211e945661047c6ec99f84eb61dd4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882944, "uuid": "e82dfe47-120c-4c25-8128-de816dc4cbeb", "value": "7115BE203AE95126E6B65F7D49B06041567EFE632F17C87D28B132C91733A42CEE127E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882944, "uuid": "6b26953d-1668-4666-aea9-97f21868edef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882944, "uuid": "abc64de9-6dcc-44cc-8d95-093f0aed2e0e", "value": "24576:9xB4EJHV8fxg/2tR32A6QbLVgXor1OV95v80YUL:DS6iJE2P2AJbZgXoy95XYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624882944, "uuid": "1a74e145-5cff-4af2-bd21-fe015633f437", "value": 941056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624882944, "uuid": "ebefa3e0-39d5-4146-a185-c8450f386b8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882944, "uuid": "5c42079a-b17a-46e4-8b91-d1a59e3fa4d9", "value": "RFQ 28062021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf54a388-d7b6-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1624846545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846545, "uuid": "fb1cd5ce-8452-414a-a24f-3c2ad3ddedab", "comment": "Malware payload (AsyncRAT)", "value": "922eb3fca255026fe34d266cc847dbed", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846545, "uuid": "9a0b55b4-1eb8-4a87-a33d-1fc8e916357e", "comment": "Malware payload (AsyncRAT)", "value": "06a5f03c70a0ddc3ac57db35824d11d7531c1ccbe4afc5cd0fa56a4fc98aa3ca", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846545, "uuid": "39043002-8311-45d2-8929-45a5eca1a98f", "comment": "Malware payload (AsyncRAT)", "value": "e869a508a9255e6cae2d12b323df4f8434bff261", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846545, "uuid": "1f3186e6-ed94-42d2-99be-e734c8b10460", "comment": "Malware payload (AsyncRAT)", "value": "4a1a02832952c83998e596dbb306ad925327587446cf5fc613ef69e926c812ac3d45fd90e92a571adbb4450692fba91e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846545, "uuid": "69b78ab2-d201-4f95-8fd0-83edf94b0c88", "value": "E54633B7112B4467CEF48778988D3F24ED71B28757B2BC72C26909CC17E20796265FA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846545, "uuid": "f042d3f7-3ee2-4f6f-84d0-042ec6948af5", "value": "a99500afd029af1c558b8cad3f03bc2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846545, "uuid": "89b25c9b-fdc2-407d-8ea0-2f962cb96f7a", "value": "98304:nVM2bNxSfVm0zOvQu14dEn+fdeLhQkSBRTHzegx2WqdBlJ2hvP9TaH2TB9906:n+e4fVLzoQu14dE+fdiQkSBRTHygx2Zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624846545, "uuid": "53a2d4eb-109b-4cf6-9cff-6937cc00e326", "value": 5865472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624846545, "uuid": "2977866d-46bc-4bc3-833b-513245a50c50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846545, "uuid": "1a37510f-8d8b-4f76-aaee-38f2ba3a66e8", "value": "06A5F03C70A0DDC3AC57DB35824D11D7531C1CCBE4AFC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85f5fad-d84e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624911844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624911844, "uuid": "a123cd90-ce62-4d39-aba1-68ceac9845ef", "comment": "Malware payload", "value": "5e055aac810806e46828d518e27883a9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624911844, "uuid": "a650cab5-aff5-4ed9-a15f-dc9866dec38d", "comment": "Malware payload", "value": "07b823d46608cb550c01e93deef903cf3f311228a668bc93cfc69aec216d18a9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624911844, "uuid": "8f7c759d-7614-4574-ba46-79e9066de570", "comment": "Malware payload", "value": "efa0d86f8363c87ca1407ae9ec8f44cb039e7c31", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624911844, "uuid": "5bcdaeff-a07d-40ad-ba1c-bd4ad7ec3bb7", "comment": "Malware payload", "value": "1c21febf09ec496ad860c3c815ad3dcc11f1acd05c5fda6ebc168ccfa0d449870d5230487ad6379346e57af514969bfb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624911844, "uuid": "a8699992-971b-45fb-8868-612f0d7a5d11", "value": "C2B1B7EAE682AB1B2D0A836699F78EB6FCDF40FF517200A744002354F1ADBDD594E443", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624911844, "uuid": "39154646-d3f5-47d3-b993-f7c68f04e659", "value": "96:93Pf3sT3Pf35ApPTQj2R36KZ0LexHBZ8zlI5uoXD58l0JNOalgGlwzAlOv+Tlpwb:NULxApPTN36KiiNBZ852by", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624911844, "uuid": "1b94b5dc-bde3-4d9c-b288-02694c1f6fc4", "value": 5331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624911844, "uuid": "6072163e-c85c-4230-b5e9-060f69a93df8", "value": "text/x-msdos-batch", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624911844, "uuid": "e7d49ba6-e186-4e43-a521-d38db230107c", "value": "Contactouwjoyyo_Dyr_BGjAA%SG_xqa(249691035600Contacto.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c663dcf4-d802-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624879199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879199, "uuid": "ca2d7aa4-7a63-4706-b973-04e9cb6c286a", "comment": "Malware payload (AgentTesla)", "value": "48629eac414c0b3dfb9a7d4be7407e2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879199, "uuid": "d4a56477-bdb2-4315-8d44-f9f93ffadcbc", "comment": "Malware payload (AgentTesla)", "value": "0aeeebac5bd077bc48f371a2e2e5916de1c811752eef8b0d735f009d01e39163", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879199, "uuid": "4f7a4b1f-2e1e-4e4f-8c68-156a1988a467", "comment": "Malware payload (AgentTesla)", "value": "f825ba898db4e8f3fe1d82a71794837b6c083b32", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879199, "uuid": "4a008b0b-44ef-4edd-b620-19cd4dd34bdf", "comment": "Malware payload (AgentTesla)", "value": "dc824b5bd183ca817f60afa6c5bc5491b9a79b72ce0411b646c808ee28a89deac358558e6112e922439d18a3aedad4f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879199, "uuid": "6d84b04a-ec4c-4210-995a-f49882937b9d", "value": "7CD5BFB875047DD62A6F576BDA96ACDC03B62B239ACBA4CD806477C305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879199, "uuid": "67fdb9c2-480f-44f9-8bc1-61584a8c0365", "value": "24576:YVrppF7225JkRNMBdQs6D99ju6DzuTAZGXqfQyb3F3Iv9EeIF7g4EI4qz7SKqVW8:c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624879199, "uuid": "d2ef558e-d827-4d6c-a79e-7a1eb1a3b1c4", "value": 2792615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624879199, "uuid": "b1545190-5909-4f2c-a8f7-5ff680e072a3", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879199, "uuid": "c957d80b-9f23-4c8b-be6c-36bff25ac1b4", "value": "Invoice 07312020A.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94171e8-d7d0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624857675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857675, "uuid": "01f13c6c-1615-4182-b566-858c04db3700", "comment": "Malware payload (AgentTesla)", "value": "ea1c40b9188af0803b51d1a27f2abc3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857675, "uuid": "e786e5f9-3d16-4c06-9dd2-2ae6799d0d78", "comment": "Malware payload (AgentTesla)", "value": "125caafa4c7faba98d28351be9df1d207a983137e2d3e483504dc0fb5433ea94", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857675, "uuid": "d862869b-21d1-46f1-a159-003393fc1cb7", "comment": "Malware payload (AgentTesla)", "value": "08fe2a2279ff996ca128037a7850c0d98713d1cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857675, "uuid": "a7076829-bebd-47b3-a949-13d246e86e25", "comment": "Malware payload (AgentTesla)", "value": "996a623dfc6b350cf3d90472397be0b807a43cd306c8c27359d933a07c55d33915fae16639ebc76b8ddbb39b7688a450", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857675, "uuid": "98bda4a5-74d5-440e-b284-0643a825e811", "value": "3A15BE242EE95125E5B65F7C89B0204156BDFE622F17C87D28B532C91B33A43CAF127E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857675, "uuid": "d297db7e-28c7-4f4f-a793-dac27828d0b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857675, "uuid": "da465122-181d-48bb-91c5-729e31142a82", "value": "12288:qQwuo3obDPLziD38YgI0Uys1+J9jJz//jN05NkgnWNjE60SU12Nj6KSP1E:q+fyD3f20+Jz/jieNoBaZ6VtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624857675, "uuid": "4c3ea4a2-576b-4007-b2e0-273b790bac55", "value": 914944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624857675, "uuid": "cd61f104-9e97-4162-8274-4ddf7ff8ecf7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857675, "uuid": "ddca3b50-d04b-408d-80c5-6cd76fe1d9ae", "value": "WaybillDoc_3227610761.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbaa77ec-d7b6-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624846539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846539, "uuid": "277e70b7-6050-423c-8569-32b58cd11055", "comment": "Malware payload (Gafgyt)", "value": "12d7b08cbf828f5a4ab921218f9e0994", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846539, "uuid": "4a0102fd-6858-4391-a060-83b31d180c6e", "comment": "Malware payload (Gafgyt)", "value": "13d56ed672bb5c193e2723f1f3d902f9f8330471963d3e026f8e51379ec03b86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846539, "uuid": "80bfd153-654d-4fe3-9a67-a50e26d804e1", "comment": "Malware payload (Gafgyt)", "value": "c04af24d0c683743c304b1538631d50e1a1689d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846539, "uuid": "d33e040f-b05a-4309-af57-d4e153ce464a", "comment": "Malware payload (Gafgyt)", "value": "b856184720117b5029f3f04535b6872df3f99442f61ca2a9303bcc62cb41020c9a97e0cbc763c68e5e73209a4c721699", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846539, "uuid": "7153f899-d86a-47de-a3c3-1a50c6c7a844", "value": "BAB31977A4654F73C045A5F125BA9A310F12AD931B1F1A88773CB6B04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846539, "uuid": "076ba59e-57c7-45f5-bb78-7074eb06a116", "value": "3072:MDVLSItJP+Xsp4JlN3HJjmH1cuEgvniuN/:MDV+ItJH2l3HJjmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624846539, "uuid": "fbb951f3-4015-4e9e-95c2-f44399de3a85", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624846539, "uuid": "4fbd3f65-7d93-4246-92ac-2dcefd4593c8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846539, "uuid": "56eac27f-bdf1-4014-95db-509ea7af7450", "value": "12d7b08cbf828f5a4ab921218f9e0994", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce049cbb-d7a3-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624838410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624838410, "uuid": "5da02a9b-f61d-43d4-b188-0bc39ef4cd4d", "comment": "Malware payload (Mirai)", "value": "13bf665b3999878812069724dbfcacf4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624838410, "uuid": "58a51ca1-67af-4bcf-aeb5-b3c32e3cc983", "comment": "Malware payload (Mirai)", "value": "15d296f2d489a7ecf552bb63b5555e2bb54a44b34134f7300a089a3fd95f5e3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624838410, "uuid": "4973ac52-ed09-4c27-834f-058ac554f46a", "comment": "Malware payload (Mirai)", "value": "4f01fe0b2e3aa5446890d2c547e30d844aec4817", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624838410, "uuid": "444cd193-6018-4841-b9f1-fcfd08bad19e", "comment": "Malware payload (Mirai)", "value": "0b28ecf2ae3c81c99df0ffa5758991d6fe22da6bb137d855a6ebe43d39f90e23ada42d421852e354997e7ff0a9182f5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624838410, "uuid": "743f9138-ab66-4687-b4c3-da7c1a4ab414", "value": "5F5329C8E593F8F5DC140978306ABB66AEB3F13F7135E99BC3D82927A841702D10669D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624838410, "uuid": "a4a58284-3159-4437-9287-a56677f2824b", "value": "1536:IcR9170vwHbQXZ5+qXDEuXi9bLSW7p/d6reFt6HuQ4Zn:f917iwHbQXZ5+qXA59HSWF/Qreb6OZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624838410, "uuid": "b5279ab1-b5f0-486d-9b34-ebd9c93ad52a", "value": 66136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624838410, "uuid": "1c55ae0d-d89f-407d-959b-8aea5f92b652", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624838410, "uuid": "31245a02-3097-4831-9d42-d37dd797215c", "value": "13bf665b3999878812069724dbfcacf4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0af94b0-d81c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624890437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624890437, "uuid": "18af64ee-249e-4943-bc06-3c586e284bb0", "comment": "Malware payload", "value": "82131083bd83a28344529e0019a04e2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624890437, "uuid": "7f1bc885-3f01-434e-b493-4772850e6027", "comment": "Malware payload", "value": "15d4bc5c4d10d2a4ba5f3f040bd618fd327d0a2a7b0733efc914c725b49e77c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624890437, "uuid": "5438bf8e-2637-4e42-a563-348f55b46b4c", "comment": "Malware payload", "value": "991d0966f1720fba1b988196d0951426582c2891", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624890437, "uuid": "56678e71-0579-4543-88a8-1efb2a2e6c4a", "comment": "Malware payload", "value": "f183d447c0dfd0120090ed06c2fb3c46f8ec60abe85715f4afceee485a92c836fb94052acf6c87e9d9132f9239bf8c36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624890437, "uuid": "c8d15594-af80-4625-b9e0-706d7ef638a2", "value": "7305BF242EE85626F1FA5F7D96B5204556FDF6236F03D85C3CB602C90723A86C9F132A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624890437, "uuid": "8a061667-c714-4ab2-9a48-75999c0f8458", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624890437, "uuid": "c1c2d16b-ecdc-4de7-a40c-1ff5bc27ce6c", "value": "12288:JAPmOz1CMGwuo3Nn7KL8XFvsymcGs2dDnBvuwVl2CXn3zhHv8xq6aVaap:JAPmOpCM9+wXF0ymca/PVfTFUfap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624890437, "uuid": "f384a898-ae02-4d31-b8d6-28a65d4addc3", "value": 865792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624890437, "uuid": "418de149-8d7b-4d45-ae75-07c3638b3973", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624890437, "uuid": "028e2202-e8d7-4611-8cbe-9df5d3457ac5", "value": "BJEyJaMlv9wXr8s.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "796c51e5-d7d0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624857595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857595, "uuid": "62542dcd-b0f9-4fba-993d-377b499131b2", "comment": "Malware payload (AgentTesla)", "value": "122e3383bec71960dd999527e52f395a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857595, "uuid": "a5be0d3c-f0ab-47cb-bba7-45ee9ea44ca1", "comment": "Malware payload (AgentTesla)", "value": "1684642dcdd3c932404f6fd5de002dab97aa1ffb3213e9d09f0e2b8b3addaf7d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857595, "uuid": "8d2a8f60-25c8-4a0f-bf51-20c144d34c33", "comment": "Malware payload (AgentTesla)", "value": "35ba83a7a614d6107d53f31425c2343c4e9c0e16", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857595, "uuid": "4404cb59-7da2-4dc4-9242-35f38af984e3", "comment": "Malware payload (AgentTesla)", "value": "98dc8c6dfdfcdf51a6d8afeea8a332ad347262b4537679a8122ea6963cbf5b896722ea12938764141aeef2e3eea4996d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857595, "uuid": "e9070a03-adc4-4a58-96da-ea8ca6011acd", "value": "4194022C38EE5119F03B7F7AA6F1298ADF6F76176616E44D2D91020E0E23B01DD91E2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857595, "uuid": "65d88a7c-9ba2-444e-a369-80f1fb49f05c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857595, "uuid": "32e7107b-4f18-4bb3-8dca-03123a80da12", "value": "12288:nX2fAGjKxe3QxznjY4Ex+LMzNOOQE/UGww/T:X24SKGiloz/QKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624857595, "uuid": "407e5b0b-9c62-4470-b481-2a5b512cf495", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624857595, "uuid": "8cd12daf-1741-4db6-a81b-7adbb3a701dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857595, "uuid": "456a0ef2-2974-4383-9173-550806822356", "value": "Purchase Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68c15ac-d7cb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624855577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624855577, "uuid": "0aeab926-f2a9-46ac-a2f8-a374bd3a314d", "comment": "Malware payload", "value": "4b480ba6e7da6e053e1ff3e0d8dbf85e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624855577, "uuid": "cd1a90d8-fd35-4306-ab55-66eaa61df2b5", "comment": "Malware payload", "value": "17666e1e5c58a6f3d8d38c8ea09a7ac336fa40f32a50a65f4d09560f9105a194", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624855577, "uuid": "2b6cb802-7c4f-4ba6-9f0a-33f1c3c0d0ac", "comment": "Malware payload", "value": "b3fa078c09fb06a88d06d669f340dd7560791257", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624855577, "uuid": "e725e3c5-2a42-4d79-9fd9-74a3e954a36e", "comment": "Malware payload", "value": "a603333dd3e8483c5f8e98624704616726212952cc792e24c01af8cc066b59206a8e1820a39d99a9945fc77f411705f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624855577, "uuid": "e64e76bd-42bc-4086-ae63-274090615a91", "value": "B9A633625BB4F11FE29868B0F1FDD258209F31961C538ECBBB602563A6C178D65CF4CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624855577, "uuid": "984ccb32-b2a8-46d9-b44b-d41ffc5a14da", "value": "09d0478591d4f788cb3e5ea416c25237", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624855577, "uuid": "02bb3e9c-4bc6-41b6-93f2-d16980336c29", "value": "196608:9TgWJLYrTICXVTYR3WC/AD7I4f4R+0GzU:l1ar0STYRGC/27AR+/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624855577, "uuid": "5005bbfe-926f-4504-aa0c-de33bfe9302a", "value": 9633792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624855577, "uuid": "9f4d79f4-adf4-4bc9-9b48-064f18c86659", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624855577, "uuid": "09265c1f-35f2-4228-9e44-f64be14a19fc", "value": "4b480ba6e7da6e053e1ff3e0d8dbf85e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec15250-d85e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624918619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624918619, "uuid": "4bc103b4-0065-4f9f-a0fc-eab7aaab0a76", "comment": "Malware payload", "value": "4d8bfe6d8032b97fc117edce65acc3ca", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624918619, "uuid": "4d6e32b4-141a-44b7-9a59-15a3155c2bc5", "comment": "Malware payload", "value": "1b4dc75e64b5c252b762bf6e368e70bd4dc2b6c069953c158123cbbb3c49e989", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624918619, "uuid": "66021156-6b7c-45aa-9958-83222b3a6f23", "comment": "Malware payload", "value": "68c3b2bb07d2f05e6c469a5f2a208494c37c22f8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624918619, "uuid": "fe8bf1db-df76-4097-baf6-32fcc9a41e81", "comment": "Malware payload", "value": "730db84602566f34c7790a6bc1ec6a2c8754db6a8503ece2fda4f1a3ece90da06120282d843e39e90a90ac2f8d4ce5b2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624918619, "uuid": "8d1ee601-cd02-48a6-81ea-061d623ce4cb", "value": "DCE4AE82B6A3C2F6C19E21302FA72EFD4BFEBC1547A1E583D784D92C4872752536A315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624918619, "uuid": "6156e755-93dd-4298-82ea-cc7d9a1b13a6", "value": "7414bf5b01ef509d8291ea6d47664bab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624918619, "uuid": "6c68731d-6b60-49d1-b20a-697159412686", "value": "12288:pBHmmzAbDG5sjKfKraaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaJ:sbD9usug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624918619, "uuid": "6a5f7d47-e8c7-498e-a1e2-d614c7583c62", "value": 708617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624918619, "uuid": "28af6d01-030f-44d3-a3e9-9bdaa1798f87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624918619, "uuid": "d5791018-7140-4e61-9b4e-aff648998913", "value": "1b4dc75e64b5c252b762bf6e368e70bd4dc2b6c069953c158123cbbb3c49e989", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b4d437-d841-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624906065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624906065, "uuid": "261722b0-bed9-4daa-8187-4e7d0d85fadc", "comment": "Malware payload", "value": "45131b3e8dbf4c31b5a496b84172d48d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624906065, "uuid": "32f929db-a2f9-46a2-8891-e52be7219cd4", "comment": "Malware payload", "value": "1cb69106c7ca06c3513bf0d7d5c2ca3240c7b10ab0297c40f23eae8264860afc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624906065, "uuid": "999a797e-6899-4483-a67c-a44fe6b3d7a6", "comment": "Malware payload", "value": "0113037a879f230eeb019e5e6182d136efe788f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624906065, "uuid": "9040d86b-7908-45be-a515-e6bbb7a0e25d", "comment": "Malware payload", "value": "023554a6c521d9356251ff2dafabd15a24c1defa9777334dfd7996bb801df6db068ee75aa41f00f19abe5c2791052d1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624906065, "uuid": "e0317a01-65f8-4585-8989-ea311bf662b2", "value": "905302B14E4772EFD41ECC34E279054C92F39E3AE76A8A2B533C953193C2A0696F1C06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624906065, "uuid": "ba3da5cb-1b35-4b42-80fa-0ec530be5552", "value": "1536:TcLDNYJgd7cT2uN3KR99WHSFhR4Q9A1WwpE9Pw:QLDMgdYT2uY9gSrR3Zc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624906065, "uuid": "b2c70ee9-74ed-41d1-8057-6486f401b122", "value": 64152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624906065, "uuid": "f4127211-99e0-4c01-9ad1-f938436763cd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624906065, "uuid": "aca0cc00-38ef-447b-aa7c-5ffadb522a9c", "value": "45131b3e8dbf4c31b5a496b84172d48d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1797b63-d809-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624882224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882224, "uuid": "9bea539e-7c2e-4603-83b5-cca589f0e8a6", "comment": "Malware payload (AgentTesla)", "value": "17d329d5611cd2506f6ba432ab4b9fec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882224, "uuid": "67a7c83c-09ad-4554-a375-f40538a8ea56", "comment": "Malware payload (AgentTesla)", "value": "1d44aa8e8d6e57fbb3ddefc648e0edc48174cb421ff2fc929fc8d827b23863ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882224, "uuid": "5fe0da97-c7f9-4b78-8e1f-d43eb9a1f28d", "comment": "Malware payload (AgentTesla)", "value": "f31f3a3d052872fb3e65c2272adb26eb07aec0cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882224, "uuid": "759343a3-46b2-41b0-b904-f4d92db8f0e3", "comment": "Malware payload (AgentTesla)", "value": "989dbeb27cf34e807fd92ec7d652936dca4e260b4fde7ce57bbfefc357a6db791bcc1df30f0164da44f7f0d25824fb16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882224, "uuid": "eaae14db-7378-484d-8622-64e48a8e2ead", "value": "609402382DFEA059E17BAF3A6BF034558B7BB611271BE15E18C116574E13B01CD92A3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882224, "uuid": "46145b81-fcdc-4937-a63b-960010a61992", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882224, "uuid": "b9aae228-0ec0-4ee4-a41f-e87aeba0b8fb", "value": "12288:dL23Bn7VJkG4bjxRbV5tF70PkP8MnXfRi:B23tVmGujxRbVx70AnPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624882224, "uuid": "21d78836-6b99-4718-a204-629b2de1f7ff", "value": 411136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624882224, "uuid": "dffc5716-a61a-4b44-9b53-567c66e90a10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882224, "uuid": "9c0ade62-0b74-48d4-b9c4-cebaa96dcfd1", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b402965-d7a4-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624838647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624838647, "uuid": "d404087d-3687-4dc3-b33f-1f30f81835c4", "comment": "Malware payload (Mirai)", "value": "de44867eba80c5417b3494a8de7fdb67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624838647, "uuid": "a662492a-7754-42c6-8c56-f47349fe5ed2", "comment": "Malware payload (Mirai)", "value": "2050c387700e282738f24682e42d57fb6ccc596b9ee0d1cdd23493da7fd27af6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624838647, "uuid": "e8469bee-71cf-49f8-bbc8-6f1f670e8c61", "comment": "Malware payload (Mirai)", "value": "7b6a720b5bf6b40e1edbdbafe5d8d904e9f2e216", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624838647, "uuid": "42ee10b8-d7b5-4b2f-84df-5e508d55e85e", "comment": "Malware payload (Mirai)", "value": "d3dfca7b691e9e26cd401ee55cf871cac0dad5adc43f085bb65d76f39e22d1034ed06b97876ca8b9baed21f77205fd47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624838647, "uuid": "6ad13a79-490f-4dfe-8c2c-eb61b5fc00b0", "value": "63332B8968121E2CD6D358FD50729F4E9E551321A0A3070FA7ABFDC33D33269EF55988", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624838647, "uuid": "599a258d-1b41-4261-8c42-1f0d18f68797", "value": "768:mkuzcCLmgr/BIGh6HHaihHHeIXXdauZj0CGeWxhyF7BtM7edUo+f1prnqDQeHbR:mkqcC3rJIC6HHaiFu/ey7edJg1pLqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624838647, "uuid": "16be7abb-9743-4a1f-b55c-8a5558e4113a", "value": 54336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624838647, "uuid": "41c6a5fa-19f2-4b38-9f41-a848362b7c14", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624838647, "uuid": "df6ddcd3-ea74-4060-87e0-d4f128acd876", "value": "de44867eba80c5417b3494a8de7fdb67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d9fc9d-d851-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624912811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624912811, "uuid": "bea02aa7-2e9e-4685-b581-a6ef3d123212", "comment": "Malware payload", "value": "bce196c08432329154e14ea64722b1f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624912811, "uuid": "6ca223d0-29f8-4a16-95b9-493e820f33fc", "comment": "Malware payload", "value": "20691095f8e73e8f1910cd88542ff81adb40b23af4af133d7b9cfb2faa08692e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624912811, "uuid": "ab4754e5-88c4-4120-adf0-90010c62434c", "comment": "Malware payload", "value": "875f83ba80e5dfe24a6b5775a9a31e83603031cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624912811, "uuid": "76b7a58b-c140-4271-81fd-d6f51f5c616d", "comment": "Malware payload", "value": "7dfd2b756ed16ad81774cfa4e079403406da2a39673e9f15b4253c22f2a72cd748682f4ab52e27a8fca87443b161502c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624912811, "uuid": "fad14d3f-5c8b-49eb-b375-699814fe26ca", "value": "61157B42B3D7C0B2EFA119F2C57597362939BC35533888CB73D4382DD9A06C16A7536A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624912811, "uuid": "5b35a531-4c9a-48e7-86c1-ebfdf51f7a8c", "value": "1968ec9f56ef90ee3a44838ce2af9677", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624912811, "uuid": "11174983-ad7b-4ac4-a715-639836a4c837", "value": "12288:ylIh/vk7UuN/i67yeFOjqAHAOye/K8tD2jywq/rKdJLQPX6:ylIZvkYKq6POjqJOyu/tAywq/GUPX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624912811, "uuid": "1eb52808-37a1-4440-9a54-d16b9cf878d1", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624912811, "uuid": "db311bbf-372a-4508-9499-7632e52ed81f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624912811, "uuid": "feedbadb-ca53-45cd-9366-119eb0fc5459", "value": "QM8yuhw40r07dBgwM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cbdbadf-d7d7-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624860661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624860661, "uuid": "24e15269-0dd5-4a45-8b11-b06112e6d430", "comment": "Malware payload (Loki)", "value": "277092c4852f62a8356e0de0b9d0350c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624860661, "uuid": "f69b18f3-033b-4162-b496-8bffa5afe036", "comment": "Malware payload (Loki)", "value": "227c4faf7f8847fe9e03fd6c90ebeff3a5042a8a8fd4eedd79553085514686d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624860661, "uuid": "6f8e8c16-17e7-46a1-816c-3bc5848c1141", "comment": "Malware payload (Loki)", "value": "8be5eae6307f1c770c3ae0e92d0a8a88cfafa826", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624860661, "uuid": "adaa61b1-9a32-4b12-8379-53a30657fd98", "comment": "Malware payload (Loki)", "value": "646d34e0f73c924ccdd472429292b5674d4de407e389ff160d3e62a5bfcefcfa5a706ac07711e593c4ceb5ce4458fd7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624860661, "uuid": "03e8dfdf-75c8-4365-b5d2-1fd940e61205", "value": "BCA4BD72A5F2A4C4F9E98DB79C459082BEE75C58CD11811DE08931F406377C9D28AAFF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624860661, "uuid": "9d7781a6-aa4a-40a2-8d75-f09118cb503a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624860661, "uuid": "b010f826-eb0b-4ece-b8c4-219dc95714a4", "value": "12288:QC/dIVYS1LewazYsu+Jyoj7BlBidrrKlQpaBGR:QodIVA5zYsooPDUdrrKlQbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624860661, "uuid": "f38c643f-b163-4e5d-9e2d-93f637c843ff", "value": 456704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624860661, "uuid": "2a34d7ed-8ab3-4593-b000-52119e0b1346", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624860661, "uuid": "95b1025f-3457-4e16-8dca-3a655eabf381", "value": "purchase inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8bbcaed-d835-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624901107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624901107, "uuid": "806b2718-4b9f-42d7-8400-f6c2cc3556f2", "comment": "Malware payload", "value": "965d025618aba10c150a9cbb3dbadca6", "object_relation": "md5", "Tag": [ { "name": "csv", "colour": "#EA7260", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624901107, "uuid": "e327ae86-ff87-456f-a8d0-fbfbe1dcb4a3", "comment": "Malware payload", "value": "232c0285650c992b32d3a6a92e2d84e69fe87342891b15b8797c14c26805a428", "object_relation": "sha256", "Tag": [ { "name": "csv", "colour": "#EA7260", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624901107, "uuid": "22b34439-eb6a-45d7-87ec-05cd85812055", "comment": "Malware payload", "value": "dde8dd7c156b32077349cd22aa2006c9d18d7b0d", "object_relation": "sha1", "Tag": [ { "name": "csv", "colour": "#EA7260", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624901107, "uuid": "8d761754-2237-4824-83a0-e266359b82db", "comment": "Malware payload", "value": "ac793da31e36e16587c7e562fe77c899175a1bac848e146e5db442826833262fb1efb09bbb4a4ba8d1573ae0166e76a8", "object_relation": "sha3-384", "Tag": [ { "name": "csv", "colour": "#EA7260", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624901107, "uuid": "a3b2677d-b168-485f-a00f-9ebc01e69f39", "value": "AD93C0ACDB27EDD08B523831B7466C1B58092B82D202D6DAFA26DFD676C46C04E7C57C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624901107, "uuid": "ac76cf01-977e-42fe-8381-5fd9505ef1dc", "value": "768:6+zNd++dyTTLcdphbhNNsXlUxAZZLcvSSqP2II5GGf8iqLL0X//qV3LL+wx:6+zNd+HTTLcdnOXlUxAZZLcOP2IIf8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624901107, "uuid": "1a01b6a7-6223-4f93-979f-969dc8fe4487", "value": 93178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624901107, "uuid": "f8d82ada-8cb5-4cb3-844d-5ae7e61e2781", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624901107, "uuid": "1c72e1e4-d579-4153-a10d-67bb574dfeec", "value": "Bel2279.csv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "796fdc62-d7c2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624851582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624851582, "uuid": "474f5ef1-fa8d-41e9-9337-cd5ccbb50a5f", "comment": "Malware payload (Mirai)", "value": "ec06f2461599b0dfb962ea272bd1cde0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624851582, "uuid": "7938a018-700b-4d0e-8af3-54f283db95cc", "comment": "Malware payload (Mirai)", "value": "233501318e698da57e0578b90bfce5f0926684b499d7d976fbfe2b3b85a1a6cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624851582, "uuid": "aad721a9-39c1-4350-817a-59cc871f5d65", "comment": "Malware payload (Mirai)", "value": "3bc88a64dc95f5ba8a2c2adc2d265e41dc3ed609", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624851582, "uuid": "493ee066-1d79-4ef0-9d7c-e13d25f83844", "comment": "Malware payload (Mirai)", "value": "2266c30d4c6e3c02b19fcb139452bbdc57748dd6b24b126ae2186c9825a2386dda28b23190dd5a718c2bf5bf486215c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624851582, "uuid": "066dd23b-c95e-4a52-bab7-42d9e2df4d88", "value": "A0B32A4AF7408F13C4D51776BADF42463323DB54A3EB23065918AFB43F86AAE4E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624851582, "uuid": "19751837-69ef-4887-84a4-c5e7c6a40a86", "value": "1536:ptnX53WNw5bZBtdYnF3X3CPp7VdlTiJihsZV9tMmaAW9+UkUzw/9b4bSaRPUk88E:131LYnF3X3CPT3sZrqmRWrM/9bPDjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624851582, "uuid": "e77fe6f2-7084-4c81-b99d-416ac3be2bfc", "value": 108782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624851582, "uuid": "78577bc2-3817-4c0c-8f9f-81b30f760f6f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624851582, "uuid": "04e57d44-94df-4836-93c7-27dcf3c52ca5", "value": "ec06f2461599b0dfb962ea272bd1cde0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9c70d1-d7f3-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1624872663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624872663, "uuid": "8afc6bf2-71b2-4023-a881-9682416d63c8", "comment": "Malware payload (AsyncRAT)", "value": "aa1849989978d996167dd129044e1bc9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624872663, "uuid": "e1b9aafe-7012-4368-bd3c-d07b53027583", "comment": "Malware payload (AsyncRAT)", "value": "23b83aff4689c451f419a400f3b2bfcd29f2ee9c4c13e8b54f2a87d03ebc32e8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624872663, "uuid": "2b5ddb96-c492-4f03-98ff-4b4a1f806726", "comment": "Malware payload (AsyncRAT)", "value": "a7e9166ba0141b1b9f8637324cf93b9a35857dd4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624872663, "uuid": "05fd758d-cf0d-4346-b32b-0db97e97703a", "comment": "Malware payload (AsyncRAT)", "value": "c73f6966b13337a3e3f7eb8dcdc939cd4fca57f1e6b03dc863a8ec6802bd719287ca3999253a048a13203fede8f6b8b5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624872663, "uuid": "bd1a1429-7a14-4a05-a0c7-47076df5021d", "value": "7C232A0037E8C22BF2BE5F78A8F26145467AE2637603D6492CC451DB5713FC69A426FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624872663, "uuid": "4925f0d4-5838-4beb-acca-5c3f66d5ed50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624872663, "uuid": "55638e5a-7b35-45ba-9569-7e6485737cd1", "value": "768:zu/6ZTgoiziWUUM9rmo2qrlIwHxHuPInzjbwgXXis4mtTl30B/pT04K3BDZvx:zu/6ZTgle2aj3n3b3Xys4S303T04KxdZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624872663, "uuid": "9585e889-9a27-45ae-9c50-06614a4cbea8", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624872663, "uuid": "d3273fce-9542-4f7e-bd48-146ebaf3d91d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624872663, "uuid": "3ec058c0-9bbf-4ad6-b1e4-7e9b2adfb315", "value": "aa1849989978d996167dd129044e1bc9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2547297c-d7dc-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1624862608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624862608, "uuid": "48e19e26-e0b6-4e4e-8c16-e1ac46319cfe", "comment": "Malware payload (BitRAT)", "value": "fa0b6d3c4c059a046944771a8d6fe7ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624862608, "uuid": "11649bf0-8e7c-4b62-82df-256a9a844790", "comment": "Malware payload (BitRAT)", "value": "2448bed4db497e26e9def8dc20369bfd843bcb0e73dab435fe61ead1cc2f869a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624862608, "uuid": "eda240fb-7a7e-44fc-976c-12b3546bd4c6", "comment": "Malware payload (BitRAT)", "value": "818d4c1b24a865fc63d56083210f13702da7a4a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624862608, "uuid": "19d5bf51-52c8-4481-a9c3-e2529e1a85bb", "comment": "Malware payload (BitRAT)", "value": "364364af952aaa7820e9d57abb29d0cfe82d3ca57962b8bea5eb81ce6c3c59f4bb3377d9dd9e624b8b3d5a7a65fc9973", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624862608, "uuid": "9b19146f-afa7-4aea-a82a-ba1d87fd2e63", "value": "F36622222E2D40F5E399C831D427BE9621B5DE19DA4164F06CD7ADCFE8338B4E252D4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624862608, "uuid": "36f745be-a55f-4119-b9fd-f26a6f6a162b", "value": "ae28306bf70f5963ea0555dfe529913b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624862608, "uuid": "2c2c7270-a3f0-4fca-baa5-4f5b4083969b", "value": "196608:/2KZtT4C9f41RkCDIhWbk/jtKdFJSl9dxHlKe5:/XZtTfu8CDY3/IdFJ69ddV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624862608, "uuid": "8aedc824-651a-4edf-968e-1bdad121cd72", "value": 7053312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624862608, "uuid": "85dcc1ce-9c49-4036-ace6-3e1ee91b9df1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624862608, "uuid": "2c46672f-faab-4ba5-bdac-117dd9cb1d8f", "value": "fa0b6d3c4c059a046944771a8d6fe7ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65630bea-d80e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624884190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624884190, "uuid": "bca82e77-3738-48e7-adaa-54c3086bd766", "comment": "Malware payload", "value": "f4b5bf2340ee26ceeb762e7f288e9e73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624884190, "uuid": "3cfd3daa-b040-46d4-b094-55b7a44dffae", "comment": "Malware payload", "value": "27184266a647b3678779aef4ce2938a45d76a9ef56f1fd53e9722c8deec87e98", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624884190, "uuid": "c82e9bfe-0004-44fb-b959-2b24567ca476", "comment": "Malware payload", "value": "5112f18009ee1e98957cfc4ffc5fd0c8920fce3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624884190, "uuid": "6faa12be-e240-4b4d-928c-f56b88723d91", "comment": "Malware payload", "value": "bf7a4b4223575041292c91ae90a56edf65c7e4688795afcd781560f616640ccf49bac15d7a07d337a947b3686521520b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624884190, "uuid": "99749de6-6e55-4099-a2be-8465a689c171", "value": "AED5021373DD8365C7B29273B916B7326E7B7C2506A5F45B2FD8293CAD30162420EA63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624884190, "uuid": "e601f6b7-a4ec-4940-8618-a4ce10a6871f", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624884190, "uuid": "94174443-3416-44f4-875b-a6f3940d1ea5", "value": "49152:SVg5tQ7a3KW5JQVqVwzRNm90eHqhdMc5PQpHf5:cg56cjQq2bm9VHQdM0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624884190, "uuid": "a266c7ac-0de5-4605-903f-cf9ce92a0237", "value": 2789376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624884190, "uuid": "5f58234c-c235-45e5-a863-7f5d83a47bf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624884190, "uuid": "f673270d-2f21-4e3b-8abf-98a470bf9058", "value": "f4b5bf2340ee26ceeb762e7f288e9e73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47e9b44-d858-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624916186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624916186, "uuid": "dba2dd73-7ce8-4262-bae3-35e3ac1350b7", "comment": "Malware payload (Mirai)", "value": "8ccdb09dd7290ee94f5fc38a0257a727", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624916186, "uuid": "4f8210c3-bcd5-438a-9c21-042861498a6a", "comment": "Malware payload (Mirai)", "value": "27ceb10c25350908441bc16f4106a8e7838debf68c569febb4a5607cc6e8a93a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624916186, "uuid": "b3e86124-fb9f-45a8-9af5-5724333a1c9b", "comment": "Malware payload (Mirai)", "value": "0f949494d7c75c99004560df8cc6b1aa641ccae7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624916186, "uuid": "ccf2f324-838b-4818-9804-05b6fe6c838b", "comment": "Malware payload (Mirai)", "value": "237ee6f671b9de45c9dec283307d560c2127ad22d3319c60d6d0eab5266cf39ac67edf03e03e1950ce3e36a43848e29f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624916186, "uuid": "516f557e-3af5-42c5-b4fc-3fb9b42f3fe5", "value": "5FA37C36E0AEA9D0C4A54238E8F99D740F5171C853727DB35AC049B800DFAB0BA16FF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624916186, "uuid": "56041ebd-cb6b-4a43-8289-2632ec0ae010", "value": "1536:w/8GPTZJwtrgiqZO0zFRdK63fBW/+h2XuyFBxmvRiuCWYZ:wRPtJFiqZO0zLQ6vBH0u+evRiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624916186, "uuid": "01e095e1-1f03-4dda-a4f6-f7127c27dc7a", "value": 103500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624916186, "uuid": "57bfa5b6-a014-40b5-9168-3b8f9a20700e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624916186, "uuid": "ba223a06-e983-4c40-87c7-8b8b4c3dbb35", "value": "8ccdb09dd7290ee94f5fc38a0257a727", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1386dd0a-d7b5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624845828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845828, "uuid": "c94dbb3a-88f6-42fd-ab92-8fe2b13b0c39", "comment": "Malware payload (Mirai)", "value": "5dfdf268863813e31534dea7bbab5d16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845828, "uuid": "fb399721-50bb-49e5-8bd0-a2c6c473cdf3", "comment": "Malware payload (Mirai)", "value": "27ff7720c49d12f8a63bc423825e23ab4ead7a4dfd42e292fea567b79b0541c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845828, "uuid": "3ebf91cc-83e9-4fc2-9203-f33c575a0bcc", "comment": "Malware payload (Mirai)", "value": "e34a4898991d47e1e65f37916bd26727c59f3b7b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845828, "uuid": "4b22c4b4-12d9-451a-a897-23ac28577b6c", "comment": "Malware payload (Mirai)", "value": "274587835a532f35c8fb492afd7fc07306c3692aab0ed906f8641c706c4442cee1738d961fa366eed60cd6ebe884173d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845828, "uuid": "eec3be24-f74d-42cb-9bbf-1a655443c8e6", "value": "3D632A99B402AFBCF99FEAFA41150A0DF421E25460930F27B32BEE937D710A5DD06D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845828, "uuid": "cbc3b27d-e890-41a0-8d4f-d59149ee75b3", "value": "1536:KTg9OuTOegLwFXRpurOvyaNWGrLtGyn78jPx:lyegLwdRErG54iGqcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624845828, "uuid": "783c1181-b0b0-4c8d-a350-2fe4c0dcad7b", "value": 67208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624845828, "uuid": "1b4ce57c-eaa8-44e9-8fbd-9f9169bc88ef", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845828, "uuid": "f8e07eac-b4fb-4583-bddd-20045640bc13", "value": "5dfdf268863813e31534dea7bbab5d16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61614a3f-d808-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1624881607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881607, "uuid": "62fdc557-fe1c-4159-ac82-5dff842660df", "comment": "Malware payload (AsyncRAT)", "value": "7427a18b6a21774c62011d6b42331001", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881607, "uuid": "2295731c-d7a6-4eae-b633-00693c7f4e6d", "comment": "Malware payload (AsyncRAT)", "value": "28073a988c9c4227dac8997449b8e5706ee88a58fd92e17f9c0c4586f0be829f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881607, "uuid": "19587ed4-36ee-4b45-b184-cb39cfb8355b", "comment": "Malware payload (AsyncRAT)", "value": "3b35f6664d139d06436322c97fc7f10437988702", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881607, "uuid": "54491de0-c7eb-4dab-b551-9b482f6bdadc", "comment": "Malware payload (AsyncRAT)", "value": "d20f364c6d8c87910962ba94e88bee5dc9818519512c5dc3a841a9f4f0986450000cd0a634401b20f29542328d3244f5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881607, "uuid": "7543f793-1118-4f70-8eae-45bd6242c113", "value": "2E44E01C2EED0059E177AF7A5AF43659CA7EB7172607D41E2891034A0E23F41DEA2A3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881607, "uuid": "8191233c-d2c1-4020-ba0b-6cf587cf600c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881607, "uuid": "641336d7-7704-4214-a7e6-1e94daff22ff", "value": "6144:Sfu2zEcKnjyo/ln/Xy1usPTRqDzB6iXgs6f8hnsqhzYiBA5+:Sm2l8jyo/MPIAiXgBrqZYiC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624881607, "uuid": "89f21cef-20ed-46da-8bd6-c836aa05aa49", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624881607, "uuid": "da1dd82e-ff1f-45a5-97e6-d499726db30b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881607, "uuid": "4fe63d5c-6f4f-48bf-ac0d-99457024d3f4", "value": "Product Inquiry - Yamazaki_2021 OS-005_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e9db3fe-d7b6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624846491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846491, "uuid": "6658ea07-cca3-4e21-83bd-924f88613197", "comment": "Malware payload (Mirai)", "value": "6650c16814238c7a3fbcc8c9aef8b881", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846491, "uuid": "9e832086-438c-4153-88db-fe5f562a0a17", "comment": "Malware payload (Mirai)", "value": "29184fbdc70b13ab0e501aaec80504fcb4a81cb3e6943add23337b094ff55c5c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846491, "uuid": "80aa0a12-9945-43fd-bac7-42fc68f46a9d", "comment": "Malware payload (Mirai)", "value": "4cae3c6e24a1fa6fafb1585329ee131cf5224363", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846491, "uuid": "a096bc09-0ec0-49ea-b71c-f8579955b3ee", "comment": "Malware payload (Mirai)", "value": "07bed37925e58ebdd0df46c840c385e96a215979732ab23673a9bace86a8263d27d810eeeaa5143a65ffaa46c7c17178", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846491, "uuid": "2b9d6002-aa0f-47e2-aaf9-2bf5a73caf69", "value": "ED63F682BC80E626C7C01677FA6F519E3315A7D8E0EA32429D155FA07ACFC1B0D6B746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846491, "uuid": "56aac5bd-0e66-4b09-a853-973b3c30d02b", "value": "1536:bZ4ZLO7YQ010oQJ6sZad7jL1B8t46eTmfJqh:bZ4k7L0l7nn84JTAJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624846491, "uuid": "ca4c20fe-e09b-4796-ad1e-49ee39dc8415", "value": 70652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624846491, "uuid": "6d154169-8c13-45ca-b13d-5842facb2aeb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846491, "uuid": "df8bce8a-ad02-4023-a997-25a5c1211127", "value": "6650c16814238c7a3fbcc8c9aef8b881", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5f986ab-d807-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1624881292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881292, "uuid": "1a84b1ad-29a0-48bc-a19b-e929356c8d55", "comment": "Malware payload (njrat)", "value": "885a9de3525d6831314160bbe33d838f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881292, "uuid": "4848e319-c125-4d70-a704-01dc152e2537", "comment": "Malware payload (njrat)", "value": "2b1e0b1b320aa81b41cf142297135183f00ad695517f12d3f715fd58eaa6a9c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881292, "uuid": "a44519ad-f995-4ad3-8ac8-28c992579247", "comment": "Malware payload (njrat)", "value": "36e6c79c9628422f50b546f8fac71aaff4510ab8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881292, "uuid": "aba38971-d842-4e90-b22b-4ae9eeb204cb", "comment": "Malware payload (njrat)", "value": "a5ce5b7944fdd81b75c39d28b4b1e67d6a285034d88e9344dfcdb099a5dfe0f3631ced1c773e0f0dae4a43ddff610be2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881292, "uuid": "0aae6ffb-dffa-4eb0-819c-a1b58cc82c96", "value": "BD34D0282DED5198F177AF39ABF036548BAAB6136713D50E298502474F13F41CDD2A3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881292, "uuid": "f2891181-52fe-46e8-a52d-8b32f3759111", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881292, "uuid": "90140573-c5a2-4984-9382-24bf5ee8c70d", "value": "3072:bgIoWQ1uk/Kacgie8xxByVOSUW8DkpwQS2lUSSHeZqfif3P7CBsm2wUVjq4HWiF0:T4u2AbvTeUWwISYUSqe8ibC2waj5VF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624881292, "uuid": "90fbdd11-bba1-40e2-b956-6c0dfe55a4dd", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624881292, "uuid": "5711ff34-82ee-400f-8e60-51a433928839", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881292, "uuid": "8ea1e5c9-f072-4028-846d-219c6cd59fe0", "value": "885a9de3525d6831314160bbe33d838f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef75e54-d841-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624906057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624906057, "uuid": "9be00592-62d0-42ad-a029-516477685217", "comment": "Malware payload", "value": "b7b3e7a9fea3c77ac896150113addd13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624906057, "uuid": "e67f819a-bc8e-40b1-a9ce-9e8c3e2113c6", "comment": "Malware payload", "value": "2bd8ffb1f4a08432fd3255cbe7988d870cdf6956daf660b86c0df148bbc4d470", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624906057, "uuid": "6ec055f6-ea12-4f0c-b871-eda62bceb758", "comment": "Malware payload", "value": "1be93d3379540c84e963886b8c8e1ad56d798731", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624906057, "uuid": "b55df627-d226-4873-ae6f-8cd4a4c34215", "comment": "Malware payload", "value": "c448a6e0b4d2ac60692ee4ed849ac8969cc9df01f0ea856e7aa829f589849e382bf6d0887f1a4563bfe4dddd33d04dbd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624906057, "uuid": "3f4b1daf-1478-4bcf-a6b7-e464b8775f99", "value": "ECE2E10298EC9F1CE56A10762E2BB7590C62F64DB382AD705F9CEB365A01B171F48B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624906057, "uuid": "5a83552a-83e7-4671-b7fb-342d54d54eaf", "value": "768:urKBirq/kT8aMCNNUsMOZ39QFawt/7xH3vI13LlinbcuyD7UryqD:ur+i+MoKN6NOZ32FjlfaZinouy8mqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624906057, "uuid": "3db25779-5b80-4f68-96f1-6e5f5f14a3cb", "value": 34108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624906057, "uuid": "99e81754-ae2e-4c81-b87e-233a6bcc844e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624906057, "uuid": "f75d61ff-2f01-4f68-85fb-b12f2aad2e0a", "value": "b7b3e7a9fea3c77ac896150113addd13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6f509b-d80a-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624882595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882595, "uuid": "d10a0430-8d1e-4221-a900-ff9c4eb1ebb8", "comment": "Malware payload (Formbook)", "value": "3bcca69e39060206b9903df14ac37396", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882595, "uuid": "1ffc1672-ba8f-4f7b-8919-c93b76fb184a", "comment": "Malware payload (Formbook)", "value": "2ced4843ae81ab8de3e28e481e4865374b67a9b46d0df2dde3af65b50b857c2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882595, "uuid": "ab8a9ada-68ee-46ed-b100-417729f0cfde", "comment": "Malware payload (Formbook)", "value": "c8d36e8024b0907336b01c2181c958a5d1ff7582", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882595, "uuid": "a8ab0e67-2b4f-4425-ac7e-3838385b8d87", "comment": "Malware payload (Formbook)", "value": "8f834e17ef3179c3b298deed4cd0bf41089d6b0348c894493dc9e1b57509860c901d9486cc5cac584fa8da97c40c4056", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882595, "uuid": "e84e6bcc-2e91-4ba9-9a6e-aefded45d1fa", "value": "9715F1313384765ACA7A13380922764017F19E512A26D33E6D84B64D7BB5BE34B237BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882595, "uuid": "e5bf9882-4ede-4398-b7ff-239a1b5cd2a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882595, "uuid": "0b0f6bcf-ec30-4897-a2ca-d69421cbc648", "value": "24576:Tgc2F7VjfcruKRqOyajSYXKCZYEkEKyBNm:yf2dFSY6+jDdBNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624882595, "uuid": "c5694dbd-179e-4938-a453-05cdef53f5b6", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624882595, "uuid": "254b4176-d483-4306-bee4-682bc1cd1e16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882595, "uuid": "d78f145e-6de6-454e-9489-a31b4513326d", "value": "Order=bcm_28062021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653ccdb9-d83a-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624903088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624903088, "uuid": "dd8887cd-7813-40ea-96ba-16a58a518df5", "comment": "Malware payload (Mirai)", "value": "3d7291745540f33aa420facfa97ae072", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624903088, "uuid": "ed2cb0ca-350e-4dfb-b223-41ffe229ae92", "comment": "Malware payload (Mirai)", "value": "312f1dc86d61a87e3b5b569188db6a5a8140f0e0aca13700503952f2b649ba0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624903088, "uuid": "dc95d5dd-ca3f-47a3-ac64-0ec2b4b0ade0", "comment": "Malware payload (Mirai)", "value": "d92808e6e1903430d6dd913739d79344ce309505", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624903088, "uuid": "350a6c0e-2ae5-4177-a249-4d13feb8de71", "comment": "Malware payload (Mirai)", "value": "d981922dee9a17a4be08f49481756ed8812be671746744c45248636a6fdc5a96f7a1ddc63e269f8213aa98d41216b977", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624903088, "uuid": "416adb50-51cd-413b-8fd6-e4ae20919820", "value": "26D2E1016241FEE1C5B00232E9668A9772153D75D0D134FBDA3D0DF8E6E960D47F4A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624903088, "uuid": "72fc5e6e-5652-457f-aed2-8edb2d165974", "value": "768:EusHfRavjynNKnjFcZIhQzhKMXg79q3UEL7n:WRwynNIOQQ1KMwaL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624903088, "uuid": "1b863fae-47ff-46a9-9555-02b70cfcd1ea", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624903088, "uuid": "6ebb0414-822d-4188-ae62-b217f64a4107", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624903088, "uuid": "49c90fee-92e6-44e4-9a96-5a13133ca37e", "value": "3d7291745540f33aa420facfa97ae072", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b0abf8-d86a-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624923535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624923535, "uuid": "255c86a1-dc8e-4a16-920f-866ee7dc7de5", "comment": "Malware payload (Mirai)", "value": "7769aaaedc60edfe606e0b4b848ba3a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624923535, "uuid": "6d05ccba-167d-47c2-8c66-a3e02ca5f143", "comment": "Malware payload (Mirai)", "value": "32bd9f887f5a15a51e1c73dabfb9ea5e1fe7ae121718bf539b41849607f48ff6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624923535, "uuid": "490d8471-fc50-48ba-814a-4c0e84785d3f", "comment": "Malware payload (Mirai)", "value": "f8eb0c004ed20ad86eb2c1573c25f2353b6e8020", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624923535, "uuid": "70140578-3787-4f2b-91cc-0f1716c10244", "comment": "Malware payload (Mirai)", "value": "0407584b66495e1c819758210e1d46e1b1c85f732cf33f421bd0d25151a109985cf43653353befde79f29ebef0cf53dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624923535, "uuid": "568f8ae5-d260-4de5-9ac5-92d469610672", "value": "654302B063D021D37AF8587675B78C4F3A90BFF8E9817985316A142C2BD9E4470B6BC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624923535, "uuid": "deba1618-a0bc-4a80-a4db-35b6ce250ae6", "value": "768:st3c5AHo6R9XnMPYwvqfwSGho0V/sW1Bf6rLC8G7uTVJNq3UIe2tD22uc4qo73sF:4cj093KvzDiokWfWTaem6qoww16v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624923535, "uuid": "3d876c95-5bdd-49bf-bb64-35b2bef4d15d", "value": 56040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624923535, "uuid": "874a1357-ff24-429d-9660-9393ca3ac4aa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624923535, "uuid": "d68ce376-5625-4214-96e6-57a52a51b7d3", "value": "SecuriteInfo.com.Linux.Mirai.1206.2895.10198", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44398782-d839-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624902603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624902603, "uuid": "c57ea7e9-4669-4382-9397-696f5c0201eb", "comment": "Malware payload (Mirai)", "value": "120772540a787304d055815bb48516cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624902603, "uuid": "979d37e7-d324-46d7-b327-250e0b6447ca", "comment": "Malware payload (Mirai)", "value": "3306806517f13b9702bcb27efeb71c1bc854bebdeeac5e18f756a05287058441", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624902603, "uuid": "7a318263-7719-4512-8ca1-016811f1c9b9", "comment": "Malware payload (Mirai)", "value": "1ab81a0464902f3c209698768a730ee571b507d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624902603, "uuid": "c28b7b5f-4e42-493a-ab81-2e97ab47ec31", "comment": "Malware payload (Mirai)", "value": "df7f668b7e90ac2361de225670f95b676abb7b1adc62095fe27bf53d5f46824574076e51a49ee313ed974872627e913f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624902603, "uuid": "2e3d1299-fa8b-4677-8919-cff063c5c1b3", "value": "97333BD6B902AD7CF99BE6BE80270E0AB13123541053073777EBFC937E321949956E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624902603, "uuid": "585513d1-75da-4180-ba58-611d2c4f1c63", "value": "768:8CeKEfhe5XdrbentIYfNMQn5MdgFHj0iPuvWeffpqmUJTXr6Lu380Df:dsfIBZeNlJDFj0imvppqmUJP6Lc8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624902603, "uuid": "7c3322a9-720b-42c1-a917-a0cf13340cad", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624902603, "uuid": "8c1da739-bbdf-4bae-972a-8094de212de2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624902603, "uuid": "1bf9b2ea-8f9c-40b2-b9df-f0869716d274", "value": "120772540a787304d055815bb48516cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d04c9a6-d83c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624903852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624903852, "uuid": "599b7776-c24d-4733-94b3-08702c14d29c", "comment": "Malware payload (Mirai)", "value": "a8aed47d6078b2a89d5e512e312b5225", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624903852, "uuid": "c154ed23-b8b8-4596-9a79-118c4fc2ccb4", "comment": "Malware payload (Mirai)", "value": "3329160d4641e5e0e509939b9c3db4a46617182d5bafe11bebe2763ea3d900de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624903852, "uuid": "ba8bc796-8c02-46f8-8656-52798377116c", "comment": "Malware payload (Mirai)", "value": "4d6cc720935f65bbde9a36d8f865b6597952cdbf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624903852, "uuid": "28048f2b-3a56-4d94-8375-a2e6694712fb", "comment": "Malware payload (Mirai)", "value": "fd9caf6c91046aabcf59c39b608b47947a5787479a2f5abde368bf312f884986033bdcad55e8dea1638a60cf0051c2e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624903852, "uuid": "e3849e3d-7d9f-48c4-8f9c-5a6dc502727a", "value": "5AB2CF717015F8B2C7A200779EEDCA83BB801EF8D0E8732A5465099DEAD5942BAF2547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624903852, "uuid": "39b27be7-dbf9-47cc-9490-1db596bb3f46", "value": "384:tZ0X9nxn8o9ir/nSdoijsN2e4JQkCD2EjKb3p8hymdGUop5hh:QX9nxn8o9wnBoWzEQf2EjKb3p8s3Uozj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624903852, "uuid": "518838fc-218f-491a-a3df-6cd57e5533b5", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624903852, "uuid": "a467c012-c66e-4271-b28b-da275b402981", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624903852, "uuid": "b6dba4b2-912c-48c8-8e41-25ef75cc3e8c", "value": "a8aed47d6078b2a89d5e512e312b5225", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "106eaea7-d7b5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624845822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845822, "uuid": "1429a7e7-7553-4c23-bb87-5aa6981ad52c", "comment": "Malware payload (Mirai)", "value": "21149de01f7a274210d0a66a35e27957", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845822, "uuid": "7c0932eb-5372-4f83-80a1-7fbe8c7d7f2a", "comment": "Malware payload (Mirai)", "value": "3393e0fb5b3baaf624852981458073ba233e32197bc2792cbf94e4598fcdcc1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845822, "uuid": "8b29f269-ff6a-473d-9cef-4616438c57c2", "comment": "Malware payload (Mirai)", "value": "52aa2a64845602b3a670045366f544dfba354547", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845822, "uuid": "1e89d53e-7290-4c10-8f92-4a5715699bbc", "comment": "Malware payload (Mirai)", "value": "f650df1f629ec81ee48cbdb11996ac353d788174c11206fb61442f2e72782a1113a1110900f3d899b0d3d66efcc721e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845822, "uuid": "a4fb4f7f-dc71-47a9-9ab3-b48eda44295a", "value": "1C534BC8A5C3E4F5EC001D79307AABB1AA77F53F2035ED9BE79E25639902603E10169D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845822, "uuid": "43ed26a9-6ffa-4126-9df9-9a59f494a347", "value": "1536:b5VYYpXIqVkxmxRvXMFnKiahjGKO18Hq6PWsYAz0+j/iMAm9x:diYpROxmxhXMFnKlRGHCHqo5z5/uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624845822, "uuid": "0bce3b79-6268-4d29-a99a-ecfe0b208cdd", "value": 63664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624845822, "uuid": "492f145d-8769-49dc-b900-893e46af672e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845822, "uuid": "eccc0d9a-8552-4ac3-b5da-2a789e8e1713", "value": "21149de01f7a274210d0a66a35e27957", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e008e804-d868-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624923051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624923051, "uuid": "d5a9a28e-3e54-4d4d-bd13-47a56eb464cb", "comment": "Malware payload (RedLineStealer)", "value": "65c52651f68f8e165607ececcb5984ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624923051, "uuid": "15d90ffb-a4a5-4f03-b495-7a7683341c12", "comment": "Malware payload (RedLineStealer)", "value": "356726b20529e961530d6f9045365a126afccf42db8b47dbffb3aa222e55f78d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624923051, "uuid": "a714c075-bf42-4969-86cc-39ac2bc3bcb5", "comment": "Malware payload (RedLineStealer)", "value": "f9d9cf41fceff297b6d4fff3fa5ab61be40e3591", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624923051, "uuid": "f9157521-6710-40d9-8f3b-7230bb7e27b9", "comment": "Malware payload (RedLineStealer)", "value": "2d6099bad54bc5aa319d7156cc322186d6bc4c004b89159a5fba6d321903ad8ad0e31229a7121696e21718a315371d3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624923051, "uuid": "fc6bae3c-7741-4109-83a7-70b2591512e6", "value": "BB233C5644A4B14AE9934CF01A54EC763E3CA7B21C80D10DE466D25CCF87BEA74DCAEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624923051, "uuid": "1e9f05f1-a8c8-472c-ab00-6050a6e1cbf3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624923051, "uuid": "384334b9-0736-426c-979c-0e0be0011d1e", "value": "384:EA6MKV0qp4/oxcGeNRFyJztP5HKPI3tASgOL1SHBzpjPYT//M4+67csH2s/L0Gf4:ED0H/MkgzR5qPI9AS0VNYQ36Aiq84OA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624923051, "uuid": "a779f4af-b902-435d-b340-af4557f3e823", "value": 45592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624923051, "uuid": "2f4ae707-589c-4f07-a06d-048db374e393", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624923051, "uuid": "75b5491c-d9c1-4123-bfc5-8741c79e59fa", "value": "65C52651F68F8E165607ECECCB5984AD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b457490b-d845-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624907945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624907945, "uuid": "d2cdca56-2e41-4e37-9426-0bf9ee45f120", "comment": "Malware payload", "value": "f3c80cbdd6e161254de2ba09ba2aab0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624907945, "uuid": "599745b5-fea9-4af7-9879-c4ca9029a14b", "comment": "Malware payload", "value": "3612932b02e0e97ec1ddac955833b9e572ca1c2d93fdc12c47e4ac6021459bc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624907945, "uuid": "bea077a2-5b46-4441-aca1-b24531eb1e67", "comment": "Malware payload", "value": "d331612a2ca4f969836c1f7096a0f495b8f3fe66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624907945, "uuid": "8a1ba19f-7208-41b9-b055-83dd1828466d", "comment": "Malware payload", "value": "040cb8b3c9ff205e3f10d70ff5df04bb8a98cf326ebd0d1103eabf07f3df03b4f66182a2615f8bef9b7760c79357f7d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624907945, "uuid": "fa70e9d4-5f47-4412-81a7-8800eecfa9e5", "value": "7E359D8DFB88BF9AD06D2F36C02702AC82EDC5177377F7AF19C569E155126064A1F08A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624907945, "uuid": "bfd27bd2-9ff7-4536-aa1d-c9390d97ba54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624907945, "uuid": "1b6ec48c-7deb-4540-ba8d-6735d8ce6034", "value": "12288:wzIG9sqBmjAdJtNC9pi71em0vKFGNGZR1XIQ9wieqsd6TvLLdmjsoFmMRS+:4IG9sqBmja8uhJFMwZbYk2qskTLoVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624907945, "uuid": "1dde03c3-e22e-4ea0-869a-e5229c783d87", "value": 1132032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624907945, "uuid": "d52f9ca3-88f4-458f-bde4-f5b8e1db81c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624907945, "uuid": "22b5b976-f675-48e4-afce-3cef6f02e823", "value": "3287392929847.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b50c59-d7e6-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624867034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867034, "uuid": "040dae6e-2c27-4304-b3e1-406d6755567d", "comment": "Malware payload (Gafgyt)", "value": "8108a19a3d7ddf044e7f3903f9f239ce", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867034, "uuid": "6dcdc6f7-3f65-4bb5-b492-b15afd22cca1", "comment": "Malware payload (Gafgyt)", "value": "37d6cd4ada3c5cf3eba5e9e8282d7619079fd22f74007ce12d608fa09eb850f2", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867034, "uuid": "f06699ea-b03d-4853-b7db-be9c20cc5476", "comment": "Malware payload (Gafgyt)", "value": "c1be29e9d1c2c09ad29606f91f33eed198f11eec", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867034, "uuid": "10e51ec6-2d77-4e83-b654-e077f80c4a06", "comment": "Malware payload (Gafgyt)", "value": "fc533475e51bb0c4da0b144f08cfd75f1b1c6031affacdbe119fea0de41c4eb5b983ec35256499a3f8684c2e90d81d39", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867034, "uuid": "6579d5d4-138e-418c-ac7c-b2593da8bbbe", "value": "8BB36C1BA292C6FAC04756B527DFA2A19423F43A0B33720B73D4BDA53F158C99E6D740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867034, "uuid": "15112393-46a9-4029-bfaf-bf0553c0873c", "value": "3072:LA2nwR507mxFoJMWJ9aqv4rphawmu9qcR+uOXanuuWBR:60yMMWPDophatrcR+uOXanuuWBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624867034, "uuid": "d2ea6b4f-903a-4a2e-9ca7-9bc39efb894d", "value": 111793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624867034, "uuid": "ccb1c829-9947-464c-97cb-d7cce637b08e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867034, "uuid": "86428787-5cd4-461d-ad31-f2c13cd9c7ad", "value": "8108a19a3d7ddf044e7f3903f9f239ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83842f08-d80b-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624882952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882952, "uuid": "3216e6e4-51d2-49e3-9b94-9af971940bac", "comment": "Malware payload (Loki)", "value": "38811f89fdfca60be471e776e73ad1a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882952, "uuid": "08e7f604-f2a0-490d-b38e-8e9206c0dd80", "comment": "Malware payload (Loki)", "value": "39b95a1927b9cc2435642fc76dbeb4e7fae9a858ce4cc2664490de6f74662fbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882952, "uuid": "1b981f71-06c9-4e61-b6c4-f7f7fdc1e3ad", "comment": "Malware payload (Loki)", "value": "2eb636e06dffa095af94a94f94530b8a75e0cd95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882952, "uuid": "84403311-2c20-45a1-9ace-20d3a3d82e6a", "comment": "Malware payload (Loki)", "value": "940d564a3c6a3a1c15fa41693213195771c9d8c3cf0d5a0603d1b612c28d6b4ecfc9bddc07c5536dab6b9727c53d4505", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882952, "uuid": "a2d472e5-0fc4-4431-af13-b28a581c9e5f", "value": "95748C00B761C035EAF312F44A7A93A9A53D7EE19B2451CB62D92FEE46346E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882952, "uuid": "305fbb14-be91-45dc-9ce4-8665fb1c8f94", "value": "a6f146a143ca57a8d8acf4fb9d34381c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882952, "uuid": "d06cd6e0-a684-4cdf-a62b-9f6af0d96039", "value": "6144:Gcdmj1Gx2/4Mtc03dYdqvoJ6AlwpPGq7jCLuzK/rQPg6UO4M:Gt1GcwMS03dY4oJ6AlSjeLGKzXjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624882952, "uuid": "1d6df0fb-13d8-4d33-9aae-bcaa716c6b9b", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624882952, "uuid": "26c37927-91bf-4bae-a151-52870d69b43d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882952, "uuid": "99737174-b0c9-4448-a777-9f28e0194a94", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72687edc-d7c2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624851570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624851570, "uuid": "9f4d1d3f-a9fe-40c7-8f9b-2efbe96e3484", "comment": "Malware payload (Mirai)", "value": "8e69bed6536984c8978f22d37fdb55df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624851570, "uuid": "5b65881f-f6f8-499e-8e19-2bfb4f03d9c7", "comment": "Malware payload (Mirai)", "value": "39e50b7ef5aa5c64d479ae4bf602ce1e3a7719b70c9b3a5f261872394f7f76ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624851570, "uuid": "cc138a2c-8e45-4b02-8510-091fef6e39e7", "comment": "Malware payload (Mirai)", "value": "44151e39be47cd93642a166caad0606e5a55dc8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624851570, "uuid": "ee4149fc-e885-48b2-9495-3a1d15c4aa68", "comment": "Malware payload (Mirai)", "value": "7ce4a8de195d665332b09799ef186566e30108f3915aae509418c5a09ba4ae763c0bae83ff9611c18fd5aea78f82cc04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624851570, "uuid": "c533f294-4980-4b9f-a1f8-99a857a753d9", "value": "A9E24CA97D808A16C5D1617BFA2E428D37151398E2DF3303DE136FA1768BC1F0E6BA45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624851570, "uuid": "1cce0e29-3716-40ff-a0de-9bb85916b555", "value": "768:3/R3fCMITZzgGidGP1GDyPMx62KX+Y6xlSHWtWSza5YP1:FfCR6GidIs+n2anSz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624851570, "uuid": "c76aed95-4f3b-4f70-b37f-24081c11f662", "value": 33940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624851570, "uuid": "34850ddd-d3db-4530-8583-b4a321fdb099", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624851570, "uuid": "f8129570-dcaa-4bbb-9e70-26f2ce87a807", "value": "8e69bed6536984c8978f22d37fdb55df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79f024e-d800-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624878369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878369, "uuid": "d6fe1d54-37e8-4b1b-ac55-c24e52aec12f", "comment": "Malware payload", "value": "68894750604cfe113ce871a2309173af", "object_relation": "md5", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878369, "uuid": "9f3e11e8-2c4f-45b1-b8d7-f67187b71650", "comment": "Malware payload", "value": "3b18bdb055c2a5795ebb6e800fe747c9d194430cb4f503abbaa016705975936a", "object_relation": "sha256", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878369, "uuid": "4b668155-8b41-4008-8ef7-a483b26b03af", "comment": "Malware payload", "value": "2606d63470f52d9fb7f8e1eac85a0bc2911a6dc6", "object_relation": "sha1", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878369, "uuid": "88c025f0-63a9-47f0-ab2c-250db943bbb8", "comment": "Malware payload", "value": "5a43f3195e64cc0e5e2227bebb75c8ed25246ad01c8cca14d4db24a0a8354e15e3de48544a632e3c60aa9826297a58d3", "object_relation": "sha3-384", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878369, "uuid": "a502c6eb-a3a3-429a-a7b1-20b9a12dbdb0", "value": "98817EB71AFCD87458B5B8B205A43E312023E8644D6353EECBC738D646474C966EF689", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878369, "uuid": "3a764c58-85c1-4e78-bc98-9422de119f87", "value": "96:TqkXf7uAZ4rWOPj+jAW0n26bmRPKirO0ob1w7bxsgdbK3u:Tjf7uBPE0n/bmxXrORb1waaK3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624878369, "uuid": "5700370e-38b1-4382-b84a-4c160bd9b0ea", "value": 4158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624878369, "uuid": "7a92e8ee-098b-44cc-a8b6-0186294b437a", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878369, "uuid": "925ad2a2-5bf2-403e-a463-f5c2d34a08a7", "value": "3b18bdb055c2a5795ebb6e800fe747c9d194430cb4f503abbaa016705975936a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be573729-d800-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624878326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878326, "uuid": "f12b6f68-6ab6-40b6-ab77-2b95f69f9e04", "comment": "Malware payload", "value": "f42542edd0ab744e728e8386bd990a27", "object_relation": "md5", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878326, "uuid": "9c5a8bc9-85e2-4826-98f7-e0c81310b795", "comment": "Malware payload", "value": "3bab2947305c00df66cb4d6aaef006f10aca348c17aa2fd28e53363a08b7ec68", "object_relation": "sha256", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878326, "uuid": "605fc830-9e51-4c3b-a112-20fc48da3c54", "comment": "Malware payload", "value": "ae06fe75f220927175caa58475a743d40ca6f592", "object_relation": "sha1", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878326, "uuid": "ef35b9df-a3f7-4c71-b1d2-8fdebdc348e1", "comment": "Malware payload", "value": "7c263ed389cc1e83a3a5e7449c73a4941e89d9e9117033245f5e9142f758127e37c6791486615faecd18dc4a041b9fec", "object_relation": "sha3-384", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878326, "uuid": "24168825-8339-4b1c-b815-004d8718835d", "value": "E981A8E833D0E6F6255E873ED5614115583ED0D2D7782D1CA7FEEAA2202DC26703F514", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878326, "uuid": "bdaa0c10-8d11-481f-83dd-46aa4f203a54", "value": "96:pA1VjJUMBx2pLNYj89c+/Px2pLz31kh5i1/hdHJ:pATJ7Bx2pL289c+3x2pLz3OhgZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624878326, "uuid": "8f8e5c41-902b-4b80-9ee8-c1ae7898419b", "value": 4134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624878326, "uuid": "ebfeea51-0137-4bbf-a94a-a9e67df103c3", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878326, "uuid": "eb03bdba-7901-4ba5-b9ab-d676c12964a5", "value": "3bab2947305c00df66cb4d6aaef006f10aca348c17aa2fd28e53363a08b7ec68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31dad59e-d7d6-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624860052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624860052, "uuid": "578f8546-2555-4b38-9e7d-d311358c3a21", "comment": "Malware payload (Loki)", "value": "7408d83911eaa6cad502921c66c62aff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624860052, "uuid": "608a92b3-1157-4613-b30b-68cf51281481", "comment": "Malware payload (Loki)", "value": "3c0a74c8ff38f03caebb172d488e84dbb8fe05b45393f8f35c7c356956a210c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624860052, "uuid": "2e5e42d2-7f11-4824-9d21-c0c663f1ccb2", "comment": "Malware payload (Loki)", "value": "17759ca6db62d0a585b2c905d6ad47519e96079c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624860052, "uuid": "a7f55c9f-169f-4906-9d80-672cb95656b6", "comment": "Malware payload (Loki)", "value": "a69db80949a8dc710e6591ce8b70001d8d17a49a5b96ac1c06318d61e0f74310ca31a0c82eda9c2d8bb50d1bcbd4951a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624860052, "uuid": "1c947b21-f4ab-4e48-bbcd-17deba8f3f25", "value": "E315BE242EE95126E5B65F7C89B0644156BDFE222F17C83D28B532C91733A43CAF127E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624860052, "uuid": "ddd4cc33-03f0-4c19-afc2-a44c84caffa3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624860052, "uuid": "ca89e3d1-e1a4-4572-bf75-90bc195bbc83", "value": "12288:HJnkvwuo3wb+FoZFuF8FmmTYprQAFTDT/KkAkjFCMFE4M4GeLIaWlkxnP5:HSDKMAF62DLPIMmV4FNxnP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624860052, "uuid": "f06d993f-6ac7-4714-a770-1e86d1d03330", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624860052, "uuid": "23350ae2-e68c-4bfc-a462-12b62ba9440b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624860052, "uuid": "674913d3-574e-43eb-85cb-d1b7e3ee9968", "value": "PURCHASE ORDERpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2a4cf2-d803-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624879373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879373, "uuid": "17c5577e-a5c1-4a36-aeaa-be0290fa681b", "comment": "Malware payload (AgentTesla)", "value": "387a538b470dbcb7cc01f855b2191b71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879373, "uuid": "2233af0e-4116-4272-849f-7d91a65f369e", "comment": "Malware payload (AgentTesla)", "value": "3c2b467cc8527d2e5a057bbac803bf3820838fb1eba1c8f961a7c20f971e1ad9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879373, "uuid": "b205f4a6-43bc-4204-9cba-9e6a9eee2706", "comment": "Malware payload (AgentTesla)", "value": "0af386f23b23366f1f791758781f68de6a242754", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879373, "uuid": "64d6ef53-0782-4aae-b644-f2c9d3b676cc", "comment": "Malware payload (AgentTesla)", "value": "468ab444573ad90bcdd92ad1112f8175ab495a7bc91132a4770a6fb42941878e62d1b0eb309d23dc33d5b2118ce0e717", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879373, "uuid": "feb11a5b-d82b-40bd-b951-ceb48635faef", "value": "AA71B8385A3C0402DE9216F284B9FD7544F7F14546CE56C2B21EEDB20BAF3417924646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879373, "uuid": "ae24e62e-9126-4154-b177-a5c8ce2b44eb", "value": "96:O9eSdYhf0tycqjMU4Fr/w9+YywIGb2wiXeA6As:eq90IcO/Gbw/As", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624879373, "uuid": "3686e9cc-dd08-47cf-87b9-9c77692af70f", "value": 3780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624879373, "uuid": "9f078aac-ad75-481a-b32e-6dd4f19ba303", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879373, "uuid": "292e70f4-4ec6-4cad-bdc8-3c749fb5c36b", "value": "Quotation 270621.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac7b3c0-d844-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624907365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624907365, "uuid": "222b09d8-d468-44d9-b97c-7da637467875", "comment": "Malware payload", "value": "355c1de5b86201f9917ff3e583dce2b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624907365, "uuid": "425b057c-0399-4e53-bad3-245c766852fe", "comment": "Malware payload", "value": "3c30a2075d7ca9b825d81167b79d45ce27a1bf07a0052412359afcdc73fdf51c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624907365, "uuid": "3f080e6c-b422-4ecc-9547-8d5889063e8a", "comment": "Malware payload", "value": "b1657e023259ec9369f92978025f589069eee354", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624907365, "uuid": "a6883320-cb7a-456f-94f1-3f2e25c23b4b", "comment": "Malware payload", "value": "62683744530e783090fb4ff3824fb5ac957230dc903e314bdc3cc38858bcba1489dba11794ed3aa2a8bfcfea6edbea0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624907365, "uuid": "be5bf6e1-eecc-4292-adad-bc8f97ace7da", "value": "2A837C13F1E4D073E0235131A966B773486FBA3399390247F789467E6EE41E09E297A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624907365, "uuid": "7e95668f-47db-4cb8-a758-e11714bdc45c", "value": "4d4d03b1080112a8681ab2abc89c0a04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624907365, "uuid": "cf1f0b98-bfcc-4cc4-b046-bd386c8beeb2", "value": "1536:eEr/bfw/P7j9LgSbtEJrm2jk0U88plm8mYYgilU58b:eE/fkJLgSY62qtplbrY5Oub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624907365, "uuid": "0d0dc25c-0abc-49ee-a21c-c9de5effd060", "value": 88576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624907365, "uuid": "4f4bbedc-083a-4e4c-acbf-3b725e0936c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624907365, "uuid": "6a00574a-3da4-4f5d-aaa8-3e9beaed3492", "value": "Textpadx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b39f3dd-d864-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624921110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624921110, "uuid": "234d3d7a-faf4-494b-96e4-078649a7eca9", "comment": "Malware payload", "value": "96a157e4c0bef22e0cea1299f88d4745", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624921110, "uuid": "70a61aad-cd30-493c-8e81-66a63d8bcb2f", "comment": "Malware payload", "value": "3d375d0ead2b63168de86ca2649360d9dcff75b3e0ffa2cf1e50816ec92b3b7d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624921110, "uuid": "c9e72a1e-102e-4407-9f86-cb50f18d7f1a", "comment": "Malware payload", "value": "446771415864f4916df33aad1aa7e42fa104adee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624921110, "uuid": "39ce64e3-18d2-4921-a51a-0edebfa8db3f", "comment": "Malware payload", "value": "2e4bfffc0e98be68cc77960b52f8f107acde114f4225cfc338bc7d1f5eee2fe4bc17573b5c1b87edb14c18c1aa4848bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624921110, "uuid": "b756592d-ee41-4a7c-b54e-f3898e686664", "value": "A3A34AF7E274A1ECC675B23A29CFA8FBE06074B415F6640E6BC52D4D23148890DA753B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624921110, "uuid": "3c346ad4-ffcd-4ff1-b453-d37f25c89421", "value": "3072:Gb+XoBHJ3RYjgggwgggwgggwgggwgggZQuYoL/:GDaoL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624921110, "uuid": "2a5ab51a-fab9-4260-babf-7d064c934f10", "value": 105232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624921110, "uuid": "1be01468-2b59-48d0-8563-72ed901fccf7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624921110, "uuid": "bf9288cf-93a6-45ea-a057-dd6bd5400846", "value": "3d375d0ead2b63168de86ca2649360d9dcff75b3e0ffa2cf1e50816ec92b3b7d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b41c69a9-d838-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624902361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624902361, "uuid": "65fe479b-c027-468a-a4bd-4d1011ebad1b", "comment": "Malware payload (Mirai)", "value": "b9f30c1a3acf3e682df45fc8649a4661", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624902361, "uuid": "7b65ece0-fa30-4b4d-a97a-2a6895300cb0", "comment": "Malware payload (Mirai)", "value": "3d39cc2cd3409b4cb0bb3815afcac950517a80e457bab7a7e0f1c0ae9123f82b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624902361, "uuid": "7e5902c2-f124-42c5-afac-c6e55752e181", "comment": "Malware payload (Mirai)", "value": "9fe5b2ad401a991c9a32cd0531b9f34cf2d1c04b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624902361, "uuid": "a9972488-cd95-4a1e-b2d5-5374522a3bc2", "comment": "Malware payload (Mirai)", "value": "e1b141d4b6df68b49761aa19c0ba8101483f3f3a1814a96a1d41fd15575ad491d64200898826dbd981e4ccc3f86b7489", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624902361, "uuid": "62f2896c-061d-4552-98e9-86a2c804680e", "value": "9623024320D3BA03E03058FA85628CCDB55996BDB1BF77A725480E254C75D92ECB19ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624902361, "uuid": "3ab6379c-e680-484e-9cfc-d7d7bb317696", "value": "768:nK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFuG9q3UELWt/iw+kvBGg6+fYtrBHg:P12O1LCNguovDPH7TcreLWhiw+kvBGg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624902361, "uuid": "94a32dc5-770a-46fb-831d-e51ebf8f9afc", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624902361, "uuid": "00ba9546-5447-4b31-8a94-0b7b479a509e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624902361, "uuid": "bca4711a-2ec4-4290-96b1-86779421f1da", "value": "b9f30c1a3acf3e682df45fc8649a4661", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627c1442-d7b8-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624847249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624847249, "uuid": "7d71f851-2603-4409-9b24-3e0e72d09842", "comment": "Malware payload (Mirai)", "value": "d276d52b1b418e102597bbd0d509c65c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624847249, "uuid": "50074c4d-e455-4d90-b6d7-5cc2d14cf512", "comment": "Malware payload (Mirai)", "value": "3dec77eaa1904b8d933c559f079d92f61f700b2f5039471ebdbd4d1900f3a698", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624847249, "uuid": "ebc0e556-f1e6-4f5d-8926-d24aa31843f9", "comment": "Malware payload (Mirai)", "value": "9a79bff7c2674ff8eba49716e5c7a8f86ad476d0", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624847249, "uuid": "17a258bf-4f26-42a2-a84f-5ea68a36b23e", "comment": "Malware payload (Mirai)", "value": "eb96a21d25f5fc60a0dac8f784a138e3a7c6f6e748ad6274bd181af452687cc75cb7ee14655795aff5195d1fb0378dc3", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624847249, "uuid": "d5665101-21e9-48c6-af20-e64c65ccfc5c", "value": "E1530747B48280FDC199C13043ABA976C83379FD1B39F39627D4EE3A2C56E221E59D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624847249, "uuid": "f87589c2-eeb4-410e-aee7-6bde09579cbf", "value": "1536:oIp6kWMYerGKA7mX/KomkBVjm2vfpRyw4RkSnJlugZ:Vp6kWOrbA7oSomkBVP5RywEkSXugZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624847249, "uuid": "5d1f34b0-c83a-4561-906d-1f0eccbace8d", "value": 62720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624847249, "uuid": "d7dbbe0b-5f8b-4dcd-91b0-1635a159d189", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624847249, "uuid": "3ac16369-d48d-4b6f-ae35-4ee9cd04234a", "value": "d276d52b1b418e102597bbd0d509c65c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0942653e-d803-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624879311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879311, "uuid": "6314f57c-ba57-4264-a590-56cc8c06e1a2", "comment": "Malware payload", "value": "ea52f801686a170a89215079af05f5b1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879311, "uuid": "a949572c-0ab5-4c55-bd41-30b7030341d2", "comment": "Malware payload", "value": "3deffa72c5291ad88f48677d219146a1d026c28de7b75d16aaaff141ae4c8b80", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879311, "uuid": "85a8b7c2-9b05-47c6-9981-583895848570", "comment": "Malware payload", "value": "a9c22057397f8cddffd718d3ee8ebc650750e0a0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879311, "uuid": "60c2c625-9413-438f-9dfa-1dbe0a5d1e6b", "comment": "Malware payload", "value": "7447c1e40422f7ec5f9508d58a4b66d7ae2a703f495a8b96f8d9bafdbc0fb8dbf21f44edcaae735282292b6bf1c4576a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879311, "uuid": "91f479b5-3afb-4047-b8f4-a16946a9cb80", "value": "0A710AA0A2AD9B67EE1351E58C7AB84881EAB54141D34D8CB2CDFEE4073633C5B5D247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879311, "uuid": "0d86afde-df2f-4bdb-8714-4ac1d61bb4b1", "value": "96:0Q9/YcN+FStwfcOy/Hyq99688Vz+5iU+bXqowBxogd:06Ac3O1y/9QPCwtqBBpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624879311, "uuid": "0c2d7871-b93f-4044-b3d2-7d3c73372690", "value": 3619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624879311, "uuid": "767ffec8-7c4e-4563-825f-80b4b2ddd9dd", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879311, "uuid": "020e2ff8-d1ff-4e4b-82e0-814509e9ab30", "value": "PURCHASE ORDER 387746.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb86a60-d7b6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624846514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846514, "uuid": "4d48d766-6066-4262-9b72-ccb4ac7d75b8", "comment": "Malware payload (Mirai)", "value": "8f1fd444ec031cb75140b39f563b6adc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846514, "uuid": "a98cd98c-ef6a-4869-8662-e8885b097478", "comment": "Malware payload (Mirai)", "value": "3f42ead64458852428fc4766603a4149e330e04327b6f7033b5d4de4b5d94853", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846514, "uuid": "ba425299-f475-4b47-81a3-412607c8239b", "comment": "Malware payload (Mirai)", "value": "39ea88636e1fa7e1c0f89fef2b622860bb361ea1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846514, "uuid": "e37658d1-e66b-44f6-8054-68708e7bcc81", "comment": "Malware payload (Mirai)", "value": "7bd3c003fc5a097f29d6bf01473bce30a33c025134d156bea6ef023fd1c2b1910396fe5f3d7f1e8d5cf22c26c40b3333", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846514, "uuid": "73749632-3647-4bdd-8c71-2c6cb5fa7229", "value": "E4530682BC51A629C7C04777EE6F509E3311ABDDD0EA3742DC150BA47A8AD0F0D67B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846514, "uuid": "93481c22-2583-4137-b66e-ad94f278106c", "value": "768:ms1qupSX4ltGcabf860GnT7u2xrtWRDFslso1Zcy0uiDz701T1fj7NSqtUut65aT:VqUSXGmfiGn/xxrKClXcB8t464qPto+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624846514, "uuid": "02ef2ee6-c429-4ee3-abf6-e22b29d95de5", "value": 61192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624846514, "uuid": "179e6b0e-7d73-4ac6-867a-ebcea23ba02c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846514, "uuid": "773fb476-a68a-415c-adc2-01a67d258e86", "value": "8f1fd444ec031cb75140b39f563b6adc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68f620f-d84d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624911358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624911358, "uuid": "fe4b4de8-2761-4496-abd8-b488702e06d0", "comment": "Malware payload", "value": "5956d73ec9d8a9a2848300774c17a769", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624911358, "uuid": "b7908e6d-68e7-49c4-b23d-205c18ace020", "comment": "Malware payload", "value": "4037a15e35dc2af8be2f02e92966f3777428ff5324f43b6e42af1da3928b90dd", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624911358, "uuid": "069516c8-0441-4ba5-9cdc-f7b90229c8ce", "comment": "Malware payload", "value": "72b11c633dcdd107829771cc96aa7e8701e74f3a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624911358, "uuid": "b3b0d23a-9f9a-4ae8-97f6-4fbcf484c880", "comment": "Malware payload", "value": "bc7d5f4fa748638334a22a72b192cafa7dd1a3fd1632e974128729dd35f9439e7cd976278f53f02d0c58f8d74389d710", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624911358, "uuid": "353f0f96-99fd-49d4-8d35-8610cb8f27c3", "value": "CC35334B7A20C195F49B123654AB5989677CFD0019D1C8171ACAB0AC33F2ADDF1AE6FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624911358, "uuid": "794fa710-7b78-4325-940e-4bfc4154b753", "value": "24576:1RyITqgYbHQUeDdHQhU+FRFAQPOXuPUn6dKQ559Vg:PHTqg4jeDZiU+FzEXuFR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624911358, "uuid": "1902b471-8b6d-4808-a173-c64da193353f", "value": 1101824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624911358, "uuid": "5063fd25-dab4-42f3-b3ce-6887931d0818", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624911358, "uuid": "f806655c-646f-41f2-921e-065b2a01834d", "value": "MinecraftForge-1.17_95927.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5ff331-d800-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624878374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878374, "uuid": "87c85781-0e3b-4756-ba8f-5b20f5dc4ed9", "comment": "Malware payload", "value": "f4329da283a6945c215813a3d1cc3ee5", "object_relation": "md5", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878374, "uuid": "89228411-dd9b-458a-8433-57ab6ba2a679", "comment": "Malware payload", "value": "4175673566118b76ba2c40af6e724a84a5d632dc7564f51273f562a17556802a", "object_relation": "sha256", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878374, "uuid": "55bc907d-822f-4c1f-b47c-313ea730d6f2", "comment": "Malware payload", "value": "d2ed168e085854eef423df2724bce61df96a53ad", "object_relation": "sha1", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878374, "uuid": "252d73a4-5037-4bcd-9a78-60a92124ed5e", "comment": "Malware payload", "value": "497a5ea12032003c0e55638e324709af55d2576c92bf324a38bcf106e57a4ea33b96bdffb0127490ada5565ee898991b", "object_relation": "sha3-384", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878374, "uuid": "36fac6b5-a0a9-4fb7-8c2f-d6d7d9e440cc", "value": "0522B0A34C84ED63111574627F9E952B8A47A9EC1952F21FBE080CD17EA8F015C3CC5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878374, "uuid": "78c3745d-7422-4ab7-b4d2-ab60ab08f7b6", "value": "192:XdUlnKLcxM7/02jo7QfM74Gl4wvTa7IkYHFzPMx3HThQFbhLXc6Rq:Xy2c642sEmCCmEFzPOX0bN9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624878374, "uuid": "7518d57f-e677-4c01-801a-ef6e6bd15051", "value": 10556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624878374, "uuid": "05438080-2e59-4461-b677-1a796723460e", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878374, "uuid": "55e9044c-6a97-4390-9032-7b58cf24dc1b", "value": "4175673566118b76ba2c40af6e724a84a5d632dc7564f51273f562a17556802a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5cab34a-d7f3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624872809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624872809, "uuid": "dedf260b-4d92-439a-a4e6-0683227b3b32", "comment": "Malware payload", "value": "bce2f5ba2ab61b11698d9b24e80990af", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624872809, "uuid": "38269c95-b4cf-4c77-99e3-913888dcecab", "comment": "Malware payload", "value": "4347930ebc98dfd11b612dd288b68f23b67d3fcb4afd5e3963e55283f951ba0e", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624872809, "uuid": "588aca60-f22e-467e-a7fa-f4291b4fb8b9", "comment": "Malware payload", "value": "fc42fb9485b4bb3063a52a905ffff95d6897968a", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624872809, "uuid": "23fdd15b-ff80-42fa-a3c7-c985fc79d663", "comment": "Malware payload", "value": "1ed5bcae00664145fdf8867647ea70d8b507b296b647d8c284c75da52e115d4e13b1117e27b9bdaf63cd97ee1059dcdf", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624872809, "uuid": "90c704c8-f23b-4e2d-b1fd-7c2016204901", "value": "0042B01A6DD87432CF71427E47EE4C426DB94B1CF5F47BA73040F6A84695BB3822159C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624872809, "uuid": "6b3af8ff-c80a-4754-bc39-363854cdf49b", "value": "192:ZMAus996yVJr9fvFZwwLpi21uL8WfBVIgSbDvtbmqSkJU1eyA7rEQ+MsAL:MK9RJZYwLpi24bBKgSoq5JUw/Ai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624872809, "uuid": "e9c788cf-8b71-464d-b744-19dce72a7e76", "value": 12506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624872809, "uuid": "ddee8173-ed8e-498d-9eca-1c08e8915fb4", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624872809, "uuid": "57c21b89-e4f0-41c3-857c-07d0087fdfe9", "value": "Lista de funcionarios.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8bae258-d802-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624879230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879230, "uuid": "99e18f1c-9fd8-4f18-b02f-d1c7a6e5b425", "comment": "Malware payload", "value": "842083fe8ec2319d2beb5d6f35871c6d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879230, "uuid": "e6e2c354-3690-44e3-9b81-912b360f2978", "comment": "Malware payload", "value": "43d639bdeed2601a7415d1098c74db512fc894fbb629c5e8eae9150c84b1b44a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879230, "uuid": "cd379ddf-a103-44b2-ad73-96acbd86b4bb", "comment": "Malware payload", "value": "fc0865ecddd9890983240ecb01bc4a6f0e5e02a7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879230, "uuid": "c5c4a354-fede-425e-8f6b-4ba25133024c", "comment": "Malware payload", "value": "f934c9f643700ced33f22c9451b35b265033b801b0bad52b69e3b96b0599fec4f00607d2cbfb569c289f0732d8c129c3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879230, "uuid": "4986aef7-f686-4c37-817a-bfea49642cda", "value": "088129B4A4F96C90DF0B0C7B583CFD6A42E572E649C298D6760EEF5107AB325B208C20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879230, "uuid": "5c30c38e-7f3c-4fed-9869-510ac5a60450", "value": "96:HF08LJKi2UyMnQlGdkaVZfIeZvi/1sjK6r:HF0+Ki2REs8LXfIiiejKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624879230, "uuid": "4ffb76a2-fcaf-4ffa-812b-1c323771444f", "value": 4123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624879230, "uuid": "fcf9a575-5e8d-4275-908d-23bb42e34ec1", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879230, "uuid": "2d063308-ebfa-4d04-800c-b275bf8d9c89", "value": "Purchase Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe633378-d7f3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624872850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624872850, "uuid": "c7294f2f-42de-44a1-bb25-46059497a3a5", "comment": "Malware payload (Formbook)", "value": "c428f38a84f17399a88559e3fc68fff5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624872850, "uuid": "0c631ecd-b977-48d8-b882-8b3806476e51", "comment": "Malware payload (Formbook)", "value": "44f060eefb28b1d90759eb517c0e134e52164a2701e4f4d9ddbbbd27f48cce2c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624872850, "uuid": "664a2e89-7edb-44ab-843a-b4440857474f", "comment": "Malware payload (Formbook)", "value": "c7e83930cce6e7e672d5e844b8148a024a1e901a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624872850, "uuid": "4e64593c-bec6-4f85-a33a-22b8719a4368", "comment": "Malware payload (Formbook)", "value": "95f03556e0987f969cee6efd6506a96e0738ab72eaf7fc479253659e8dde5b929512e162c9d183403af5521316888b58", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624872850, "uuid": "8873bd0b-0dee-43cb-8629-7e06ade611f2", "value": "34859ADB38255182C38BDAF09D5BB1C8922EF4F14CC465448816CBFA2C66AD7D70FD9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624872850, "uuid": "042db28c-acac-4153-8296-83469f44b6dd", "value": "1536:XTrSsiVJWZQIQgQdQRQXQqQgQZQbQJQtQ9QXQpQ9QEQiQHQQQZQbQJQtQ9QXQpQC:XH3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624872850, "uuid": "eb67c2ba-d5d2-44f4-9a43-b77dee5b80c4", "value": 1792354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624872850, "uuid": "95b6f0a3-76f6-45ed-8884-e5fba1e9aa58", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624872850, "uuid": "31849a7a-90bf-4b4c-bcfc-958edbdd0502", "value": "PO 33015.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f43680c-d7b6-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624846465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846465, "uuid": "5c37771a-55e2-48de-bd4e-75393b747108", "comment": "Malware payload (Gafgyt)", "value": "3cc6879e199bd3be414e280fe2e770f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846465, "uuid": "abd45f3d-1666-4d4a-a12b-53bdbf04317e", "comment": "Malware payload (Gafgyt)", "value": "4523b2d2ffe8ee4e1847427b0b91afb4d259f0fd7dcc80c25cd7ab8478aed3b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846465, "uuid": "0dfdab26-9cdc-4a77-91f9-305203322167", "comment": "Malware payload (Gafgyt)", "value": "f8f83e622682d5c4e9c93dfe8f06c42040e423b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846465, "uuid": "43212ec3-801e-4402-8e5b-03ab8b907987", "comment": "Malware payload (Gafgyt)", "value": "07c6cbf21808758a8d7ff8d7dc003e30180ccb0bae0058a13d8bb89ee51c5504c5f142881d63abca2714170d1da8c09c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846465, "uuid": "ecb1c221-9466-45e9-b80e-3ff2537b530d", "value": "9EE38536B7619E77D81ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846465, "uuid": "fe0b3feb-5327-4a26-bbdd-21228d903dfa", "value": "3072:dgZc9h1jlnLA2PiXYeyCcvVNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZvVWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624846465, "uuid": "2672697d-e1e9-4be0-9af0-834f4404ef44", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624846465, "uuid": "679e6792-55ce-4f9a-8281-14cb60ab6e15", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846465, "uuid": "1c6ec30d-2f3c-4bbd-9b77-690eaf9ab8d5", "value": "3cc6879e199bd3be414e280fe2e770f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37deaad-d7b6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624846499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846499, "uuid": "dbd3cd7d-043b-4461-a404-691eaa409220", "comment": "Malware payload (Mirai)", "value": "521b3cdb1f8c55693df1291aab624ce0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846499, "uuid": "678b77ef-278f-450f-9bfe-c2256c874ad5", "comment": "Malware payload (Mirai)", "value": "4572b814d6cdb5785fd1229f6017d3b071036dba04e24c1a9a790deeeac3bc3e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846499, "uuid": "cf266d1a-c45e-44db-892c-ac5a8e845958", "comment": "Malware payload (Mirai)", "value": "606e2014a33c5dbee85b7723808b1c883c07884b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846499, "uuid": "9fbf70f9-5532-4994-9ff8-93151be780a9", "comment": "Malware payload (Mirai)", "value": "64687f7191578af9beacfd4e9f4bf476872a417500f133a299a4cc78f9f466b564667d11fd702d4b70461429e1b95966", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846499, "uuid": "6da376f8-584a-4791-8737-fe3418e34919", "value": "5B93741AAFA05EF7E8AFDC3346A91B4524CE54162588BF75BD30D918F20A24F15E38B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846499, "uuid": "fedf3a31-29b6-442c-9bd3-d8150837694d", "value": "1536:GRWuNskH9ZBLPtSrRop6/wzOqCx5E8FjBwFudSZCLHSk:iWuNskH9fPtEap6HrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624846499, "uuid": "cd7fc99b-ee6d-4607-abd3-9e7ccda1f68b", "value": 92268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624846499, "uuid": "471196b3-9585-4829-87a8-e5cfe6d5f40a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846499, "uuid": "7977bb54-20a0-4469-b1ef-c4b8ad51d028", "value": "521b3cdb1f8c55693df1291aab624ce0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f643c9-d84b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624910635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624910635, "uuid": "81225005-deb7-4ff3-9790-3683441aeb13", "comment": "Malware payload", "value": "6f208841cfd819c29a7cbc0a202bd7a3", "object_relation": "md5", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624910635, "uuid": "2e0cbe25-ac6f-4851-9da1-f811cbd2dfa2", "comment": "Malware payload", "value": "45b6349ee9d53278f350b59d4a2a28890bbe9f9de6565453db4c085bb5875865", "object_relation": "sha256", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624910635, "uuid": "6ca4cf77-468f-447a-bae8-02b4d63de498", "comment": "Malware payload", "value": "0febc376cc066bb668f1a80b969ed112da8e871c", "object_relation": "sha1", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624910635, "uuid": "1ccfff5b-a079-42cf-9fb8-52ee16a824e1", "comment": "Malware payload", "value": "80cf4f4886bf0e8756653af3fa72228ea1aadf0ec88dc7de0ed83ab507d1235105eb012f76f054730c78ebfccf887f47", "object_relation": "sha3-384", "Tag": [ { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624910635, "uuid": "1ae1a895-9228-4ba9-b1ff-86c94bb50941", "value": "CD7422BF28EB08381A9E00E4124F8DB60E1BC778865947D7C3BFB645A7ADF50758E640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624910635, "uuid": "2bc4a3f4-debe-4ceb-811a-382be7848dee", "value": "6144:jbfc05b2SIlgWYc6tDaHdFanc1dbtpf6Kc2GXO8i6eW9p/avh:jjvb27eWYcMDa7vdZpThh9DkpiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624910635, "uuid": "70221837-2796-4b67-bbaf-694c78e3acbc", "value": 341002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624910635, "uuid": "239f9d9c-98c1-41e4-8907-001338714d23", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624910635, "uuid": "a9078a1a-ee52-4da3-b10f-53f749a70081", "value": "45b6349ee9d53278f350b59d4a2a28890bbe9f9de6565453db4c085bb5875865.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af4eff3-d81f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624891447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624891447, "uuid": "3caaf7aa-081e-4678-ac20-ae020a489f8f", "comment": "Malware payload", "value": "852fc1c4554b3393775dfbb6f56a2980", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624891447, "uuid": "d8adaedb-a998-4c0a-b7f9-7940f358eb80", "comment": "Malware payload", "value": "460f38c34487074b98cc67ad7d9a6f53419010190da5430d82eeae74afa953e0", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624891447, "uuid": "ab7dd479-cb97-428d-aa7a-d783f3eff301", "comment": "Malware payload", "value": "fe445ea3fa1c238a116af46e920d63accbfd79cc", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624891447, "uuid": "59efda67-8e50-46ad-8684-c67be4d76a82", "comment": "Malware payload", "value": "000fea10aa5eafec9cab7ac4f50f8a19d4b8a8641ff804c95957ef59e3a36176b1bd375ed232dba2aefcf6eb97e9ee3a", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624891447, "uuid": "8bfa4da7-e835-4e41-a12d-366bb9e18fb5", "value": "5EE31294864C2D2DFBDC8204CB78F89E94A13F2DBEC9E05CC2251D95F79E1563E90E29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624891447, "uuid": "18a7c42e-942f-464c-8cdd-83cdb38ce8c0", "value": "3072:egv+dH9wTn3dMLA0TOJuNNcwOEWaCvUSbDeLVJ19NiGQcg/rXa9:LuHSTnt0TOENNXLHC567ohc4a9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624891447, "uuid": "02c45be0-9a4e-473b-8b5b-5e37cdac692f", "value": 154813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624891447, "uuid": "b78b78e8-0e1a-43a9-808c-718aa4fef9bb", "value": "application/pdf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624891447, "uuid": "ab5ce63e-817f-4a4a-8d03-0586a833d4e1", "value": "460f38c34487074b98cc67ad7d9a6f53419010190da5430d82eeae74afa953e0.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aed56d8-d7b5-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624845840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845840, "uuid": "47fc5413-9747-4f33-b350-18522855b25a", "comment": "Malware payload (Gafgyt)", "value": "11942bb1e07cb895bc13d25dba099a89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845840, "uuid": "917dde6b-c19b-4ea4-94bf-057a71f5a5c3", "comment": "Malware payload (Gafgyt)", "value": "48f4d3fab68315cfe6a03a7590f4c6c05c5451fa69fe49af0af5dc07a78930ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845840, "uuid": "ecb094e4-e398-446b-86dc-782f79ae13c6", "comment": "Malware payload (Gafgyt)", "value": "e7e285bac5734cd6e7d51f6aba92c327f9295e6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845840, "uuid": "0b974c3a-2375-45df-a8cf-3760d82c1383", "comment": "Malware payload (Gafgyt)", "value": "606f74ac3e912f7fbda7b6242c0ebcf777d754e680f4a81fd3ba1642e5974d90f0832e12d68097b4ed36c32e6e25994a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845840, "uuid": "3f8a1574-fa9c-4411-9281-6722ca97b96e", "value": "C2C3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845840, "uuid": "1aa86f3f-61e4-4504-8037-02babd1718fd", "value": "3072:4jDy/+mh1vtbPIKanbpcUPium7/L7QsvmGfIiNb:mOJ1vxfanbywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624845840, "uuid": "c506a789-c5e6-417e-bc81-70e9b9bfb95b", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624845840, "uuid": "3808dfdd-55a3-47d5-96bc-70c43ef0ad77", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845840, "uuid": "99b11126-9d09-4239-b380-92d897ec299d", "value": "11942bb1e07cb895bc13d25dba099a89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3955e998-d7ea-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624868654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868654, "uuid": "fa73dab5-9e1f-4f15-a77e-c48fb05c601d", "comment": "Malware payload (Mirai)", "value": "bd6412d55528ae2b756c1581d195ef53", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868654, "uuid": "80067741-5b27-44ec-a964-c5213d517d5b", "comment": "Malware payload (Mirai)", "value": "4931e254426ea82c1abb03ac2bd2cd1b8b50ebd39ebff94a5ab046f92f356f04", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868654, "uuid": "c2f3d909-45d4-41b5-be00-6244a3a3e25f", "comment": "Malware payload (Mirai)", "value": "f5df528846ced574fad7ec12bafad0ff6af9bb9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868654, "uuid": "4503e174-24f3-452a-bc35-c9e9f5a797c9", "comment": "Malware payload (Mirai)", "value": "36adb7ef13fd593728bb4971cd7fbcf828ab87accf401aeba3f7cc327d5e27ec1878757c0bf0f05c55b1f1749dafc755", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624868654, "uuid": "17e7c35a-2d9f-4ef2-b5bc-7a287fd8a7bd", "value": "4A13754E2A619FECF76C863847B78E206758339526E2D6C4D19CEE015FB034D641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624868654, "uuid": "79442f05-b020-4306-b6ba-af4f6c093f52", "value": "768:/wNdFv3tW0u4b1KTVEhzMv1i5Rq2+sOsrsWlsqsYlsxsstEdjOs2mvhnEOJKmPBw:siVER/jtO/VKPZDKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624868654, "uuid": "c1fbfb20-8343-4fb4-b132-d2a096fbd6fe", "value": 44540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624868654, "uuid": "aa917e8f-3cae-4a10-895f-35aed32487a8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624868654, "uuid": "3a23f1ee-2c00-44d5-846e-85afe6ca8adf", "value": "bd6412d55528ae2b756c1581d195ef53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad894f9-d80c-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1624883206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624883206, "uuid": "f9e7a04b-3424-47b6-ac6d-b42d7c015eb7", "comment": "Malware payload (TrickBot)", "value": "022caec7ed77f286c0c5191aaaf75010", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624883206, "uuid": "2a5c11ba-a422-48fe-9c66-1f9ea5f8c107", "comment": "Malware payload (TrickBot)", "value": "4b2c39847825cdbc53f5a1afa37f047eeba06b7b490b191967e88cba0706df3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624883206, "uuid": "2e258f93-1d3f-40c7-a573-7afac6706927", "comment": "Malware payload (TrickBot)", "value": "95f9bd87449cd84b9ee8c4678d67c3b89f030362", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624883206, "uuid": "0b414fdd-fa27-4f27-adc5-12f87b2f7e47", "comment": "Malware payload (TrickBot)", "value": "052d8b395366739f5f4167498bef088b85a9875c95ebffd1c3aa87d4957c114b32ae41384307d91b6d2623306a059217", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624883206, "uuid": "374a05bb-77da-405a-87c0-038d606456dd", "value": "36F4D002B793C472C5E125311F24D7735739FC250F248B9BA3E40D6BBEAA1926A3D6D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624883206, "uuid": "6428eafc-b1ad-4686-834f-850812bb4436", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624883206, "uuid": "a4fdecc2-1360-4280-974f-5caaf3696de9", "value": "12288:ehqxSLo5C1Ps4XhCMX8XL8PC3SrSal0l/elVxLmss8uIC:eHLmCiIhBSQP0SJignZmss85C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624883206, "uuid": "769d5337-1d09-4135-b0eb-28645b355a5e", "value": 724153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624883206, "uuid": "2f13d305-b34e-4640-8e37-252d09f7777b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624883206, "uuid": "b3728099-3ebb-47d9-bdb1-f4cdcd76ce90", "value": "4b2c39847825cdbc53f5a1afa37f047eeba06b7b490b191967e88cba0706df3e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d9aeed-d7a8-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624840215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624840215, "uuid": "18bc1815-d39f-4b50-b59c-5a478bb81cd7", "comment": "Malware payload (RaccoonStealer)", "value": "77c5562aa3aee033d80ee4eda315cb87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624840215, "uuid": "34448667-5792-4d46-b5da-1d38e4fc505c", "comment": "Malware payload (RaccoonStealer)", "value": "4d040a47b68aa1d352d146d2061a940436eb00a36a5f5fc3baf0fa8932e198a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624840215, "uuid": "5dc35b71-9ec1-4be6-92da-bc52708a579d", "comment": "Malware payload (RaccoonStealer)", "value": "7f5233d8b178f2098267a86195f3b525523de191", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624840215, "uuid": "d17a6a5e-bd06-4dbd-b5e7-a48bc300d855", "comment": "Malware payload (RaccoonStealer)", "value": "036a6afdec0073360f073a5ee80fc2e2c7902065ec9e95f21f188a2bbf689b38d322568f86c0e586ff27fd84664ec771", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624840215, "uuid": "600c686d-a762-469b-a9b4-6beda497cde8", "value": "BBD4D000A6A1C034F3FB71F89A7A926DA52A3DA16F6500CF12E926ED56347F4EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624840215, "uuid": "22da3d28-7d15-449a-8ebd-957ef1a9c87b", "value": "b067534ac0be7011ca2eacbb5ad9dcfe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624840215, "uuid": "ad059d54-08c6-49e1-985d-6a4aa61c2c0d", "value": "12288:B0hTpw7i3LRkisa7nk0DaPLpdPBT8Jx3LNvYfrl:ETpw7Ucar5cX5C55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624840215, "uuid": "97a24af0-4b03-4a2e-8d9c-c15f5875ac8e", "value": 624128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624840215, "uuid": "65fafcef-8651-40d9-9f6a-eb8b5a6ecba7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624840215, "uuid": "4d3dc477-2c02-49e4-8b4a-8f7ae21c4fcd", "value": "77C5562AA3AEE033D80EE4EDA315CB87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ead90577-d7ba-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1624848336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624848336, "uuid": "f60d2cd2-ea65-4fc7-bbf1-1b301db290e6", "comment": "Malware payload (BitRAT)", "value": "9872c5836f6267c8a7a0355af11fd10f", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624848336, "uuid": "67298868-05c6-48b2-a143-6cde9dbbe34d", "comment": "Malware payload (BitRAT)", "value": "4dc35908a0885511857ea610a559c4aebe99231ba8493e95885512f0f98293ed", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624848336, "uuid": "abfbf7e9-a9c0-4f6e-8eb5-27d142613ccb", "comment": "Malware payload (BitRAT)", "value": "0eb9b07c1f75fbf056f1502bd3edbdb448164734", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624848336, "uuid": "d43f90a7-7d86-4936-97ed-0c3c475c915f", "comment": "Malware payload (BitRAT)", "value": "3eb8614f586d2a52f599c3083c08363d5656bcb056c0f55c2bc01a97f42f0a3986cbf0a3907e5d812407e845f4e93d10", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624848336, "uuid": "1e4c5b04-1633-4997-af47-0ccf1459b66a", "value": "4B06123BB6F46389D0BD883597AAFC6030F11E39CE81D679D9B6A9C12311CE5A50352F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624848336, "uuid": "b9565717-32df-4147-a3e8-eef35c96302b", "value": "5b05faa1e3cabad37c86cad478e55916", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624848336, "uuid": "d83b876e-8841-4ca9-84dd-1b773013415f", "value": "98304:87Pb17RLe6OmPZFvKDAOKPfITyQERKlMNSrZ:81FLe6BFvkKPcQLNSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624848336, "uuid": "0bad07bb-e3a0-4880-a11e-695da889b0df", "value": 3686912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624848336, "uuid": "b9ab93a6-33c9-466d-ab34-ddc358b06637", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624848336, "uuid": "0000322d-d13d-45cc-bfec-d55a675c8351", "value": "9872C5836F6267C8A7A0355AF11FD10F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff27c0e5-d81c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624890461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624890461, "uuid": "e0b75a24-7e26-4075-b826-3b724e137ae5", "comment": "Malware payload", "value": "fef719e088516b81a176374c6d22ba42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624890461, "uuid": "f7af0461-4886-4cfd-aca0-9d12ef2b0e5e", "comment": "Malware payload", "value": "4e4c8a7b36db5f15e7f1f5676e9d5e2871d2101ca7e28349384a8cdb698a54ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624890461, "uuid": "deb6bb64-85c5-4980-b4cb-fb07aca56eb8", "comment": "Malware payload", "value": "242aa309cd553ce6287026722e1ba59527c8cd64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624890461, "uuid": "d1092bc4-35b9-462a-9f9d-a1773730e8f0", "comment": "Malware payload", "value": "4a5c6c9c1ec0407fb587963b148a2fafed1b17be949a87a9e9cf3c20daddca941f1e18da95c280129ab4e5c4c5437e8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624890461, "uuid": "8cc28ccc-7ea9-42d7-b722-b2c86dddb7b4", "value": "1D15CF242EE80626F5BAAF7D95B5204556FDF2236F07C8AD7CB502CA0713A42C5F173A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624890461, "uuid": "e3878380-229c-413a-b5f7-14a64bc45ae5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624890461, "uuid": "51b9534c-7514-4354-ba91-13d7dddae052", "value": "24576:3gKqOiQSwtS/ueUyQ9lMNJgjbxamR+5NQ7G:QEi3fQwixdQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624890461, "uuid": "10805261-dbd7-494e-ba08-4cf8717df6f1", "value": 927744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624890461, "uuid": "ac6a8b16-d070-4552-8f0e-5cd3d23aebab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624890461, "uuid": "8caf3b2b-2ec7-426f-836f-bdbac0889444", "value": "yogMjGlZZ84pTpd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e60043ba-d818-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1624888701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624888701, "uuid": "9dbfff96-45bb-4f86-a953-b5b6a019844a", "comment": "Malware payload (RemcosRAT)", "value": "e3160ad51d4d9df6ae40ad37dbd69fd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624888701, "uuid": "a5311021-dce2-46d1-ae61-c5715a872b69", "comment": "Malware payload (RemcosRAT)", "value": "4e7528badee13ec6101ba01cd2763bdc754f144c9d520c199fc4f179fde04098", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624888701, "uuid": "100f97c4-a86f-436c-b001-46da7e620c45", "comment": "Malware payload (RemcosRAT)", "value": "d4f39668cd5307fb33332fa8fbe5a4147a27e8c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624888701, "uuid": "e2984cfd-3c10-45cd-9c19-30c24fe4e659", "comment": "Malware payload (RemcosRAT)", "value": "4cbc4993e987bee5de3f07a4fa03ad0dd16eb2ba46e347385d34540e23545e3bfc3fd28f920d0f489919d2a035043976", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624888701, "uuid": "1f745c1d-0a92-4e4b-a49f-c4183c3d8fd7", "value": "2125F029777796D9EC91C5792F06C1781AA72CC0E848CB6EB0D8BF6FB5F509560802BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624888701, "uuid": "7ab5ecdf-6211-4d17-ae18-b8b8abe8cddb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624888701, "uuid": "3ea3ae43-ab9d-47a2-8560-30999a360517", "value": "12288:wPwgSlkYK65Mao7vunIX6RCp2aRm3hJh4tWKG1Gu7iTQezjBwv:wykujo7vuIX6RCAqmxJh4tc1Gu7Kzuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624888701, "uuid": "7eb2b349-dd44-43c2-810d-39effd8969aa", "value": 1041408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624888701, "uuid": "4aee9cdd-ab1b-486a-842c-e0eae15f9687", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624888701, "uuid": "8c97faac-e71a-4173-a83e-996fa94188f9", "value": "mail.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d767521c-d833-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624900273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624900273, "uuid": "daf3ae4c-bfe0-49eb-913d-d7c1d7f2b130", "comment": "Malware payload", "value": "ba4ace152584f24941daef204fd7fd21", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624900273, "uuid": "635b069a-a7f0-4093-9246-2a115ed8d1aa", "comment": "Malware payload", "value": "4f910805fb3ee645262b20b757514ac45c893f88d9a00b9b20d6a41dabbba314", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624900273, "uuid": "125e32bf-556f-46a0-a34b-57d0a7a425db", "comment": "Malware payload", "value": "138eafe05e9b282cc3933ff646c6958c959ef9c5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624900273, "uuid": "dec8a5f0-76e8-450d-bf03-82bc23dfc366", "comment": "Malware payload", "value": "17bf8c503009a6e2d2602e5981cfb821c12e2697745179bfdcb85aa448bd43e676cf6f1d7e87fd789037011083f3e7bd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obfuscated", "colour": "#0E3395", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624900273, "uuid": "701ecaef-4b15-4825-8030-d0185c200a19", "value": "0DC19F6CAB3967174045DD68BC7DF987D28CFFB35D3785822C3A64C744C8269412BC54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624900273, "uuid": "ee326f4b-e5e6-4176-aa8e-4c94e180d75f", "value": "96:KDy4qJOI3kwYTMLCS8pzeAW8NsOVBn9AvijSmDefduzzeeCW/8AnV91ia0ClMzpZ:KXqMI3DR8I8NLnn91jSmDsduP7CWJB9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624900273, "uuid": "75ecbb26-e388-4dc1-b1ec-e676438a9d63", "value": 5745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624900273, "uuid": "f6be4334-409d-4a99-9354-d18da73db4ce", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624900273, "uuid": "10e278e5-9852-4b76-97d4-8b4d1e3423ad", "value": "001887E44SS1ss4dttyuvvn0094-0021d441s00.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc3f260-d7f5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624873598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624873598, "uuid": "cb7bcb33-4245-49a6-bc58-2eaa1f23752c", "comment": "Malware payload", "value": "5dfa998f62612e10d5d28d26948dd50f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624873598, "uuid": "d2a091a1-5a80-4ce8-ad09-4922da469976", "comment": "Malware payload", "value": "4fa565cc2ebfe97b996786facdb454e4328a28792e27e80e8b46fe24b44781af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624873598, "uuid": "8062d5ae-dc49-4346-b5fe-feba9ec85bbf", "comment": "Malware payload", "value": "05618b47ccf5aba595fba60feb30969b5500abb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624873598, "uuid": "fac759e0-e1df-4f61-90cd-8d0116d99a60", "comment": "Malware payload", "value": "9ff44e14cba1144699dcb47bad2b9da40ef1f6336d4724e5004fb1839839c697886e2b442254e8c3911dbd741b0979ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624873598, "uuid": "ceba52c4-3f33-4636-be70-c004ecb63a10", "value": "CAC37C8172C0D472E97619720A60DAF09E3DFC301A50AEEB778416394E61AD3DA25F7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624873598, "uuid": "6c7b5e43-a897-43ba-8038-13a852564d6b", "value": "d3b5af96763bcd3d7a96fdb6495c42f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624873598, "uuid": "d0048a31-3d6a-4b9f-9579-76903a1b2a0b", "value": "3072:FGLXPggYI4tRE/UAhW9SOsRHor5bHVZ3D1Lowg0p53NTz0cKzWZH28wjJ5Pq+ZoR:F2XIgYxZxPT53NjK2H6PSDlu9sYtC0gF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624873598, "uuid": "e4865ced-56b1-4eaa-8ffb-9bff0e06d208", "value": 124416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624873598, "uuid": "3644cffd-1b22-44ef-8346-11e003dd00a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624873598, "uuid": "e50929af-0a6a-42d9-941e-2188ad861878", "value": "builder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e87b08d-d85b-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624917357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624917357, "uuid": "5cfb5924-4276-4cae-8fbe-408f9f44a005", "comment": "Malware payload (NanoCore)", "value": "902bfcb0700a03069a73aeabe0dbabb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624917357, "uuid": "d52ad7c5-1f2a-4ee5-9646-0ce8b37c8c3d", "comment": "Malware payload (NanoCore)", "value": "4ff651a559ea78e6aa9977bfce5a491a4930b2fe0a6744e3443d21709f796146", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624917357, "uuid": "0bb31065-665d-4ba0-9a1c-6d341e68b731", "comment": "Malware payload (NanoCore)", "value": "f73d624da5f7287f47443761ff75caf3632de951", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624917357, "uuid": "ee39a023-e3d3-43ba-8daa-746e63d07970", "comment": "Malware payload (NanoCore)", "value": "cfb7505179458d125b813bd8b83af3ce853dc8572923c4f1f696b6e2905e3cc063e17c2ea4161b7e4148087a93cbac86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624917357, "uuid": "7a03d8ca-e3fe-42e9-978a-ff96221ae13b", "value": "4735E01C3ADA5039F0F7AF794AD065969B6FBA6F3702C40D14B0DE4A7633640D98C63A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624917357, "uuid": "b0bac368-91f7-4309-b191-c55ddf2517e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624917357, "uuid": "20b8d22f-5d33-4cc0-997a-0b6abb1f0970", "value": "24576:jOj+IbAaMd33EUbAaMd3U7VPU5dy3sD+JCKF:KZAaMV3EEAaMVUhPUvOsD+Jb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624917357, "uuid": "16c3a5b5-11ac-4bd6-ba41-b75e2cd13003", "value": 1163776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624917357, "uuid": "17184890-214b-42bc-970e-c6dd1f45b127", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624917357, "uuid": "51a7adc0-5a2b-44f6-9bb9-0ffff5324c8a", "value": "902bfcb0700a03069a73aeabe0dbabb6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1489847-d81a-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624889525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624889525, "uuid": "d39c4d38-eb47-4fc2-97ab-360121c671ab", "comment": "Malware payload (Loki)", "value": "cf1b7323f6f45ba667b189db9ff26142", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624889525, "uuid": "1b0e9c84-daf8-462b-a23b-0d3bf74ce6af", "comment": "Malware payload (Loki)", "value": "5049d3e114300bec068368b467db53022712b73bf2e154cbdb19fb8de6fd8779", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624889525, "uuid": "f46d94b9-e315-4390-9a4b-c46730ce56ca", "comment": "Malware payload (Loki)", "value": "b6a4bcadc2aea96ef714afb16efad2e5c28db364", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624889525, "uuid": "aec1b49d-e3e1-4486-a42b-c0fd35653058", "comment": "Malware payload (Loki)", "value": "f0f8edef40c234e1ce05d931c4b8009bbd3d1a44a9020ddf121e3c06f97791397ed5559902ea03309b8fce57f856f860", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624889525, "uuid": "dfec8207-b6d6-4f25-8761-13f6f7d67c76", "value": "72451236DA536F9FC1BE8AB54663C27198E2FD38D625478BCA817C5820F4D522E407F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624889525, "uuid": "1378dee5-d1ac-4458-b29e-6b5f43acb8cc", "value": "24576:pBlodwojYVNg7QOOPqxrbAyUctCqBjpZfI//ofVwb7gSBwSg:prnVYQOOoyctvZfIXIvYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624889525, "uuid": "066be7f5-6866-4795-9c07-2cce83e19106", "value": 1219736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624889525, "uuid": "ec317c3b-ba95-4604-a30c-a07cd071aac1", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624889525, "uuid": "8cdbe0c5-9fed-4b25-9a75-32078f6f5447", "value": "SOA 2.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8375fff-d858-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624916192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624916192, "uuid": "80d33f4a-8025-415e-839c-54a4a096ad4f", "comment": "Malware payload (Mirai)", "value": "b170859f0259f5665e862453ee70df3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624916192, "uuid": "9563858f-86a7-4540-ab1f-126b37706276", "comment": "Malware payload (Mirai)", "value": "50924c68a647e81e8a5f450ac2a7ba7f023170261a6317ce77892093fd6960af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624916192, "uuid": "c2f12860-cd80-46a6-9083-2f17828434b6", "comment": "Malware payload (Mirai)", "value": "40c5ea25bbd354aa61770af574ba1bc8f79388d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624916192, "uuid": "5d7c3b9b-364b-4c4e-ba6a-f897dccc22b0", "comment": "Malware payload (Mirai)", "value": "78b8a302e2dc1a2ee1d8699451c2323265c774c68c4314e1adeefaede39c58e754f7a43d8c59b0b49355cbd95e489958", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624916192, "uuid": "d1d25726-6393-4ee8-8ae0-2066e4b28222", "value": "7BA319C4F253D9F4DC4A45703176FB368E7AB1BA222DED93D3E49B236C91A42C8055AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624916192, "uuid": "c9b68f89-a907-453e-a49f-02c4c4e12ee6", "value": "3072:qKp/o2jLxwfZkqO1aTJ+nf/xxRYcTDIOGO6UdAT89YBEdO05YQ96:qKpQ2j9yuNATonfZxRYcTDIOGO6Ud1BO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624916192, "uuid": "18d9930e-0a13-4cba-8841-e7c75bbd483e", "value": 103312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624916192, "uuid": "cbf84a89-124f-4f3a-9b54-44a47a02e860", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624916192, "uuid": "fba21cb5-a092-4766-acd5-5ad4866b81fe", "value": "b170859f0259f5665e862453ee70df3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1672e10e-d858-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624915841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624915841, "uuid": "45a7e28a-2c86-441b-93a2-17216e50b7e6", "comment": "Malware payload", "value": "60e64b58f518999fa9bc004f732ff823", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624915841, "uuid": "e7c893e4-0f9d-4222-b827-37a65b82f944", "comment": "Malware payload", "value": "5262760b5075df8ba6480155393b2d77774679302c803e6e05ff36fca2e36160", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624915841, "uuid": "8bc35578-b1a4-4736-a117-732a2bd20524", "comment": "Malware payload", "value": "39d7bc4f75e28efd741f1e805300c4a8d91c0e97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624915841, "uuid": "7a4f54c0-cf9e-4ad0-bd0b-99a849c03a38", "comment": "Malware payload", "value": "8b8ce5b3b2cd5a41035297c71679b0d2b0cba4eb9758d7b93f8759f1c717df94ecffbd97923f7ce4c345915d4bd7d597", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624915841, "uuid": "90570a3d-08ce-42d3-be81-f901ae56446a", "value": "8FF33AB67300E41DD63BD1B09710A2F8A2DA2C74D946C413F381FF293AF76859A6467B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624915841, "uuid": "f2f63a5c-f3cf-474e-9dfb-8cb8917458cc", "value": "04f3e63a532f7914b98c31634d4738cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624915841, "uuid": "84f3476d-a495-4845-926a-3aeaa3929b91", "value": "1536:xkQS93PgeNsFFIPvdIkDtJPdZDrKrFkFN6+FxMeygWAMCe1qO3E74NmUQS+:HS9YeNGIP1Ik/FZDrSo+eMGGyRS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624915841, "uuid": "31cb4180-a9bc-4a2a-8d1d-19c76312513f", "value": 169056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624915841, "uuid": "aade6937-f3aa-4b92-b043-16f9ce2e53b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624915841, "uuid": "b0b7dab4-2154-4245-8392-bb1d487682ae", "value": "PROJECT Response Letter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e389de-d7e5-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624866656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624866656, "uuid": "df45448e-3bb1-4049-bdc7-b9a067b5609c", "comment": "Malware payload (NanoCore)", "value": "a79f0d15db98765ca104e5b3e2a56785", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624866656, "uuid": "84b05961-e753-4b35-8d4f-dbd6a2732c1e", "comment": "Malware payload (NanoCore)", "value": "53a74c28624424292af9e2ceed7da5d53af113cf213e855e5e4421aa60e7901d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624866656, "uuid": "0cc46aae-05ad-4364-9b96-9fae4755da31", "comment": "Malware payload (NanoCore)", "value": "fa83af9222f7611f7c6cce875f6a75e1757a6974", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624866656, "uuid": "8eedee1c-d70d-444d-8e54-fd524ec31743", "comment": "Malware payload (NanoCore)", "value": "7f360504d67d923477718d866f9f78ae053f6c0794e266ad08da2fe82a51d12103e778aba97a1b1135c15bf48d813e1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624866656, "uuid": "a8efbe91-6f4b-4dea-8e13-39bca75a53ee", "value": "2B05E1302AEA5019F173EF755EF476D5DAAFBA633B06D86D1051038E4B23942CF9063A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624866656, "uuid": "8ee84842-4ca2-47c1-bddc-1391876d0b57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624866656, "uuid": "4ce185ab-3520-4d61-a607-4ea291accebb", "value": "12288:EyJZaF9GF2P85Q+3wdT9rE52z7yrv4JPmPOUYU9VC6tAFKXrAKv:ENjk5QRdBEE7Cv4JPML/CUXpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624866656, "uuid": "4f455361-1936-4ede-9595-0b6886a025bb", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624866656, "uuid": "98f58282-cfa6-4a72-9095-512bd16dded4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624866656, "uuid": "024c5fbc-8a3e-4a6b-b566-8dd3f079f48b", "value": "a79f0d15db98765ca104e5b3e2a56785.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf07bafb-d83c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624904124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624904124, "uuid": "bf7a4cc5-04fe-43e5-a9c3-fe734400998a", "comment": "Malware payload (RedLineStealer)", "value": "3e38467e91e626646bd6c7ed5c890f52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624904124, "uuid": "daf9fede-b004-4c4e-8304-4c7fa12deeb6", "comment": "Malware payload (RedLineStealer)", "value": "547cc534323bdd58f2fb30611e0cae63dea9c2583cb8932ef5e6063b2a08fbcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624904124, "uuid": "9925c20c-5938-4d74-91c9-2c389ae33e9a", "comment": "Malware payload (RedLineStealer)", "value": "0ae6f104555e5e835955fda2d4145bbcb4e1a3f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624904124, "uuid": "251b62c2-1998-40c4-a07a-53910eb69bf1", "comment": "Malware payload (RedLineStealer)", "value": "768555d2688a6996b7b5805900dd8909383024be4e60e8d2c93025279e0cb4a17861e1a507f91c7afa7c2451d81a2150", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624904124, "uuid": "ed97c04e-9468-4a24-9c25-cbe92aa957b2", "value": "28F5335471C585F3DB812530AE4DBFB2E4FDD7081B36A89B3B50872D1BAAA18C06DC97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624904124, "uuid": "0af21e29-3110-41f9-abae-cd1d3f596c74", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624904124, "uuid": "087e1674-c262-4cf6-bdc5-955148feea58", "value": "98304:xp18Qc5IoucrITEU1Q3aKP7UCvLUBsgOtQTRkG:x38QcducaEU1QKKPlLUCgcUkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624904124, "uuid": "f9b3c457-dad3-4499-bce6-58cb99859d38", "value": 3563638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624904124, "uuid": "4969049d-eb7c-4ad5-8704-b37e8a68ce58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624904124, "uuid": "7220d961-815b-472a-9bbc-5be4517a2df6", "value": "3E38467E91E626646BD6C7ED5C890F52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee894a54-d807-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624881414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881414, "uuid": "b44c011c-5b2d-48de-89d9-d4cb6b84196f", "comment": "Malware payload (AgentTesla)", "value": "bc72bdc2d3518d6fdb8c2c43fb67dbba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881414, "uuid": "3044e262-fe86-4024-84c5-38c0e4d01ceb", "comment": "Malware payload (AgentTesla)", "value": "563d0226f3ff043014f86d780778fc6bbae2193e46137271d586ca3d83da34af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881414, "uuid": "95ae37c7-5f4c-4f6e-b930-4f529b0842d9", "comment": "Malware payload (AgentTesla)", "value": "a44f1c62ce3b06bcc6ed4fc1da6da11683253ca2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881414, "uuid": "e0e05f42-c1b0-4369-ad7b-d943e2f51c95", "comment": "Malware payload (AgentTesla)", "value": "a2fbebd0c1a0f1014ba7c0f2002baf70cd57c9e6db545c68d3ae460c4244607ba5e31b8a0ed0809bad52ba8f82458166", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881414, "uuid": "deb99e68-f4c1-4c1f-88c0-07118a84c11d", "value": "BCA412283EFC616AF1779F3556F829544FBFB6132A17D45D2986120B1A33A42CCD3B28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881414, "uuid": "b2fa389e-3d6d-4539-91be-69254958d51f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881414, "uuid": "b3aaf180-ddbf-47f6-bb03-79ec5c2e3334", "value": "12288:Ij2xgoCxSI4WEr5NvffhoNaYNrLQ1e9Ra6j1Qe+OXtVKs:e2x7UlvaNvwaYNrLoeRqe+kVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624881414, "uuid": "57580edc-4bea-4cea-8c57-97486bb4fcb0", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624881414, "uuid": "c08ae3f4-40ef-4053-a60a-d505fbde15c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881414, "uuid": "ce797794-7d51-4b58-a814-bc2c9c6f8a3c", "value": "bc72bdc2d3518d6fdb8c2c43fb67dbba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e80420-d81c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624890338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624890338, "uuid": "e0e70319-96be-4fb0-9926-201e004db83b", "comment": "Malware payload", "value": "1ab0d7cd905736aa796e835a002d1771", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624890338, "uuid": "188bc27c-91a5-4048-a5ad-c95db0cf3960", "comment": "Malware payload", "value": "56b65acc27d239fe16e6b06461e008a482eeb9a02f52fbfa3009b5370f62d02e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624890338, "uuid": "9696ce54-f23c-4874-a77d-4ca346fbcfad", "comment": "Malware payload", "value": "e180dc5b848efa6467f2937c82637275909d12c2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624890338, "uuid": "ef704914-d8b6-45fa-aa53-f670df21b9f2", "comment": "Malware payload", "value": "716eb857beedde88bb7bb9dce9b5bb1640785bf9bf633da0396ba5be253b163a8f3a6271592fbbe6c365c10442bc49b9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624890338, "uuid": "59639b72-962d-422b-9748-3f074de08d3e", "value": "B2E4339E2C356A57C0CF6882CF1B4A9D05FD95C68048FA4127EBA36EDC61EDFF581242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624890338, "uuid": "a4c1aeb8-5900-4db3-a016-dee57ddc7a9d", "value": "12288:uYBmqviRhvF7kDUXFtSymcgMoXBn9vcYJlMCXjnzh7/8xY+a7Ea7q5:uY0woXFwymcc71Jt3Nkra7q5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624890338, "uuid": "457d7981-e209-42e8-9d25-5007622e696c", "value": 709916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624890338, "uuid": "dd307049-6375-40cf-9a44-caafd16d89af", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624890338, "uuid": "66fb639b-2253-424b-a261-2de458072a17", "value": "SCAN 945657_INV.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db162d1-d7a4-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624838651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624838651, "uuid": "0b6adcc7-cc87-4d5c-b983-87cb5980d9f2", "comment": "Malware payload (Mirai)", "value": "bf25887e75a9c667c1c3d943644bfcbe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624838651, "uuid": "2afee163-81d8-47e3-80fd-e67159ea6c2f", "comment": "Malware payload (Mirai)", "value": "59493f95fb44ff201e54c962d8b8bf3854de3a55f639f328f8dad5e3c8470beb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624838651, "uuid": "0f6887c5-1b79-44bb-ace8-0dc43142478b", "comment": "Malware payload (Mirai)", "value": "13d667810d9b2b67e33ee61e9b7f3c2fdfe07ced", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624838651, "uuid": "cd94ba14-aff0-4cf2-b659-82d5de933b12", "comment": "Malware payload (Mirai)", "value": "68917271f91cf1176082adf8a3522282d031478926342677d9911613885ecc965be5c699c3ff9b2c6c3f69a7f3bbc7ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624838651, "uuid": "14639509-75d6-4509-9afc-abd8e0d1e085", "value": "C093734D3E219F7DFFAC823887B75A21A64823DA66E1C585D05CFA021E7034E741FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624838651, "uuid": "028d147c-2dac-486f-a973-b930373b610e", "value": "1536:1YRdsnDd6C6gb/ZVyDYjMbwqZ9f0vfwW9ufY1C+KBtyRirfXDOiOn3J:CHsnD8/gb/zyDv9f0HD9FC+KBtyR6/DI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624838651, "uuid": "e64c584f-3608-4d13-8d18-0ea058de6ddd", "value": 89332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624838651, "uuid": "57750f6a-6f87-48d2-9d88-a76c54e00cb1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624838651, "uuid": "ddd47207-b325-4f07-b676-1b10c2f1c3be", "value": "bf25887e75a9c667c1c3d943644bfcbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a00d2ca7-d816-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624887725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624887725, "uuid": "35783b0f-8e9d-48eb-875a-72d8418d294a", "comment": "Malware payload (RaccoonStealer)", "value": "5edcc4f8fb881b391e4eb258b6422fdb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624887725, "uuid": "a6aaca69-f501-4361-a446-097890405afc", "comment": "Malware payload (RaccoonStealer)", "value": "59dd63bc09da452ae3781f5570d0dfe344ff76df70419d89659ff73d7e691002", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624887725, "uuid": "34ebf246-0835-4eb5-b927-f5669dab911b", "comment": "Malware payload (RaccoonStealer)", "value": "3bf3ed28bdd2ceb9916d365df8d63dfa105a33f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624887725, "uuid": "f4eda55e-8226-439e-ad1a-3f79406e1395", "comment": "Malware payload (RaccoonStealer)", "value": "1a7c6c82cf19aa8b4807d1a05dbd1448a35a3d888cacc1432f4449697a28b55504371d99d58f2cfb50adb741cb5bd76d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624887725, "uuid": "93e8ba62-1564-4e24-870f-d78adc573a56", "value": "BAD38DA2E9DA6501F1054731C464864F6E10BF552933CA0B33067ECF9EB92C39AE5BF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624887725, "uuid": "10639a7a-b32f-4bae-9b34-721bee2c2f81", "value": "881c5e1fe3abca37c874949babc63f6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624887725, "uuid": "c48da3e5-cf90-4324-aeb3-507322102d85", "value": "768:Qu57/LVS/RyceoMt0VaaJPCjmCsFb/881m9zdynSfAPOczcC3k9CqOjAulOPgTpV:Z1VS/RDwtGJOoSIPfzcBCqOjj1pkQxjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624887725, "uuid": "1c536249-0ecc-481c-8d28-23190968a2f2", "value": 140424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624887725, "uuid": "0ef0c46a-b6fd-48f3-8d03-1201e2e06c17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624887725, "uuid": "43fd253a-3fe4-4adc-ba2c-1ed2175082d4", "value": "5edcc4f8fb881b391e4eb258b6422fdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8599cd8-d7a8-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624840521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624840521, "uuid": "5d975757-c34b-4db0-abc6-bb6a1a6f47aa", "comment": "Malware payload (RaccoonStealer)", "value": "6a792cb55ea84b39eaf4a142a994aef6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624840521, "uuid": "32ff0c28-818d-49e8-8d52-e009ecc0142f", "comment": "Malware payload (RaccoonStealer)", "value": "5a3597141950b71eb9654410762a615fa75349a8330ab6efd16a77b79e16f0fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624840521, "uuid": "546b1a0d-89c1-4131-a887-cfc5af59e08b", "comment": "Malware payload (RaccoonStealer)", "value": "06ca301399be3e2cb98bb92daab0843285101751", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624840521, "uuid": "3fc2b65e-9b37-4681-8b62-fbb47e9ef384", "comment": "Malware payload (RaccoonStealer)", "value": "4b026700e68b1524801d104b0f74ad18293644b83f7bca09adce37901479f369e108b6984eee33ec93d68d973bf9cc17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624840521, "uuid": "999f552a-2e2b-45e0-b006-583ff79f8247", "value": "E1F4E046BF8AD132D55245384CA5C47666333D301ABA5C89BBC93F6F3B72660C10B7AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624840521, "uuid": "10ef0561-9781-48c8-aad5-44e60e09c8f8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624840521, "uuid": "0c78a395-26cf-411f-b49f-66c8135b6d2b", "value": "6144:d/QiQXCE55m+ksmpk3U9j0I6KBsoxvjFEOTb9WmZX/8shzdsY4CpHPhnPyNpuyU:VQi3E5c6m6UR0IJp1hf39Wkv8xwJPIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624840521, "uuid": "d3f08f18-9b09-484f-ac82-61ff690317b5", "value": 762119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624840521, "uuid": "932b9af3-7808-4b8e-a645-037a7019a861", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624840521, "uuid": "00760302-b266-4ffa-bffb-d75bb95217d5", "value": "6A792CB55EA84B39EAF4A142A994AEF6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b75955-d7e1-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1624864855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624864855, "uuid": "e69aa8be-00f9-42fe-9655-6e1a08984067", "comment": "Malware payload (QuasarRAT)", "value": "0dec37509a6328db793b1708d9f97e1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624864855, "uuid": "bd8d2e37-2c2d-4244-ac07-58daf3ffca53", "comment": "Malware payload (QuasarRAT)", "value": "5aa536fddd85f56a15349992de55d422a379ba2f5ee5e16bc6311d4c6471fddb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624864855, "uuid": "3c07bc2e-e3c6-4425-939d-ddae6f6a534b", "comment": "Malware payload (QuasarRAT)", "value": "ce8ecfa888c58bf7bda7de201c6c225050ab65c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624864855, "uuid": "f66cd698-8fdc-422b-beb8-ad7e961b8aaf", "comment": "Malware payload (QuasarRAT)", "value": "4cac110b841b30dedf6d9178bcf27e0e72e1ce11526daf9a5a187ac0616bc0f14cdfb3de1ca91de23ffcab9aaeb99b5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624864855, "uuid": "d426eccd-1fda-42e9-b230-94598f5af039", "value": "5CE46A908EEFDEDEC26F663FA54A0C9214EED306079792E59F464D34B3852238D611E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624864855, "uuid": "62b44daf-d98d-4b09-ab06-6acd14470942", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624864855, "uuid": "5d4dd963-a44e-491d-b73b-2b0bd5325da8", "value": "12288:CC/dIVYS1Yw70gkiF+YTBLlKqvrLJeu9uwvDR4w2U:CodIVz70viFQqvxJ9uwLRn2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624864855, "uuid": "76fc7709-6826-46ce-a588-340b5147581b", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624864855, "uuid": "2a8ed538-208b-489f-ad7e-873f10069b63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624864855, "uuid": "a309ddca-a863-447e-9ac5-11c55dbb9cc8", "value": "0dec37509a6328db793b1708d9f97e1c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c97a9c9e-d7e5-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624866749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624866749, "uuid": "77b629c4-f265-4c7e-9c78-1196fd8f2f89", "comment": "Malware payload (Gafgyt)", "value": "44df1e501bb152e9a8a2c4239d1ec8b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624866749, "uuid": "4e03c0e4-5e46-4e54-a79e-decb0ca8ce7e", "comment": "Malware payload (Gafgyt)", "value": "5bd0d26b144f8f383ec5a5740cfa7c95a0a686b624b0fecdce62c80c4babd535", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624866749, "uuid": "5c2daa2b-7420-43c7-9749-64113e34d112", "comment": "Malware payload (Gafgyt)", "value": "a5539a8c7027fee865496997203597249908ff5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624866749, "uuid": "2809a125-45e3-4ae7-b13d-d5c71459c079", "comment": "Malware payload (Gafgyt)", "value": "f396750be8801fa0196a88569633708f050a5ed09f902f1073405a4851de7a62b7f422462b78557dfb8949ce94b00d2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624866749, "uuid": "9dce260d-3ef2-478e-804d-872324aa5668", "value": "53A34B86D603C6F3C4430AB2029F965A0632BB3A4E3B9EAAF71D7CF49B118D57115B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624866749, "uuid": "e0985704-440d-4526-b662-e28aad8a4aa9", "value": "3072:T1f87zPTEVj3W8mz1+cnpS0yrwc5hoO+iX+GVOzByoQSbb:T4zPTEVj3W8mfkXrwc5hBBX+GVOzByof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624866749, "uuid": "a5726994-64da-45bc-bb69-58cb115395b2", "value": 99306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624866749, "uuid": "8bf6c8c1-997b-4324-a57e-8a48da6c3815", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624866749, "uuid": "29c9dd34-8b2c-423f-b6f8-688aefcc4e3f", "value": "44df1e501bb152e9a8a2c4239d1ec8b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd5313f7-d7e5-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624866755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624866755, "uuid": "d136ca33-63c8-415b-8a5d-b8e463941283", "comment": "Malware payload (Gafgyt)", "value": "de032cc48321ab7d845d0871b759a142", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624866755, "uuid": "9301087d-438b-4e40-bf1a-c2620707c309", "comment": "Malware payload (Gafgyt)", "value": "5ca3b4fd8700a2c0a2cbc6d98085d128d90a7d8eb5225b3875b99ff34efe8a69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624866755, "uuid": "59f81efb-6800-4e09-9fe9-5815f1ddc0c9", "comment": "Malware payload (Gafgyt)", "value": "716cbf8c7133607971e6ba7fe11cf28f8c383ac4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624866755, "uuid": "cf2210ca-946e-4337-baba-5489b292c767", "comment": "Malware payload (Gafgyt)", "value": "b40f511b847cc57bb36a828957d2ccb818462d24ce54a15e6cd087a65fc7cf50918f5e12c282376f50b7e2bb94fc5f9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624866755, "uuid": "25b2aa6b-9830-4609-854f-12f04357808f", "value": "7CB34B4798619F77C146AAB125FB65300726BA120F4F1B99756CABF4074F8CEB00FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624866755, "uuid": "065b7662-88a5-43f4-9352-ea149432c70e", "value": "3072:TNfo80uL2GCiD8qMq5hLh1L7LVP/9gQPcR:TNQIy5gMq5hLh1L7LVP/9gQPcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624866755, "uuid": "627720a0-40d1-4717-948c-dd3592ab8bb6", "value": 108324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624866755, "uuid": "5305250e-cbc7-48cf-b82e-a187e3899d6f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624866755, "uuid": "7d3d5d80-a899-444d-afa0-4693ee02c0bb", "value": "de032cc48321ab7d845d0871b759a142", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce6614f-d7b4-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624845790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845790, "uuid": "c011a969-2563-417d-b303-37c37dc86e30", "comment": "Malware payload (Gafgyt)", "value": "99aad2c4351b4a9f559b2aeba0c26d03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845790, "uuid": "42e77325-ccab-4614-a1a7-d671212666ad", "comment": "Malware payload (Gafgyt)", "value": "5cdf6d88b970af77615d0adfaae085168af0498f6dd7ac224d880f4340afacc3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845790, "uuid": "a0c8cd45-f26c-44a5-acee-9cd0009f622f", "comment": "Malware payload (Gafgyt)", "value": "bb7fa9ab14245bde39f6d92d34201bcd9e08851e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845790, "uuid": "8c8b625c-c364-4514-a540-6beff1b6096a", "comment": "Malware payload (Gafgyt)", "value": "cbd4afd92e53432d7b8f57914287444d513f622f889b19f69076e9749b0d9223df0a9c8ccc69e232244952be4b66fdf9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845790, "uuid": "24ff5698-b7dd-4b48-a9b9-0cba15fd22af", "value": "DDC3C63B67170E23C0CA50B101E34332AE75DE9B34B952D7AAD07D686F36A843856BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845790, "uuid": "5295e4f6-264c-4d1c-9320-8be91bd611b3", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqPEL7ymm/QMurB1nKGNb:SMQplVEamm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624845790, "uuid": "494f318f-d25d-45a8-99c5-43234d4de38d", "value": 129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624845790, "uuid": "de8381eb-443b-4a5e-9584-1d3dd3fc3266", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845790, "uuid": "17362bf0-991d-407c-a101-f84314d68331", "value": "99aad2c4351b4a9f559b2aeba0c26d03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f8e828-d82f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624898554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624898554, "uuid": "4d45385c-fc6c-4238-b351-7a0db99054e2", "comment": "Malware payload (AgentTesla)", "value": "d247af18d0d5371f9aa181b69c6bd292", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624898554, "uuid": "13bc3c77-7d0b-4890-a97a-dcf31d040347", "comment": "Malware payload (AgentTesla)", "value": "5ce6f6af37375fd20a6d300d5840e3f744ce58ddbab1cf9757193e2996969f75", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624898554, "uuid": "734b23d1-9243-4098-b103-3ab9ce3eafc7", "comment": "Malware payload (AgentTesla)", "value": "5e63409f407eaf2f6bb551d7f78549661350a640", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624898554, "uuid": "76aec9f8-060b-4e36-b736-a718133694a7", "comment": "Malware payload (AgentTesla)", "value": "999741e611ded7438af27c42655b2d49fa446488b370d78b0230680d45170659487e8d3f68c5ae181c528464dbc2609c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624898554, "uuid": "609fa3c3-d61e-4c01-8dab-2984a08d93e4", "value": "6655AD3D19BE123791ADD3898BC98C2FF840DA7B70117E7898D753A58706A8379D213E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624898554, "uuid": "7432dc82-0318-40a3-8b77-6b2ea6bd4113", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624898554, "uuid": "0f157a59-d0d1-4411-bb45-05c7fe954aac", "value": "3072:7lSqfUfxxsxp2r24ImUvVBpWu0d7sf3JpQuV7W7EI/fLsXzcgw7zHwgmKhgB3ZhW:oqAxopv4TEGuJ4uZhILsIg2MFhEVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624898554, "uuid": "48c8e86c-b542-4554-b524-0ceec629e7cd", "value": 1338368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624898554, "uuid": "75a50700-2e5f-4b30-8a9a-407b96ea7b60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624898554, "uuid": "76e614d1-b01b-47af-b3bc-d504e0dfa423", "value": "Request For Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d42ff69-d7f6-11eb-875b-42010a9c0053", "comment": "Malware payload (Amadey)", "timestamp": 1624873734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624873734, "uuid": "95261635-d495-42d0-9e81-1a1134b90cb7", "comment": "Malware payload (Amadey)", "value": "436176a81aae0a8ed31b535db05243db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624873734, "uuid": "09c94650-809d-4a66-9812-7f94fb3c76bb", "comment": "Malware payload (Amadey)", "value": "5de778debfe6b671f1e5a79bba69ae0ad6c92143509f9a94d1323a05ee0ddabe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624873734, "uuid": "3aa529aa-de1e-4d5f-99c9-4b98d8426824", "comment": "Malware payload (Amadey)", "value": "568f8ea46df4cfc5d34353f1bd98541bc217c1a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624873734, "uuid": "07e95bab-9d3d-4595-89dd-03e529d08ca8", "comment": "Malware payload (Amadey)", "value": "d1118c6fa9d4ba316c49155602398610ee2959e2af9f83bc5cad91069ee4ee02f35277547213e7f38f8931801acc26cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624873734, "uuid": "988c8e08-47e7-4380-a2d4-8430c5f85d7d", "value": "0AC36B72F1D18872D0790E7CDC5A92986A2EFE312D35155BB6E50E0D6D3A2C27D2C2D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624873734, "uuid": "2ac151fd-c386-4c59-aa08-c434419a5d1c", "value": "a02ab1a937fc1433a9abad7bc2badee6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624873734, "uuid": "2694a9d1-6675-4bdf-9379-f7d224a6b99e", "value": "3072:OeZmogDk+cPedGpqpm2pSBwkXWEfIvgpL2oAm9:OeZkgDPppvhfvpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624873734, "uuid": "abafd949-2667-465f-8980-0f9d66d00396", "value": 127488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624873734, "uuid": "f004d96a-0a89-4cd2-bbc4-4489a621d284", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624873734, "uuid": "e67d66d7-9fbd-4e65-8b86-15d37989d984", "value": "436176a81aae0a8ed31b535db05243db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce68489-d7e9-11eb-875b-42010a9c0053", "comment": "Malware payload (Amadey)", "timestamp": 1624868446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868446, "uuid": "aae0fee8-c3c5-4274-a231-6eb31ee9761c", "comment": "Malware payload (Amadey)", "value": "6072ffa2e78a14d9655d436e2178e5c3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868446, "uuid": "ce12446d-27dd-4654-9295-46b06c940338", "comment": "Malware payload (Amadey)", "value": "5ed5d0c108109f37d683bbfc81db522a2622269d9ef339b963cab3ca3974a517", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868446, "uuid": "92375dfa-e51c-4dc5-b198-77b30f256c77", "comment": "Malware payload (Amadey)", "value": "554ce2c13d5eff616a56b66790ca251a2f65789e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868446, "uuid": "9c1a4b30-4dd9-4307-b7e4-e8271383037e", "comment": "Malware payload (Amadey)", "value": "24d8ede8260f14e5f4833a81171af8bf1507829ca4c3e5fb5375f7aa40b71a7b3106d58ca762eb6932c83ed3efe69f84", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624868446, "uuid": "48131133-f3cc-4e78-84f9-b417ebac5ac1", "value": "C6F513B332205155D4D4CC329927BDA732F62F3B8E429C796ACA7DCA25210E5D217FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624868446, "uuid": "70bc4810-9023-43a0-bd81-373c3d3bfa20", "value": "5b05faa1e3cabad37c86cad478e55916", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624868446, "uuid": "39a305be-4031-4b7c-8e18-c8d0f8f198e9", "value": "98304:yPtF7X5GyEtiu11rcTVr6KbMs4c6LnbryS:Qr7p6lQN6c6LnyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624868446, "uuid": "870089d2-1979-4427-8bc1-926e7ece1272", "value": 3610112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624868446, "uuid": "6c7a4be8-803f-462f-85f5-2d39f55fbd99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624868446, "uuid": "c6b02a37-f362-4f84-987a-b5b8e0b26c93", "value": "6072ffa2e78a14d9655d436e2178e5c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be58663-d819-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1624888765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624888765, "uuid": "a618dacc-d706-4506-9211-e7d6463317e9", "comment": "Malware payload (AsyncRAT)", "value": "5a9d5a62f44882e103dd0ef3eea3df52", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624888765, "uuid": "4b3aba58-ee8c-4d53-a75e-d219eea96d1e", "comment": "Malware payload (AsyncRAT)", "value": "5f037d9a6d3232b001d501328a679dd7966b61e70de6a89ca03ede1818fc120e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624888765, "uuid": "f7532184-729b-4288-b344-5e70f6761d50", "comment": "Malware payload (AsyncRAT)", "value": "1d437032f1899d0c7e78cbd0cf3e1b481dee8113", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624888765, "uuid": "fd66b9b4-bdd8-4202-9739-9188722e4397", "comment": "Malware payload (AsyncRAT)", "value": "1b740e0046e40dfcb9600c7bcbd0096f0533473398fac2900812907054470ddb7bc37ffc765dc9fca8f2ee810669aa34", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624888765, "uuid": "60826237-6a4a-4d5f-b79c-dfd849ea9c10", "value": "9E946BA95C218595314EEBB0AB13C09DD63570E3A6FFCB5235D40A1C54C9FBBCB0E92A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624888765, "uuid": "7f7ac99e-1709-45f8-9f13-2b6227502611", "value": "3072:flJBAeZnSSS400kZo0pQMvQuDxsSRS/SPlSRXNJ8yAA3X82JqbWiyYs0CzkA0XHX:zLGSipElGLf9upis0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624888765, "uuid": "98dc8e32-e487-4126-bec7-e74b66561017", "value": 440010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624888765, "uuid": "29164ed3-8839-4b9a-a082-5dd49ac388b9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624888765, "uuid": "571ef3cc-1ae2-4b75-b1e8-a8b77d152294", "value": "TripBrief.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "954f0119-d7db-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624862366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624862366, "uuid": "6d839d4b-ea6c-457c-a703-198e7a298056", "comment": "Malware payload (RedLineStealer)", "value": "8f584186277856e76a67c56cd018ae24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624862366, "uuid": "47f96bfe-0e46-4095-af98-885aea604b6e", "comment": "Malware payload (RedLineStealer)", "value": "5f737f1b5a908056939a3a813db4ed653b887c4e67fc19fab9cd72a9a3c748da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624862366, "uuid": "dd1dbe5e-532f-4141-971d-4d364fbbf5fc", "comment": "Malware payload (RedLineStealer)", "value": "92d25efa4eab7588a5b4301f14b6d20913b6badc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624862366, "uuid": "4e1de65b-873e-4197-8d09-9e9d3c0c2aa4", "comment": "Malware payload (RedLineStealer)", "value": "3a8923f885f8c19b4562a3ebb07f2d2115e0ca9302bc05424da394fc217d4bccf2b319c09011f5ac13f7215ef3306d30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624862366, "uuid": "7f5658f9-b94f-4262-aad6-cec5dea4b53f", "value": "354529D3E7A25C02D2B71B3DC9D9A3347E69AE82151F4E1D20BDF6C60522502FB50F9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624862366, "uuid": "ab8908ea-f224-4748-8fda-2b2211d82815", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624862366, "uuid": "d2b486fe-8e60-42ed-a2c8-6c49443b4b00", "value": "24576:sXEkX+Gzdeka6cjbikDKXKYTjsXLxU4gtr:OFvpuLYTcCXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624862366, "uuid": "2df8e76f-d1d1-4449-9ae1-bb08e9dd4819", "value": 1240064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624862366, "uuid": "f1cae747-157e-463c-8580-2753430a8906", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624862366, "uuid": "1b1aac55-2b35-4818-a76a-05df4cc50e6f", "value": "8f584186277856e76a67c56cd018ae24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde2229c-d85a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624917034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624917034, "uuid": "49282aaf-cad8-409e-872e-a12359862658", "comment": "Malware payload", "value": "b35d6c2090048a6fe2c4e5a0834713e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624917034, "uuid": "51dea2a9-a0a8-481f-be2e-c5b2e5f11a9c", "comment": "Malware payload", "value": "5fd7e3ad5c9088c5b2d86d5751ad2e727006ab32ad9345bf6101bba6610117ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624917034, "uuid": "994d6b69-919e-41be-89d7-b843b99dcb80", "comment": "Malware payload", "value": "0a8cecbf8a0a7bf1fb903b08605739e77f1b353c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624917034, "uuid": "449c4b48-6c5c-4b04-b69a-4bdc58d09f6e", "comment": "Malware payload", "value": "65e12eea185ab722af8c0ba7c130f24fc1ee8dfd7c165c9a5f2601968fa7c179f7b9da0adf2fb979c1af1365f6bf8ebe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624917034, "uuid": "b37ea335-8260-47fe-9b1b-eef65c03208d", "value": "8CE26E069B4405BEE00ED93FE3D28531DF329B9F7A25EC896D7E92FB06152830598B1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624917034, "uuid": "35e363fe-1879-453c-abb3-d39734ffcd22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624917034, "uuid": "c8b1ad84-693b-4663-9704-08826bf29fd3", "value": "768:cuYxQZ6++hIduJJ1U1NCOLtuEYzob6vWccgcccI5BrZIYaF/kgWzC747/SPD4uCS:cuYxQZ6++hIduJJ1U1NCOLtuEYzob6vG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624917034, "uuid": "14dcbea8-1ab3-4a81-9fad-a43c3ba0bac6", "value": 32544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624917034, "uuid": "3b53bd6b-5522-4fd1-9fad-9e0d9a0bf4c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624917034, "uuid": "f3d6683a-7dc9-4595-8ea6-06da5dbdc0e7", "value": "Wire confirmation.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68223111-d83a-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624903093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624903093, "uuid": "9742235c-8bb8-4fcd-9b28-789091e7c727", "comment": "Malware payload (Mirai)", "value": "eb98a4ea0cdc4f0304f16ce3fc28be93", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624903093, "uuid": "fd337c10-2349-450a-a6ca-2a918d469e29", "comment": "Malware payload (Mirai)", "value": "60c8c3d94c9a331e2cdcc9ccaf61c9d4220c847f9379c54ba9e39d9e707db3c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624903093, "uuid": "f18dd6f0-f48b-439d-8a52-aac3a76a0af6", "comment": "Malware payload (Mirai)", "value": "99c12ccbd66898b5481d375fed8ea1cde2b13f2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624903093, "uuid": "02031e5f-e419-4c4e-89ee-f328399576cd", "comment": "Malware payload (Mirai)", "value": "81696b00cf3542a2b98002c141460ebe144dc18a20b7687db7fb1c0f3ff4c109885f1e8909eb389c1ce2df420b0d7dec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624903093, "uuid": "c101a2c1-93a3-404c-8869-6134e7e07409", "value": "9EB2E1C5D6EA2BC3C3A29336D0BC5A8DE27216C00346451E510D729FA7A760E5BFB3E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624903093, "uuid": "f8c6e4e2-7c04-47d5-acff-fa053edc3ab8", "value": "384:MUDKKQOcRpmYLdn6RBOFRFt5rUFX1DiSIlCo3AnupCFNqnrrd1NEZgO8UXWozPLU:p/QOC0Yhn6ROHWFlAcwNEFCnNBxchcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624903093, "uuid": "baa52cdb-0011-48a4-92e5-c4495b03c482", "value": 24720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624903093, "uuid": "257e5088-6543-4698-b9dc-967657297f9c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624903093, "uuid": "fba52d2c-4a5e-4638-9c23-e26fb15e720e", "value": "eb98a4ea0cdc4f0304f16ce3fc28be93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2df647-d808-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1624881492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881492, "uuid": "c720d98d-e77c-4b0e-88ce-3482695f33d0", "comment": "Malware payload (AveMariaRAT)", "value": "1817f0a3ae844ca17d0bd99bc6317fa0", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881492, "uuid": "7d522530-5668-4cb2-86f3-d21469b724e8", "comment": "Malware payload (AveMariaRAT)", "value": "61f6468ed95ae06fb50141c97dc5e585801d90f861fe5d5bb0d7fe68e01a395f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881492, "uuid": "91311ecf-736b-4c36-a4a2-987dcdf6a249", "comment": "Malware payload (AveMariaRAT)", "value": "9c5358b8e8d057be474b426f8912555d692a83ed", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881492, "uuid": "97fa17c6-e83c-4c57-96c5-c015fb2b0db4", "comment": "Malware payload (AveMariaRAT)", "value": "8a78dd5846159ea3976bf585b988d90e3a31ac454bd9dd83b5853a5eb6f4aa5db4faf09614f1af81fc8b612a355a08f2", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881492, "uuid": "1e506add-6075-480f-a305-fe0683fd9b6b", "value": "C8B39E13F7E54835F3B201B01ABD7E6ACBEDF9701628C49FA394854B2D31846EA25397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881492, "uuid": "8bb7581e-815e-4d1c-9e3a-5c3f011a980d", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881492, "uuid": "1ce0c2c5-61b6-4002-b291-a2c1f904baa2", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01N:K1VmhaH8EFvW+0OVE0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624881492, "uuid": "c0ce6f3a-f34a-46ef-a5d8-7fdbb3a56953", "value": 111662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624881492, "uuid": "e7f3ca77-7491-48a7-a738-9d0495f4b3f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881492, "uuid": "40377709-05ab-457b-89bd-0b4475909156", "value": "1817f0a3ae844ca17d0bd99bc6317fa0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc16914-d7e6-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624867051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867051, "uuid": "87c1edea-f20e-44cb-8544-2f3602bd4a36", "comment": "Malware payload (Gafgyt)", "value": "72a2a066208d8627cb5a9beaa9461711", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867051, "uuid": "0c5d6664-eddf-4414-9c74-10bdaaada4f3", "comment": "Malware payload (Gafgyt)", "value": "64e774dd08490c332ebcb4d3083ac69aae1a51e18019e4b7ef697086553cbdd5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867051, "uuid": "02b772ba-3f52-473e-9a9d-f3448b61fbf7", "comment": "Malware payload (Gafgyt)", "value": "96e775e41b53bc64c8e853bb6feb9d6d5814e7c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867051, "uuid": "6925bf69-8065-4093-a030-eb01ead61601", "comment": "Malware payload (Gafgyt)", "value": "6497861cc7536310776bb20bd5547126097393edf292d26fe251fb7c76ecd3eef5452387448bfcef870dde4fa2e8db73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867051, "uuid": "28dd8139-20b1-43e2-9d87-a5206d8a6ac0", "value": "A6A34A82A740D6B3D05306F6119B9B190133FB3F5A2BDEA6F36D3CF48B519817221B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867051, "uuid": "ba8a738d-43c9-4ec5-915b-8d57ea181086", "value": "3072:gFELpWzUjUQ9yejpy80JPKxBUa5uvZ5h9OP/txi+GVOzByoQSbb:DpA0P9yejpyfANuB5hIP1xi+GVOzByof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624867051, "uuid": "e778b8ac-dd79-4744-948b-8b221892835e", "value": 99306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624867051, "uuid": "94b34122-36d9-48ab-a9b7-86a6c45ce681", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867051, "uuid": "5d70713d-2141-420a-a9d9-784abaa59bbd", "value": "72a2a066208d8627cb5a9beaa9461711", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c90190ba-d800-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624878344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878344, "uuid": "ffb599da-0918-4d33-b532-e308008f95ab", "comment": "Malware payload", "value": "ae6eeaa09f5fa4c937928430c397b1ff", "object_relation": "md5", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878344, "uuid": "e9e78db0-12d7-4f0b-85f5-89838cf64034", "comment": "Malware payload", "value": "652ee7b470c393c1de1dfdcd8cb834ff0dd23c93646739f1f475f71a6c138edd", "object_relation": "sha256", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878344, "uuid": "0de47028-a873-455e-94c6-ddd1ab74b209", "comment": "Malware payload", "value": "5b231b4d834220bf378d1a64c15cc04eca6ddaf6", "object_relation": "sha1", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878344, "uuid": "d31dce0f-1a5e-46c9-8163-e9e7aebd23e6", "comment": "Malware payload", "value": "a4fa29340e8edbee689b4e2a862a3da95e840991574bf5035e19fa83f08f361a53c26580482def055eaa6da98a481165", "object_relation": "sha3-384", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878344, "uuid": "1a1303aa-e80c-46f1-bf85-0fde53d37736", "value": "D611CC1060E740E9064534EBE81D750879A940FF7F988636B56D2D733FEA1208B1E638", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878344, "uuid": "56ba69df-0848-4e2c-ad4c-00fc28ef340f", "value": "24:Q4CAIkHY+dRmsNprjJcRWkJw+JKyRx3e0NQL:3C+hLjJyWkJd3dqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624878344, "uuid": "38279a36-1781-4570-a72c-0f1d43cc3d25", "value": 1110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624878344, "uuid": "a97f13a3-fdee-4b77-8ee5-bb0927d5185c", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878344, "uuid": "0edfda12-35fc-4711-bf1d-fbaab096394a", "value": "652ee7b470c393c1de1dfdcd8cb834ff0dd23c93646739f1f475f71a6c138edd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb8022c-d7ea-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624868660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868660, "uuid": "4a94df91-87e6-481b-b115-0b4641777387", "comment": "Malware payload (Mirai)", "value": "db74733d1f189dd1ded9740d79ac3d6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868660, "uuid": "6fe2d061-fef2-416e-85c4-b74dc302875f", "comment": "Malware payload (Mirai)", "value": "654986d2734a3c3a3180c90eb43ca915183350e6674a76fc2d56b79c893f962b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868660, "uuid": "580552a5-1664-494b-a301-ff628497ec66", "comment": "Malware payload (Mirai)", "value": "83d82873f73ef214774869e797642719dcee0b1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868660, "uuid": "e7f2e012-7920-4d63-bf19-090c0b132f82", "comment": "Malware payload (Mirai)", "value": "e6a1e30822ee8807406044bdd78ef1f1fc026064a716ccc5929cdeba63dddb4496c087a2a7f54e6c288d983ba5fd56f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624868660, "uuid": "eb06a45d-d3f0-4363-a3cf-592bf01fa846", "value": "EFD24A85A5D3E9F7FC5149F230A3EB72CB32F139605AEBB3E35895369C02205A20725D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624868660, "uuid": "79ab3d9e-7447-4d7c-98f1-dc44eed27d9a", "value": "768:CVHSeA2mQbH70VIj8CRgXlwJ1H0c4PvgFl:CVyeAHyMIRkloHaPvgFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624868660, "uuid": "af92f79a-6f90-459f-b4a0-8f053dbd7dc8", "value": 30832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624868660, "uuid": "18201e01-7fa2-4eed-a70e-5cea7d922597", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624868660, "uuid": "e35afcf7-3cb8-4a65-bdcb-fade1a5b3dc7", "value": "db74733d1f189dd1ded9740d79ac3d6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34fa4ed-d7d0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624857692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857692, "uuid": "29497857-8ddd-4c06-82d2-f3d7473dfda8", "comment": "Malware payload (AgentTesla)", "value": "4513c2dba051f13dda14de8d3105b26f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857692, "uuid": "a151f529-dfa4-4cbd-a3ce-8f73acd25880", "comment": "Malware payload (AgentTesla)", "value": "65860d0a646d04a02071464cb18738e8c9f8e029be1c7f5ff3db4652cece7618", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857692, "uuid": "44ee6a8a-a1c0-476e-b870-0d5247423615", "comment": "Malware payload (AgentTesla)", "value": "ff84c4ab44d637b63fa1ec0c497804431ab365ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857692, "uuid": "e71c7b5e-839a-4a2c-8a9d-5f256280e944", "comment": "Malware payload (AgentTesla)", "value": "58d6369ffdfc4c3e712163262f8c4c201235bd11f90b67867bcc9787f4b316116e388333d52b30b568d3e93220c741ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857692, "uuid": "f96bb088-80f3-4b87-981f-05da5f7d9b8e", "value": "DBF433CF2B939B43686A7770887FD08BF7181AAD51C2A541A774043AC64377CFA639E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857692, "uuid": "d858dcc9-9773-4f4b-be38-1f58db58314c", "value": "12288:xkvDl8J4SDEO7rdESfjlbs0K5yrWvJnils+CQnPvtgPo5XjWMoczKFIDXrauj:xilK4fO7BES56mWZiNnXIUXyYXOuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624857692, "uuid": "7566099a-91e0-4f21-abd7-56dc0c9569b2", "value": 757062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624857692, "uuid": "a98e7cfe-4bf5-4515-9d75-746f221fdc93", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857692, "uuid": "d42f2a2a-5469-46fe-9290-72af05432b83", "value": "proforma invoice.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d41c384b-d839-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624902844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624902844, "uuid": "fe9a7cd7-074d-4db5-b419-2be5cea411ac", "comment": "Malware payload (Mirai)", "value": "3a3e59ee9abd6ed48c5cfe754401c00e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624902844, "uuid": "f9d75f78-1fd5-4926-a493-9371ded34cb4", "comment": "Malware payload (Mirai)", "value": "65da40347d39e2a95fbf3edc0481f592f6ebf15a9370e39511a2ddaeecce58be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624902844, "uuid": "0eb4816f-c787-4834-a7ee-10c2a8374ad2", "comment": "Malware payload (Mirai)", "value": "2063a95c503177d6cb059714b37ccac628968010", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624902844, "uuid": "c96bf817-33bc-4866-a185-f05ea73b0a88", "comment": "Malware payload (Mirai)", "value": "50e17df7fe93ec91f734f0fa1d487fcadc936b4c673759bd70c0ca68685349bf483ce9fe49cbeabb9ed960ff9dec9665", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624902844, "uuid": "c2ce511b-37b5-46e3-8134-3d265bc52b5e", "value": "59A2DF1821CDEE32D170943AE23CC347AEDB87E652FE312A1E080BD9E49490AD37E945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624902844, "uuid": "2d3ccceb-b081-4da4-b612-1587992f2a95", "value": "384:Yzmog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbshymdGUop5hX8:YKoh/DxCvhdR4IjWVFbSws3UozJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624902844, "uuid": "ea1028c0-5147-49fb-a1e0-3631de7ddd5d", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624902844, "uuid": "c361a683-7249-44af-af3d-2be4b55990fa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624902844, "uuid": "28d03287-539e-49b2-ab7d-525ba9b4c370", "value": "3a3e59ee9abd6ed48c5cfe754401c00e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c29325-d7e7-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624867336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867336, "uuid": "9f9adcec-85d0-4cfb-9b81-b1ab885a93e7", "comment": "Malware payload (Gafgyt)", "value": "4c0bb56e78a9c97a75eb7863fd400049", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867336, "uuid": "cb18552d-5422-4a0f-99b7-17d83cac279b", "comment": "Malware payload (Gafgyt)", "value": "6638766718600d2bedc74353aa416fb7a9d9094eec331fea0a72d8b32e3bd125", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867336, "uuid": "c5256437-0540-4244-b92a-957252ccf70e", "comment": "Malware payload (Gafgyt)", "value": "6d9f982b5eefb755fd97d4d3c6edff663865d0d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867336, "uuid": "c98eed01-3c38-41dd-9aa2-6b79c863afcc", "comment": "Malware payload (Gafgyt)", "value": "b71220c7962a68a2e30ce85b68a33eb7be276e8b94a8e95e7120a7f1496bd298bb94c3bb8fac34d3efa3946727bd10d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867336, "uuid": "c9e3472d-7884-4c39-a1b9-95cedde305c3", "value": "5F044A05EA408B57C6E22B7AF79B438E73239B5467D733154928ABF03FC27995E36011", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867336, "uuid": "2cb1f0e4-950e-4180-82e6-7cb34bafe856", "value": "3072:hz9Ek4wvRKrZel5mnTTWaa/gu66ddmrK30HyWKn45hLJzTx5VM/90DtcsMr6m6wb:3mXWaa/gu6edmbHyW75hLJzTxfM/9EtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624867336, "uuid": "17d2557a-8cc9-4b94-89c8-cbcd3edf66e9", "value": 179612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624867336, "uuid": "40360cf4-7312-4d69-9f33-8faceba2837a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867336, "uuid": "38839226-e50f-4e6f-9e8f-e2f2648bf2d2", "value": "4c0bb56e78a9c97a75eb7863fd400049", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94af7ebf-d81b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624889853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624889853, "uuid": "f733a3df-3234-43da-b0a3-25397d121674", "comment": "Malware payload", "value": "d11cb78189ae4d88ed5346eb61b5bfb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624889853, "uuid": "7e404efc-aad5-4023-bfd4-bbab38f3a9ae", "comment": "Malware payload", "value": "66b63c336bde81c55cf38f9736817d1878d4c32db4c6d0aedb2726dcbf88afad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624889853, "uuid": "1250fc3f-f4f0-47bc-951d-bb7264d6d4ee", "comment": "Malware payload", "value": "4df85ba6788528008cadf9bd391dff58403dd808", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624889853, "uuid": "3783a062-7d4a-4a15-9e8d-34f762477deb", "comment": "Malware payload", "value": "b48e8d0e75f9243ebc336d4a1c3cfe4297559db6da87f9d95e99a57349444f4a27b9a8e95a0d102f2e407cf57c0cf975", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624889853, "uuid": "88b9cb0c-a0aa-41ba-87fd-5c45c070a58a", "value": "AF552356A798A03AF9EA0EF1DD62234764B7EC511230D747E3A3BD8EBD34041CA15B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624889853, "uuid": "31d43561-6580-48c9-97c8-2bfe17dca928", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624889853, "uuid": "b3a5b1d1-2ead-45ee-9eef-c723d7a820af", "value": "24576:ZD1ZAqraU2tMMeGAkoZFrmrSd35DdXZOo+lH7FrIY2sqXXXRy2b:d1ZAga2iEmmd3hdY9lH7Fr7qBy2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624889853, "uuid": "e3e4bb6c-df4d-4f09-8a6f-90d106d2e17c", "value": 1292465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624889853, "uuid": "a4da6daa-1d89-4ad7-b36f-44c63c64529a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624889853, "uuid": "73da2473-b12e-4350-b929-3498cbfd44ef", "value": "d11cb78189ae4d88ed5346eb61b5bfb6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db0df76b-d802-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1624879234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879234, "uuid": "98fc44db-43a5-4e5c-a078-a7c19153bd44", "comment": "Malware payload (CryptBot)", "value": "7cbf7ae8143f1ac7bc49afb9b1819a58", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879234, "uuid": "f616f65b-0a42-4fc7-8eb3-a66b6dcfd146", "comment": "Malware payload (CryptBot)", "value": "6743545d37eec634a1bb706f966a9da079d83d2a12274fdcb4acb505828cde24", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879234, "uuid": "fa5f497f-4e10-4e65-811b-e24972f11901", "comment": "Malware payload (CryptBot)", "value": "6cc0190c62f301acf49ca32cc00d44f07ef0a95a", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879234, "uuid": "7d716ffb-e726-4d7f-8e5d-46846355fba3", "comment": "Malware payload (CryptBot)", "value": "d958356f3fca4751d4a2e5317644ed2006496b9ff9e92e7d97620c39d26d887cf61b965be62cc230c6d533d0e55028a9", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879234, "uuid": "b918b6dc-27fc-4f23-af44-31a33bcbd628", "value": "7005F101B691D036F5F711F959BAE368A53D7EB0472410CFA2E52BFE86746E0AC31A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879234, "uuid": "357b9c60-4d65-471a-8a9f-733a86a33e5e", "value": "203005f6a9207faf3149acf4bd59a7bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879234, "uuid": "e6e261d8-8c84-45bf-b66f-48868c0939d3", "value": "12288:AS48sA2qwHhmQkHptbhi6SCSU9EnifIiip+m8LdDkXCSY6KV6gwQMT9wkHTAuPul:HT2zHhgptbpS2Ui15m8r7wtukzhuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624879234, "uuid": "240c6f90-a878-47f7-a068-598f7c3349a4", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624879234, "uuid": "d1aaec00-0ecc-4f20-aa03-cfaf6635b2ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879234, "uuid": "e1acfc7d-8086-41cc-b3a4-a5b332db7b42", "value": "7cbf7ae8143f1ac7bc49afb9b1819a58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d35cb9-d818-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624888511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624888511, "uuid": "c214bbd7-e6ac-467b-9bf8-1e0f4c1e104d", "comment": "Malware payload (NanoCore)", "value": "b1f301d396c7b894e5cb0313b01e00b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624888511, "uuid": "21ae2e0b-945b-4ce8-b9e7-48a63c8cb42c", "comment": "Malware payload (NanoCore)", "value": "67b6c2763a40c91b2909cb735944c99f1d4c77e4f29fd331ffcb5677779f88ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624888511, "uuid": "b451df90-ea1f-430b-8139-15f7842ea8e8", "comment": "Malware payload (NanoCore)", "value": "ab4fbeabccb9be19a571b1a16a353dea161817cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624888511, "uuid": "c8ef9d3a-ae87-4c06-8bce-1fbb8863c152", "comment": "Malware payload (NanoCore)", "value": "555b9dc77caf1714a928cade0df61ff55019b5bf74d69b2842edb84a65ca41c7469b68a0b90592e700594dc77880acb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624888511, "uuid": "822a3b0e-6ca0-427b-8934-7812a8bd1eb8", "value": "6E15E1347AF69409F237AF39CAD82095DBFEF6633603C91964A5128AC713B03DD8196D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624888511, "uuid": "3aa923e9-2c73-4b9c-ba76-a9b0ad55c722", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624888511, "uuid": "bb43b72d-cf25-4217-96ba-70eda6b6498d", "value": "12288:ZfmR8TBNwvSWOigRv2bzGWSE5DfWIpNUNa/D8PMfYK5w/FEiJTXo9GMfrVlPlpn:SIgVj2hEpfieoowtDo9Ggf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624888511, "uuid": "2c5cca7c-33f1-4c5b-abe8-20475bde99a9", "value": 912384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624888511, "uuid": "bbc04db9-9c70-4336-b5ef-b46da8a4bcf7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624888511, "uuid": "8070153c-e76f-4c5f-8f85-8724dc0078b6", "value": "Proforma Invoice20210625.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77661176-d7e6-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624867041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867041, "uuid": "e1f74a3b-444c-484c-a4b0-f41faeb7c451", "comment": "Malware payload (Gafgyt)", "value": "68cf719b7e8915677d876bb0b2ab7346", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867041, "uuid": "1a544e18-5ee3-4b1e-8a98-2bcca83bce12", "comment": "Malware payload (Gafgyt)", "value": "67ce92cb6cca2889c6a847f7f0029f8eecb9282ee3a5289130770a5c185de4c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867041, "uuid": "2bd0cef3-5a06-4eb9-b63e-c42aa8ca8d3b", "comment": "Malware payload (Gafgyt)", "value": "bbd9f6d550d14d5ca91412c2f5a89994b784b26f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867041, "uuid": "9e8955fc-e0b9-4ee7-958d-84c542d54208", "comment": "Malware payload (Gafgyt)", "value": "a2b6d5700c725adbbb021723535abdf8890b6c13cf0ab37c8fbde159816b83f161f05518f2bf9bb4159b39510b43f82f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867041, "uuid": "4895c9a5-cdd0-4fd5-97cf-7d016b227b10", "value": "15E3A51B7B619FB3D81ECE37069A4601108CE55A02E97F6BB2B4C51CE78B94F09E3D94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867041, "uuid": "9d412d9e-daf8-4eae-ba10-7f64a3e5ce82", "value": "3072:YQW+0ZrzKFZ5hdTWaUf7RGkSF+1GPSe5R:YQWzr+FZ5hdT/Uf7RGkSF+1GPSe5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624867041, "uuid": "d03f0fe7-02f1-4b59-a232-45041055675b", "value": 154114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624867041, "uuid": "c8210330-cd0d-40ec-996e-7c20a1c35677", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867041, "uuid": "ed7c26ac-8806-4de4-871c-9a2e3ec4c77d", "value": "68cf719b7e8915677d876bb0b2ab7346", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d9c971-d7e6-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624867030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867030, "uuid": "057d5945-0dc9-4614-a89b-3900ece3ab36", "comment": "Malware payload (Gafgyt)", "value": "d75eb74b37b530baada46eb17e887f5f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867030, "uuid": "a6c1506e-3ff6-45f8-99d2-91e4d8210edb", "comment": "Malware payload (Gafgyt)", "value": "68023ec1632a8548ccc6119b3d9b91bfac55c3ffde19961cc7cdbbebca8a8f2f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867030, "uuid": "ff0f26ff-0e33-4455-8060-7c95290173e2", "comment": "Malware payload (Gafgyt)", "value": "f81337cd61de24fb7183c586e3075d8d3077c235", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867030, "uuid": "af84a285-7a54-4423-bc11-57cdfab094e0", "comment": "Malware payload (Gafgyt)", "value": "fc210fbf0441885e7706b3bca52b8227f94c6cd3722d6e24f64032cb1b860b268edcc2fcbb31a8ad083f6305d2c94168", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867030, "uuid": "38c21e0e-efe6-450e-9e3e-460ef27699d5", "value": "4EC30805FC404727C7E22BBAF79A43CD773566586BD73321AA295EF02BC47982E39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867030, "uuid": "349eb2fb-0d4d-4d4f-b258-94e2998ee914", "value": "3072:Z7bYA0gsIXa9uuc2tJLkRoHs/vzf5hLc+WokN4hFeOa/R+qQlDCOdAPIR:HRoqrf5hLc+WQer/R+qQlDCOdAPIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624867030, "uuid": "9108b4d0-c6c3-4d08-a7fe-c98488f38fe6", "value": 120151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624867030, "uuid": "0e87127e-e60e-4ea1-b47c-515758d43373", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867030, "uuid": "abda077e-2492-447e-b967-af994b6983ae", "value": "d75eb74b37b530baada46eb17e887f5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8682499-d7a3-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624838400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624838400, "uuid": "6d2f37f0-55f2-4750-840a-edbaee162ae3", "comment": "Malware payload (Mirai)", "value": "60ed718948bd68f7a0f664cd7648d1c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624838400, "uuid": "3f735681-6346-460e-8b74-2687004b3221", "comment": "Malware payload (Mirai)", "value": "68607385f1eb79e25bb9a4a5f59cfff4f721277704b7e2d1c0228f623933b525", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624838400, "uuid": "d08d44e2-2c98-4007-a070-9e5657d2b6e8", "comment": "Malware payload (Mirai)", "value": "b3d0036bfff76edad7cfe09b1818e9594f60e1c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624838400, "uuid": "9c1f2e15-f517-46b6-aa46-70d7a0c55cbf", "comment": "Malware payload (Mirai)", "value": "a286792cae3f40fcabd9a12c555d528195b1457ddcae15e7c44565d634177ab3842aa20226051c54c3737f83eabb7434", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624838400, "uuid": "ee6a9def-4674-447a-b85c-ebe342e383c7", "value": "3EE34A42EA408E13C4D51B76FAEF41493322D765E3DB73078D185FB43F86A9E0E62A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624838400, "uuid": "20f25f29-d47a-46ed-bac8-dcaf19cdad84", "value": "3072:walgM69pe0QmlTvIUdt9mrsplDKZUQQBKXAVanXX+F8JyvSPhLZ85iBMR6yoC1QP:walgM69pe0QmlTvI8t9mrsplDKZUQQBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624838400, "uuid": "9d08b194-f32d-4147-89a4-6ef94f7f83c2", "value": 145189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624838400, "uuid": "3cb76ca7-b292-49e5-9e05-f09a7d33dede", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624838400, "uuid": "478ad5ee-608b-4872-9496-1cbe831a8f83", "value": "60ed718948bd68f7a0f664cd7648d1c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0425185e-d7b5-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624845802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845802, "uuid": "96fcb271-3d12-439b-a902-c4d7cffb5837", "comment": "Malware payload (Gafgyt)", "value": "b793524ff48bdaf58c96b13ab01ac2ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845802, "uuid": "1ec2b095-e398-4e30-a564-afe434d8c74c", "comment": "Malware payload (Gafgyt)", "value": "690c5b8276b22612dda254936a8862630e16174bcc4a61e7e45ec04e1afb0bf3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845802, "uuid": "51410aad-d74f-48c4-b575-0c5d138c6eaa", "comment": "Malware payload (Gafgyt)", "value": "5bb2e6010c16cf0d80abfc12bcac7876b504499e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845802, "uuid": "233ca98b-d914-40f4-9b14-745549acb62f", "comment": "Malware payload (Gafgyt)", "value": "8ed4cbcbfbb8f5342d6138d1daadee7cd8108dea48470fc399f2d9c4cd40b75bfa6922a38278acdfd32ff539f38bdd67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845802, "uuid": "bf2334a3-c947-49d4-a1bb-edee3351a103", "value": "FCE3A53E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845802, "uuid": "87ce03db-4f62-436d-b02b-f82267490f6c", "value": "3072:JW6dm9tS1aRGQdK76t/zCeI5mrThPaLEnvPrNb:c6IG+LCPmrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624845802, "uuid": "9f90f45d-8757-4a76-afc2-021f5aa9d4db", "value": 155428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624845802, "uuid": "cfb35613-9f17-48dc-a1ca-4d0cf2dbb6d2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845802, "uuid": "ebbb8674-8c10-434e-bf04-a8262b8609bd", "value": "b793524ff48bdaf58c96b13ab01ac2ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d224e534-d803-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624879648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879648, "uuid": "27d61ec0-fd47-4d6d-b14f-f0f83d702241", "comment": "Malware payload", "value": "ba7d82ff5ddaa55e206e346bdfdf2872", "object_relation": "md5", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879648, "uuid": "868521f1-b2d8-4147-979f-e2b5a56f1408", "comment": "Malware payload", "value": "691afd4ef5f33d99053c57456ce9fa126e29d51d4dd510928193d8c3332547b1", "object_relation": "sha256", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879648, "uuid": "0437b473-5598-426e-9d25-95bf12de9db3", "comment": "Malware payload", "value": "8fc79950d628ec81bc04bda01dd7aa4868c8259e", "object_relation": "sha1", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879648, "uuid": "08420de4-363a-4d09-a35b-346810f3fd63", "comment": "Malware payload", "value": "a2aeb97f491803a73f87a7319a1e370fa3fd9829e73870e24d624fa5893a8851e6384c0bc05c7c34aac145a59a471ee4", "object_relation": "sha3-384", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879648, "uuid": "2561e682-7f14-417d-9db8-f3cbdf1ea2f4", "value": "4A418787BC4D49742011C139B6C4AD20E29EC05F99C39B28B17FC39C2FC4558E3EBA5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879648, "uuid": "b451a7ea-87ab-45df-8c26-ad1e69c983c1", "value": "48:37Aipd/bz8vVYAaPTr61QIwrXWI/K/HU5bcCJNncL/XlpkfJRL/XZ:caHWVbI4PIbccuNpkfJlh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624879648, "uuid": "cf28724b-a224-48e6-a072-3a68df48ad8f", "value": 2346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624879648, "uuid": "8f0b24ff-bf57-4a41-b4d2-76815f28396a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879648, "uuid": "eede5f5b-1ef8-427a-9b08-5510c63a09a3", "value": "691afd4ef5f33d99053c57456ce9fa126e29d51d4dd510928193d8c3332547b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9174f552-d806-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624880828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624880828, "uuid": "33ac5c7e-59c9-4e0a-a0b6-c494f93f2e9f", "comment": "Malware payload (AgentTesla)", "value": "7c0803fba1838e2d97452449be48dfa3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624880828, "uuid": "2c3fdf20-cfd3-48ba-b57d-a1717ca5d52e", "comment": "Malware payload (AgentTesla)", "value": "69d6ba4ed00ec8b1990fd34b31f2b7abba0e3b711e85a9f0bc11276325d5ddb4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624880828, "uuid": "6ba97c4f-fb0b-4910-8439-30846a129989", "comment": "Malware payload (AgentTesla)", "value": "7ae007d4bede4f8f751d70f68d63130388f5f8e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624880828, "uuid": "1ded9532-218d-4d75-9861-a8a2170b566a", "comment": "Malware payload (AgentTesla)", "value": "0e4736859c42e0fc3e88a593809eda86be21cb1a0208c55d5135c2d28797c3a4431794a04688a55bb760a7759e3636de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624880828, "uuid": "1fc214d4-5626-4dfa-af89-2104c0c7532d", "value": "10457EA0B5D088A6F8BB0EFD9D35643020ABBE5D5965800C55B9774A27B334390EBF1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624880828, "uuid": "a48c77f2-0613-4361-9b34-484232ef2fc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624880828, "uuid": "94b4a245-a067-43b3-b3c2-dca7bd259fd8", "value": "12288:AeVwuo3gb10dWSPmjuzO4WYgFssYFjAaey3PHskD9cBQTO9W5+EBTaltZZTM:1Nx0QS+ju9qFMjADy3PMkBeQT55+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624880828, "uuid": "cf739f25-1c25-4d08-a7f7-3819c05eb6e0", "value": 1205248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624880828, "uuid": "5a6bae60-5ee8-4bb8-ae22-7e837a82f282", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624880828, "uuid": "a9d5ed5a-42ce-4c76-9194-fa7acc592612", "value": "7c0803fba1838e2d97452449be48dfa3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6501e50-d7b4-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624845779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845779, "uuid": "ae1c78f8-4126-4914-97e8-dbaf3cd45d95", "comment": "Malware payload (Mirai)", "value": "326d1843bff5eddf33474906f3bc22f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845779, "uuid": "38ae71eb-20ee-4400-aeef-05632219a47f", "comment": "Malware payload (Mirai)", "value": "6ad88bb415e3fd3b3442a3ac0f054cee9469dff2af5222f695815b403ec07042", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845779, "uuid": "c53a2983-9804-45ff-accb-5af8c7dde960", "comment": "Malware payload (Mirai)", "value": "b63c198f70486b8418f1324273824d4005818124", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845779, "uuid": "b5a25b96-b817-4c15-90f3-49c50d80c033", "comment": "Malware payload (Mirai)", "value": "735710ce0549168361188d7038c59561f176cfcbafddf6bea64636d2f26dcb740f8f7c99783f4801a6c0fd3427b06001", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845779, "uuid": "64bde188-4585-48a6-b538-6f1df34b3ca1", "value": "C9730986BC409A10C6C50677FE2F218E33075B99F1DE7252CE155FB47B8B81B0E2B65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845779, "uuid": "797ea7d1-c5b5-4eaa-b114-3c79cce34f45", "value": "1536:CynZ7o8MRxyGZYLqmuKsUaTMOs4J70qNddleEozMI5i2Ckvmfs:t7oRyGZWqu1dIYqNHMCkvmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624845779, "uuid": "5308275e-79b6-4c01-94d8-c74d973056f4", "value": 80524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624845779, "uuid": "9f5260a3-b2eb-4e76-b7cc-27cee40eeaee", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845779, "uuid": "595daa16-9aca-4d9e-9a4f-53c65a2df93d", "value": "326d1843bff5eddf33474906f3bc22f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9c4959-d7e6-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624867046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867046, "uuid": "497703a7-f96a-4778-85fa-21119ebd3517", "comment": "Malware payload (Gafgyt)", "value": "6f05e999650d1467810c153a9e6760db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867046, "uuid": "bd86f7d0-1baa-459c-8348-68b37a2b0733", "comment": "Malware payload (Gafgyt)", "value": "6c21c0d6d1e71cf17b29d3d85d0beb232a5edca52a6ee63ab48f5c88d19c4864", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867046, "uuid": "0cf6a477-ee3b-4f7f-b5df-68a7ccfe9fb9", "comment": "Malware payload (Gafgyt)", "value": "3d21d16caea9aeaaa4d52f8594b868418085d6fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867046, "uuid": "bd2ffdcc-cd20-4362-b040-6c6738e635f4", "comment": "Malware payload (Gafgyt)", "value": "8b6eb235b3ba1919e7cb40eddb2c67780af70f6f698a670a7feedb9d03831dd2aa52547e1f02cbc3161359c718d7c967", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867046, "uuid": "cae78a51-57ce-4d3c-a882-2b81618e7360", "value": "E4B32997F800DE66F40AEA3605D70721B630FBB50E531A7673573AA69E362E47823F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867046, "uuid": "9bdfdc42-4c6f-4d16-9c3a-25f6eb073e89", "value": "3072:dccIp52BVEB5dY9huVPmbyFKgJ3tcFMmm27VPDunSQP5R:dcc0QBqB5dY9TyFLJ3yKmm27VPDunSQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624867046, "uuid": "73892cfd-1d8a-49a3-83b7-558d27580d15", "value": 117857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624867046, "uuid": "84d7455c-fffa-4ea7-8a7c-dfcf5634c55d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867046, "uuid": "ee5443da-a3df-4142-81a0-9177b52bd70a", "value": "6f05e999650d1467810c153a9e6760db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ef49fa-d7d9-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1624861648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624861648, "uuid": "4031c33c-194a-46d0-b880-74bb6888f2a2", "comment": "Malware payload (CryptBot)", "value": "0f4373a2198c5c3f6c551271ce7c2131", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624861648, "uuid": "351d418c-b61e-4e1f-bc4c-008d2d9eff02", "comment": "Malware payload (CryptBot)", "value": "6c2f740758b9e93bb0f3a30b16f6aa154dcb3f6011455f01190c9299d9b8beef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624861648, "uuid": "f388de41-aa89-48b1-acc9-b5b380ddc356", "comment": "Malware payload (CryptBot)", "value": "7c878bc0510f7e05c4ce4b04492ce944a8c116d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624861648, "uuid": "be8dbfb1-45e3-4f38-a349-1a7b0f3792d3", "comment": "Malware payload (CryptBot)", "value": "55a6a8369e3c0cc6fd6c2ac753ef848a7a0d7a7ba133addf89969fc5b48430a426c324810f3899709810875eff15f078", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624861648, "uuid": "83a16226-cd17-48ca-82ab-503b1b8ba751", "value": "8EF4F100B650D035F5F322F5997AA3A8553CBAF19B2450CB63D92BEE47B46E0BC31A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624861648, "uuid": "86b7b579-c4cc-4bb0-93fb-cb0341606eef", "value": "a6f146a143ca57a8d8acf4fb9d34381c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624861648, "uuid": "0905e24e-df39-446f-9e66-26efcfff19c3", "value": "24576:972nIV6Cchb/bhKLQW3yR9NiQ54sxjwl3K9PI:9N/SbzELl3jQiyjwl3K9PI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624861648, "uuid": "3093151f-5eba-4398-a9c2-00b03eef7190", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624861648, "uuid": "a3e155d9-3589-459d-970d-07384fa45fb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624861648, "uuid": "d977a8f6-b148-4593-84b8-b44334606c68", "value": "0f4373a2198c5c3f6c551271ce7c2131", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ec028e-d7dd-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1624863057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624863057, "uuid": "8b14b807-86c7-41b6-b3e0-534017aae230", "comment": "Malware payload (QuasarRAT)", "value": "95584679e9980d43a2ebd8bc94523fdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624863057, "uuid": "68a9cd17-396b-4f30-ab85-7bd886dfd8a8", "comment": "Malware payload (QuasarRAT)", "value": "704d41dd4ca17a0c2817c62a2377df8f07c99883a952a3b037bacef4b3114e1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624863057, "uuid": "fd89a14d-82e7-44ea-8fcb-0cd5d58db6a2", "comment": "Malware payload (QuasarRAT)", "value": "41ef7cf835b03ff5394e8cf315f3aa434da99a2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624863057, "uuid": "bb759052-d847-4d94-8b6f-af3dac038675", "comment": "Malware payload (QuasarRAT)", "value": "0097be1209aceff52b4578030e0fa9f0406fd4e79208e4f8391af6704519d9885ba8d0b780e7de9b2f2413eb46bca428", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624863057, "uuid": "b8bc90e7-150e-4125-ad1f-b258942c20f6", "value": "F0E47A818EEFCDCEC26F227FA05A4C8215DEC3461783A2E49F465E30B3856678D655E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624863057, "uuid": "62d14426-68bc-4aa6-a19b-e68c756f3355", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624863057, "uuid": "20866880-70dc-4b42-8ec5-7b96cb29b0c5", "value": "12288:wTC/dIVYS1I2IP3TKZ0v7RzRNCGMPYI+V5gR0DHgQvcB2VLvuBIq2U:0odIVmXOZ0D/4GMv+jNHgQRuBIq2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624863057, "uuid": "4c8bf198-1226-402e-adf4-1547dad353d1", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624863057, "uuid": "e51a312c-192b-433a-a74c-ba4f19b63c6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624863057, "uuid": "35d3426e-16dc-4346-bbd6-ec1065e169e8", "value": "95584679e9980d43a2ebd8bc94523fdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ef5afd-d86a-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624923537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624923537, "uuid": "3a94b909-297f-416f-b52b-73ccf1e24e7a", "comment": "Malware payload (Mirai)", "value": "f54179ca0c6b0c308572fc95df6c802a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624923537, "uuid": "ea53a3c4-6eec-4ff3-b588-ae4ae65e8ea7", "comment": "Malware payload (Mirai)", "value": "721774eb0b4a7a61973bd4e312d9f055e48f971eabbc916e04b04bb94579553d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624923537, "uuid": "fea198af-34d2-46d6-951c-e9dbee1ce6bd", "comment": "Malware payload (Mirai)", "value": "7a64ef6236946c98a860bed9c037d7a4cf7eee0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624923537, "uuid": "d676d748-dd12-4f4a-b335-111f2a725507", "comment": "Malware payload (Mirai)", "value": "dae7ab1689534b3e73289064ed45a43edfb94d572e3ef9a906e84adde99abed6e8208a12c021abc479e67b7c1b5b4a8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624923537, "uuid": "052f6314-9dc1-458f-9f90-6d620b74bada", "value": "D7E2F2615606A4F3C5D00C75E7741E8223BC4C7D67DBB34A1634622C98DF1DEBA7E682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624923537, "uuid": "c244634e-ac74-4da7-8ff3-341858936941", "value": "768:UbSlsLzKRVIexti/B1DbY4DvdVyrmC++YafO7ZG3UW:GwsiMexti/BdDVM6C2rC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624923537, "uuid": "5c97261e-eb14-4474-b5bf-48a471a97e85", "value": 31880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624923537, "uuid": "281ccfb9-1cbc-4c5f-980e-b345120fff90", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624923537, "uuid": "4ff51d81-b243-423d-9dca-d9089a95b7d6", "value": "SecuriteInfo.com.Linux.Mirai.27.10739.6852", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9312a2d1-d7b6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624846471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846471, "uuid": "3dc34bcf-26f4-48e8-bb61-785fdcad0be0", "comment": "Malware payload (Mirai)", "value": "d93a51a366a62c8dca302083a3760989", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846471, "uuid": "0491ea2b-545c-428e-83b8-5ee5528eaed0", "comment": "Malware payload (Mirai)", "value": "7263ed794f3b9694c00b69ec487574add1511e4a243f65f49ef822a554d007a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846471, "uuid": "1d79d8a0-744c-4324-a113-43a963e37ddf", "comment": "Malware payload (Mirai)", "value": "0c58eb373a2eba06d285e3da1dfb75a8e4865572", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846471, "uuid": "1ea4f97d-25cc-48b8-8f3c-e4cb4b717cfc", "comment": "Malware payload (Mirai)", "value": "64848a696a39f428c4de9809ab1705bf7d4a004bde7e69b0c79817f3b710b6af4f9682dc8ba6f6d6f0cc4911821d7649", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846471, "uuid": "4e85c70d-2001-46ef-866c-1cad2bd71aaa", "value": "DF533B0073948F0BF4AA5EF5283F17E487BEEE4016E5F1846A0FE64A8235E335559F68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846471, "uuid": "315fdfde-723f-49b4-8cda-fc683e6c6223", "value": "768:TBFWn7icJpjqWBRunbEJn23dZk+0YGadi+Qq5wU05vlYGoWKchU5d753np6grkfm:oeYysnMoaAnzdkGoWKX5lkfebV3XBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624846471, "uuid": "136165aa-7c74-4974-9df3-871c36de4b6a", "value": 66656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624846471, "uuid": "1534899a-092c-4167-83ce-fe00e189d1f8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846471, "uuid": "af7dad72-bd33-4f22-97fe-4760d7d8c480", "value": "d93a51a366a62c8dca302083a3760989", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e19178-d7ca-11eb-875b-42010a9c0053", "comment": "Malware payload (Pony)", "timestamp": 1624854992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624854992, "uuid": "82b64f82-cf0f-46f6-9a29-03911447a611", "comment": "Malware payload (Pony)", "value": "96a489c7a5315dde4474d5af3da9aa23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624854992, "uuid": "b6d6b719-024f-42fa-8cd3-b227ac5d97cc", "comment": "Malware payload (Pony)", "value": "746af22576d3d2bd2e98c14ef6a798fb2f52d722781003729e110d9c058a4050", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624854992, "uuid": "0892fae2-8cd6-4992-aebd-da7065007ef9", "comment": "Malware payload (Pony)", "value": "c14551499212aa8f30817cabed8fbcb84e0eab63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624854992, "uuid": "15566be8-ad86-4ce8-9223-faf5e16c8de2", "comment": "Malware payload (Pony)", "value": "4add711b40522b8a2772af7fc2ceb39e4fb5aff1efbb518d12ac3392f77f9e1e4f49c5d8be48f74a153319a171e33dc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624854992, "uuid": "b18faf55-28eb-415d-986e-0bde7b35bebb", "value": "D6D3E00576928472E0870A302872A6626F7FFD62977146EB37D8247E0F727D28D7C35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624854992, "uuid": "5f66d618-6aaa-4239-b2ef-48261b8d6265", "value": "2ff75684b51a08fae5dd626f7b53fa6d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624854992, "uuid": "47fd2a65-9b13-4983-9033-8e76217689bd", "value": "3072:kpJz2c5lgWB+quxn3Uz2iJKsDBT7ylmplXgRJ4V:WJz20GWBtuxu2XsN6Mp6RJ4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624854992, "uuid": "7602d18b-ac09-48d9-930c-0835fdb9430a", "value": 134656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624854992, "uuid": "18dca5b2-13ed-44dc-b97d-b431bc5df656", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624854992, "uuid": "4065f951-e93a-4afe-9893-69c829eb24e4", "value": "746AF22576D3D2BD2E98C14EF6A798FB2F52D72278100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4781c6ec-d858-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624915923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624915923, "uuid": "48db9902-1965-492e-9a2c-d14a3b849ac0", "comment": "Malware payload (Mirai)", "value": "8b26dfdf02dfe85442ccfa80b996e6aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624915923, "uuid": "2d1bfeca-16b7-4477-a009-c3c3056b48eb", "comment": "Malware payload (Mirai)", "value": "74e22f4033b023ac2d6db6aa34e71708a48559a2f55a3d384f3d98bf51681158", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624915923, "uuid": "6c37e37f-2871-4cf7-bdc6-3a9d7945d62c", "comment": "Malware payload (Mirai)", "value": "c1a5fa6bbb7e63e6126d49b691f1d6d446ba3627", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624915923, "uuid": "18c247d6-c6db-43f9-b439-afdf16fc9700", "comment": "Malware payload (Mirai)", "value": "15b5a51d505fa0feb9426b5a1a36ddd751c1f28e49ea0b6bc7e4f29cfcddea45fb6652a79e7c637e6f65768a4ecb3e9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624915923, "uuid": "9b23184b-a1d3-4dae-93aa-f627bac12b27", "value": "C9142946EA814E23C4D7137AB5AF018E3322A7D5A3DBB2068D145F703BC6A5F0D67A46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624915923, "uuid": "47f16302-fb12-4213-8eff-6cd850b08af0", "value": "3072:TmNF5CzTYKdEimF4eNGh2x/1tZfCgmYRDkNRnyZTLGH5WQZtwPoikM/9EiKjULjI:yNFMzTYKdEimF4eNGh2x/X1CBYRDEnye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624915923, "uuid": "99404080-8e82-4b80-83d5-64c83fd0694c", "value": 192844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624915923, "uuid": "a7b90fa6-f223-41e2-82ea-3b9312c34f67", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624915923, "uuid": "988f6c97-f186-4a15-b18d-314989232ea4", "value": "8b26dfdf02dfe85442ccfa80b996e6aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d235015-d820-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624891854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624891854, "uuid": "33c03738-c00a-482d-b0b9-0bd18179e60f", "comment": "Malware payload (Loki)", "value": "c927155d358979027e64e6ad0ac81e94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624891854, "uuid": "2ded95e8-ff2b-4a3e-9830-612bf3a55d45", "comment": "Malware payload (Loki)", "value": "764102db058fc38adcd25edb18e0b6309c05bda423f1f6e83918c2fffdcdb141", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624891854, "uuid": "8a686743-396c-4374-b0af-61e8e54108fd", "comment": "Malware payload (Loki)", "value": "dcbac1ddaad6dbe6beeb35ce959b9c7fe5d85ae2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624891854, "uuid": "38b5df3d-3384-4fbe-8683-a1661f3a5018", "comment": "Malware payload (Loki)", "value": "0f4a9e12b0bd36be69af43e3a189ed328423008327ad72f12f829c7ec404aea7807531031e5931e0f42ace9fddee6b68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624891854, "uuid": "bd9a6f71-71cd-43d5-8c6c-95fedcc2b542", "value": "B6B412033980BA47C4506AFB89E7D1E03A321E468F19FB679DB87F2E1D71A94D750B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624891854, "uuid": "34ca97ee-403f-40f2-afd2-b97eb43d0cc8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624891854, "uuid": "c721a27b-dc6c-491f-89cf-c547da29dcd6", "value": "12288:az2KjxZ8nDRXlYpLMND0lpPk+pMN/YSKoKs:un8lVeLiD0l/qBlx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624891854, "uuid": "aeb26fbb-c151-4d01-acbd-90587687bbcd", "value": 501248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624891854, "uuid": "f5be271f-1b2e-4f6f-8e39-6f842495e2f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624891854, "uuid": "44683735-cfa7-4f8a-bb46-09cc4692c4e3", "value": "assccc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3f3f04-d803-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624879554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879554, "uuid": "80efc525-667f-4436-a53e-cc0792c87746", "comment": "Malware payload (Formbook)", "value": "573ec4b34cbc15cc3c404fe7a1af22d0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879554, "uuid": "fc93f4ea-ae7d-4fdf-b5a7-9fc220714c4a", "comment": "Malware payload (Formbook)", "value": "7889f48852ecfa6f19c88bb7c580b8af348437cd778eddbc76ff41c20c4580fc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879554, "uuid": "2896cbbe-5a32-4338-9438-7296a6dc7a01", "comment": "Malware payload (Formbook)", "value": "947f564cb6f491532e7fce781cc7144ce8917cde", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879554, "uuid": "0b89fae9-fb17-4ebd-80b9-412b3c8d21d1", "comment": "Malware payload (Formbook)", "value": "21f8f41672de3baaaa5c3535ca7f1d6d14b886ef23cb5032e6e2d0389b0ba1f7c503a1e6d35d4b44acef366dcb345fb9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879554, "uuid": "8206bb44-a31c-48ef-8c7f-96b3b324e3b4", "value": "9445120176C16E33EA23CD7C1747D9A2C0B94F169024296AC78C758B6A3ED94F7D339A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879554, "uuid": "f822341f-67c3-4c93-97a7-87da73bd672f", "value": "24576:utKoipHre2OB3N9cgwUXxekxXeQg+8uk1R/JdmeP2ctEAKkz:kipLe2K9cgwUhH3vZC/JdmeP2mxtz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624879554, "uuid": "0321224a-de97-4c3c-9456-9afde92fe186", "value": 1274216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624879554, "uuid": "a58b200c-35fb-4274-8a8e-89a65ae49747", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879554, "uuid": "5560732d-555b-4a5a-8dfb-097fab2702f8", "value": "Requirements-Jun-2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b7d14c-d864-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624921054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624921054, "uuid": "22b53f65-d258-4fdb-9674-8627d9ba7354", "comment": "Malware payload", "value": "ab3229656f73505a3c53f7d2e95efd0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624921054, "uuid": "a0841c17-2891-4396-9227-50656e1ab3f1", "comment": "Malware payload", "value": "796800face046765bd79f267c56a6c93ee2800b76d7f38ad96e5acb92599fcd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624921054, "uuid": "62a26d4c-1c86-49c4-aa4e-a9a66ca301d6", "comment": "Malware payload", "value": "45404b862e70a7a1b4db6c73d374b8ac19ddf772", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624921054, "uuid": "e244cad0-6507-410b-adcb-f81c76daf3e4", "comment": "Malware payload", "value": "7d0e3da5df79de1593219cf8edd98fcd11173331b6c3d7435d01910ce89700e316386ab721ce140d08260b391bba34df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624921054, "uuid": "4f87cdeb-858e-4c47-a6cd-9c2d58cbfd72", "value": "56A32BF7E67561FCC675B23A35CFA8F7F0A0707815B1640E6B85295E23108890EA663F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624921054, "uuid": "ffeb7b78-7015-46e7-8496-a49cc229d230", "value": "3072:PmYCb+XoBHeJRAgggwgggwgggwgggwggg5kQok:hCw9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624921054, "uuid": "69653edc-7383-4ed8-aa93-75573ccc64e5", "value": 105232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624921054, "uuid": "956b37e0-7a7a-4ee7-8b73-49f5d67db901", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624921054, "uuid": "a15eaac2-a7ef-410e-aa48-3a813e9063ff", "value": "796800face046765bd79f267c56a6c93ee2800b76d7f38ad96e5acb92599fcd4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c31e553d-d7b6-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624846552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846552, "uuid": "c04d278f-4c0e-4442-a9d9-897f3bbbdbcb", "comment": "Malware payload (NanoCore)", "value": "8fa306b23f72ca98178725150ddafaeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846552, "uuid": "cc5589d0-876b-4c3c-9017-d2bcce6eb962", "comment": "Malware payload (NanoCore)", "value": "79adddbd760bde05cc3145e430c203c6052d3fbd63815d187ab1f12305ddce75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846552, "uuid": "da3ac9a5-e890-448e-8951-f775a9611ffc", "comment": "Malware payload (NanoCore)", "value": "83057dde025b7e80b9307e33f756480989f5441c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846552, "uuid": "468d176c-02b8-4616-a503-23ce23154fb2", "comment": "Malware payload (NanoCore)", "value": "56e546b84e7904aef1efd74806cc0cbda3aca7b0d9d4fa98ee99d155e04b1269020b92f90a81497b5a7312b1f4bd264d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846552, "uuid": "504d8aaf-1163-4e1d-a2d7-f967e5fb2291", "value": "4D45273536F64B04F03946B13292C8B093F57E58ED9AC31AC9E03ADB7562FD19E8590B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846552, "uuid": "3e8052e8-2366-4c0a-8489-e7133d861d33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846552, "uuid": "69aa1f9b-4d54-4add-b31b-a13bd01462fd", "value": "24576:eiblb4Y4DgAdEfFBXZ4shfQGy8HVwKH0C:nb4YQdKXZlhfQGTHqK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624846552, "uuid": "ecb8f118-a236-426b-b1e6-68388776243b", "value": 1202176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624846552, "uuid": "f6197cc0-ca75-46b7-af86-94d064a50ece", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846552, "uuid": "ae312a01-d3b7-4b55-aeac-83f19cc4e371", "value": "8fa306b23f72ca98178725150ddafaeb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb938fad-d800-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624878322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878322, "uuid": "f45c632e-caf8-4eca-ac0f-6eb52a29f007", "comment": "Malware payload", "value": "43530cae846e5a334ad9fe8c0ebcd52a", "object_relation": "md5", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878322, "uuid": "f22e534c-7d9e-4607-8c6b-f6bcf8279aa6", "comment": "Malware payload", "value": "79aee7a4459d49dc6dfebf1a45d32ccc3769a1e5c1f231777ced3769607ba9c1", "object_relation": "sha256", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878322, "uuid": "a9583f07-3e0d-49b7-82d7-0e72550c7168", "comment": "Malware payload", "value": "ff1dd49ddc5e5777178d674baac457346edfaab3", "object_relation": "sha1", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878322, "uuid": "40fa8986-a787-4c4d-9cc7-e7e7f125224f", "comment": "Malware payload", "value": "56dfae8431cd7165f5a39847d9e6781ab5e1560763755b46e671ae586705cff24c9ba414a2c971130ad85c0986f99ec2", "object_relation": "sha3-384", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878322, "uuid": "9966ab35-7ddb-4269-ace7-7f141efe56bf", "value": "7961A7F82690E6B6149D873ED6128140787ED093C7681D29A37AEAB2253DC73B13F21C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878322, "uuid": "8e6a3269-1bea-4a10-9952-6a7261a8e81d", "value": "48:TgOJFCcHJTAMVgixQLpLNYr54XEytfA0ydlQ/PxQLpL8X1EFcA7Egc7vYpiKJ:TgMjJUMBx2pLNYj89c+/Px2pLQwfyhKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624878322, "uuid": "2af8d191-cb20-41ff-9cd5-57d7cf2b39fc", "value": 3321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624878322, "uuid": "a36096f4-c962-4bd3-a897-a8065dc2a021", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878322, "uuid": "3660e06d-e1db-40f8-b458-0f9d20eb72af", "value": "79aee7a4459d49dc6dfebf1a45d32ccc3769a1e5c1f231777ced3769607ba9c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0fbb2e2-d80a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624882653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882653, "uuid": "7cdc66d9-1e83-4c4f-9ec4-7286c6459bec", "comment": "Malware payload (AgentTesla)", "value": "96da9d31795b54becc7816d9dd4e30e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882653, "uuid": "c35c1391-6bcb-4443-83d2-957ab73c466c", "comment": "Malware payload (AgentTesla)", "value": "79ff2d6e3cc9cdbafab699e003eda039e813ac048039640c3c6c9f0258d35df7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882653, "uuid": "2ffb064c-7b9a-4e82-add7-90c9159b1a92", "comment": "Malware payload (AgentTesla)", "value": "225ee4ba7b72f30416bf071bb99f9da7d6c89e3a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882653, "uuid": "a3363e92-b891-4fb5-baec-9663875e9320", "comment": "Malware payload (AgentTesla)", "value": "019c3455c91bbf6f63b383ecddb10ef47de704e1c9dc5cd17b663239ff31b9831af474d61355750f3cc8cf66896623e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882653, "uuid": "07485c14-190d-4433-8f8f-49a570539816", "value": "C48401283EDF5164E2376F7896F43A898ABF77125A13F49C298112490F63701DDD2B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882653, "uuid": "ff4d44df-8bd1-4714-a6a8-9a70d1b63836", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882653, "uuid": "e7fc212f-1cd4-4731-b765-8eb90f2d9929", "value": "12288:ED32RBkLo/JyRZneHp5A0dWwYxdivRKkqIvlELBSsLOv:A2RByoxyCJXyxjItEsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624882653, "uuid": "6cef8c31-5a4e-48cb-8bea-790a3f0ef064", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624882653, "uuid": "710e457e-6367-4bdc-9790-20bedd9439b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882653, "uuid": "703e51a2-a04a-4e4a-a9cd-0c6c09f83186", "value": "F9 52766 NLEX Corporation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2553f1f-d800-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624878306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878306, "uuid": "9e962da4-d28c-4a84-903b-8d95984f2a86", "comment": "Malware payload", "value": "9885d42b645604eac9cf8eb51356d34e", "object_relation": "md5", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878306, "uuid": "7f8517ea-c672-4de4-8d03-86e761dacfb3", "comment": "Malware payload", "value": "7a15e51e5dc6a9bfe0104f731e7def854abca5154317198dad73f32e1aead740", "object_relation": "sha256", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878306, "uuid": "c96383d1-1c4a-4dc0-922e-cb4aeab171f9", "comment": "Malware payload", "value": "a4203ca2686ef6983f3e32b552177ffe29b53380", "object_relation": "sha1", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878306, "uuid": "11b51c83-5e55-44eb-9388-154592a48161", "comment": "Malware payload", "value": "569da9b7cd05b6095bcaec03a0b61510364379ae61bd8ccc02ae44148ece443578dff14cd86e45e8b6ff942dbce74378", "object_relation": "sha3-384", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878306, "uuid": "315f7c05-95f2-4429-9564-c3f2b63abaf7", "value": "6172651BF7E4CA7AC0E8537840D74734A2F1B8B0A77253171739917A2D423D46F2AAC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878306, "uuid": "096bffbb-a754-4b32-9587-b75d9687b938", "value": "96:RUh1A7BWB3jXzoQCE/rG/u/Dq/ulwe/CEg4Vg4Bkw7fgDB4BNL+iV225Y:Rn8hXzTCE62+WlfTg4dBF8Deniiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624878306, "uuid": "d16c5ad7-2b02-4bee-9d5a-71ef8b7e29d4", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624878306, "uuid": "a0d26780-3f98-49c7-8558-3899a6c13464", "value": "application/x-sharedlib", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878306, "uuid": "0fb0036c-efea-42f0-b317-fef712d65c61", "value": "7a15e51e5dc6a9bfe0104f731e7def854abca5154317198dad73f32e1aead740", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15fc7b3-d7e5-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624866762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624866762, "uuid": "3c1e12c1-d370-4a95-ad6e-7cf789be49be", "comment": "Malware payload (Gafgyt)", "value": "b9a3c55f725ab8ed9161cbfc329ef87e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624866762, "uuid": "f023d034-a346-4271-9d52-c9d26e572a88", "comment": "Malware payload (Gafgyt)", "value": "7d127eb2ca59231754ea0378c2e215f3fb853007f9dd8ec0bb55dd6d98eb70e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624866762, "uuid": "1040cc64-12d7-40ab-80fe-365b6f84578b", "comment": "Malware payload (Gafgyt)", "value": "121c37327975726ebcaa2575c1814ac168f0d4a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624866762, "uuid": "5d9d3df0-54b6-4159-89ca-995bc6a79359", "comment": "Malware payload (Gafgyt)", "value": "72517658f8a427a7a69754c1982a93d433a0b788a36b6404e9682fff86c37462d7dafd88b7155b26751ce644a909fb94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624866762, "uuid": "2340edfe-7581-447a-ac84-fc3d952c3e2c", "value": "11C30805FC404B27C7E22BBAF79A43CDB735665867D733115A29AEB02FC17982E39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624866762, "uuid": "f81a191f-708b-4e5b-8dbb-3235664d70d5", "value": "3072:l7bYA0gsIXa9uub295+klfp7+POC5re5hLIQWmQWtX/MZrQRhCRSA5SR:3lfp76Z5re5hLIQW4J/MZrQRhCRSA5SR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624866762, "uuid": "a3cf7b08-05b6-4156-b18d-559b5ce9fcf2", "value": 127697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624866762, "uuid": "ef355f96-af96-441e-b413-90d74ab0e2f1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624866762, "uuid": "f1fc62da-23c3-4cad-aca5-e02e7a6e5a3d", "value": "b9a3c55f725ab8ed9161cbfc329ef87e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087ac673-d7b5-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624845809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845809, "uuid": "c07c0df2-0d82-4f85-9942-cb1fa659a4ee", "comment": "Malware payload (Gafgyt)", "value": "6dc87157d4a43aebe69b373a753bd325", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845809, "uuid": "4b1d582a-d055-4dab-b7ca-f1275f797d7c", "comment": "Malware payload (Gafgyt)", "value": "8369bbdc5906a9e0f08e80ebd9cb0c46e2cf77c2a5a7bf71d7db54b7a4d85670", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845809, "uuid": "012230dc-c5f4-47f1-a395-045dc349410b", "comment": "Malware payload (Gafgyt)", "value": "ce74381aec364aca542945116873c51cf7a82803", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845809, "uuid": "aca93595-63ee-4ac4-80e1-685bffbf843c", "comment": "Malware payload (Gafgyt)", "value": "2eb80718e0bc3f5aac14748b3db7af49ba3f886989dd0079a7599a3d296e314404f28265905f92ab040d28308b52b0df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845809, "uuid": "bf7ba792-0c82-46c2-a826-dd2a6e5f1b46", "value": "19A3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845809, "uuid": "b3663e64-2a9a-4fed-9aea-4ad529f74f3d", "value": "3072:VK1z13U6HzHoXRtmTUhQog/EmmFVcqq0GnDZT:VK7DDeKlog/EmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624845809, "uuid": "3ea5339d-4538-4172-bff8-28406a5340ca", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624845809, "uuid": "5ef00f30-3d2a-481a-936d-d41c9f496ace", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845809, "uuid": "db25df3d-de9e-4bdf-b618-b24cca4bc44e", "value": "6dc87157d4a43aebe69b373a753bd325", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497549d0-d7d8-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624860951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624860951, "uuid": "f8b9a645-57fc-430e-b3ed-d62b135543fe", "comment": "Malware payload (Loki)", "value": "adbb9378da315c657beb2b3a802eabf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624860951, "uuid": "d1509970-0d23-4490-a758-ba679741de61", "comment": "Malware payload (Loki)", "value": "8486b8bd67d7a9ba6152015db520a76ab1bbe3ab8e087cad256a30d456c898fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624860951, "uuid": "19ac531f-2dda-4088-8ef9-bcf7f4037fb4", "comment": "Malware payload (Loki)", "value": "0c98b39ce4163636d277bc1b98ec370577e04c3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624860951, "uuid": "eb292aa4-efcf-427b-a7ff-939e648310e1", "comment": "Malware payload (Loki)", "value": "4e53daaaaa314eaa892bdeb73e0d283b56a81474600b9e03390eda5a5b5899b6de6388a4407faa8ba378810ff63acce3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624860951, "uuid": "93d3a4e2-498b-4d64-aa81-d99ac3cff1fe", "value": "4715BEA9329071DECA27CA31CD242C50E771BC66531BD22B9453318DAE3DA97DF211FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624860951, "uuid": "12037088-4386-4033-8981-11677424913e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624860951, "uuid": "681d23c5-bfab-4d60-87a0-5a473392e579", "value": "24576:FZDZMr3WnEl6cd7Y1A3s5EbG8szO2FdT:FRGbWnEl687j3oV8szO2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624860951, "uuid": "6f58e0e4-87b5-49f4-82ba-88efa757873f", "value": 935424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624860951, "uuid": "77dce342-01d0-48a1-a3ef-7dabbde5147f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624860951, "uuid": "50acc54f-fc2c-43b4-8d9c-d59f1612bce2", "value": "?????PO20210628.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16bec70e-d7b5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624845833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845833, "uuid": "e28e60a9-ed5e-45ce-b445-90bf1e177eef", "comment": "Malware payload (Mirai)", "value": "a82681bcaae5e0b639400ea4c96ad2ba", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845833, "uuid": "5b42870f-4c32-40b4-8a07-042051a31067", "comment": "Malware payload (Mirai)", "value": "858a48fa82db1127a764210f4026d245aa017d87daa39f1709900518c5bce5e3", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845833, "uuid": "5363f730-bec9-4ffd-a76b-02023adb454b", "comment": "Malware payload (Mirai)", "value": "b4c03c4ca55ff993c83f31d2325f5b528d75c5dd", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845833, "uuid": "a7e34af8-b4d3-401e-9358-52b390502e5a", "comment": "Malware payload (Mirai)", "value": "22e40dea9daba54bd29eef3d15710afd34fab998b0addb83df35051c3c297d889e57d016a5facd900a96d6be212f9dae", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845833, "uuid": "1448ecad-6957-4784-8d67-c20cc5946981", "value": "95633A07BD8086EDC089E1B802BF7579C056F1BC277571CB6BD4FF2A3A15EA01B29949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845833, "uuid": "65804fee-2bca-4ef9-8959-4a081cb37532", "value": "1536:Tfu73WGGE0DUm8lquk5O7eGdkmM1bF148/yUVR:6Z10DU3lqVRCkmMBF14HUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624845833, "uuid": "56fc5eeb-52ca-4e67-b6d5-c3e2b1bbfd98", "value": 68512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624845833, "uuid": "04efbd07-135d-4a33-832e-e5676f18e5b2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845833, "uuid": "ff2c7f0b-1730-45ae-8391-f670a8ebf7d2", "value": "a82681bcaae5e0b639400ea4c96ad2ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3fa7ad8-d7d3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624859009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624859009, "uuid": "b3c0e903-12e0-4218-bb12-db19e3d91c8d", "comment": "Malware payload", "value": "63c73a70b4171f74a5e5bd1d00ffcef1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624859009, "uuid": "dbd4c584-66ea-4f74-85c8-5de624c829a6", "comment": "Malware payload", "value": "87cfc640acddea4ff167364b7950a338c9d1150baf711aa88a6703106422ff1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624859009, "uuid": "ec1341db-d6d6-4ccf-ba07-0c8b603d88d5", "comment": "Malware payload", "value": "cab7239df3606e878bf614dc47ded05116018d1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624859009, "uuid": "c29fe4cd-03d7-4643-8312-803bad65f08c", "comment": "Malware payload", "value": "6c87b77da6b1467229bc95db43f799170686994ff9d878100a21a9e7725e547fbaa47764fa31cd11b9b92f9d9610c894", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624859009, "uuid": "2855b727-08e8-4319-99db-1b1d19e25597", "value": "96F4F11F7BB94672E0034AB819C656D012BEFC76672A590FE346A7283EF2F814D91317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624859009, "uuid": "05237f75-8950-40ee-ba7b-56d041bbeb6c", "value": "12288:Sc2Si3Tmfju+TNpFH8d393wdTVwa5x9HUJP+M8nJMC8avdczdCZ2Pka8s:Scni3Tkxhkd3wia5AJWMqJMC8aVchC4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624859009, "uuid": "2fa9bad3-c9e5-4114-a720-bc876ab0c947", "value": 762745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624859009, "uuid": "2d96d35d-efc6-40b2-b921-5b10562af35b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624859009, "uuid": "230db44a-7239-4f23-9416-aaf3d92e1a8a", "value": "63c73a70b4171f74a5e5bd1d00ffcef1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e8af098-d803-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624879320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879320, "uuid": "5db0a647-f746-4194-8617-9ed15e7c4b17", "comment": "Malware payload", "value": "54026c4583be0e83d750502a4bc4fc37", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879320, "uuid": "5def699f-c77d-430b-b019-fd46c5bb57e5", "comment": "Malware payload", "value": "8a3cec9b8afa04d0beade7db643e2dfc98c103d80599172715fac9003eb984b7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879320, "uuid": "f4cb549c-0ee9-43d5-8617-e657da49d509", "comment": "Malware payload", "value": "0848273b565026d3fb5d918ebc3932d46260e302", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879320, "uuid": "df48391b-0688-4a4a-bbb5-d8caa2b5cddd", "comment": "Malware payload", "value": "5c2540bb88440eb4f472eb1c63a59c8ac48020694eb2d7aae596f2c61f3b1457e74d705cce8e4e5d3cba0e560327712f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879320, "uuid": "9f6665b5-1719-4e62-9ee2-f2cd2cecd06e", "value": "4B713AF5E5092892EB9900D7E80E7C6D1376FD8A8BC246ED70ACFACA0312765552781B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879320, "uuid": "5e1c1e3b-ae35-46d2-b5aa-25839f825013", "value": "96:bT8yETFPSVKtul3+h02tA9VDEX3UFq6QdowmWH4HBTmaj1:boyETNm8ulQ02tUiHU9Ht1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624879320, "uuid": "1c7a48da-0cf1-498f-9595-3c1f51fb44f2", "value": 3550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624879320, "uuid": "cfa64636-ee31-48e3-8625-25e50773135c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879320, "uuid": "9ab63721-f727-4f45-87fc-64b1064333fd", "value": "PO-F64C88F.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d2fbbd-d81a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624889340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624889340, "uuid": "7fdd6975-1d6c-42e6-be2a-02f7754f48ac", "comment": "Malware payload", "value": "6458ce6d022b54e5d374e32bbb71c06f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624889340, "uuid": "a7e6978f-b9ce-4b97-9192-3e2558d83e95", "comment": "Malware payload", "value": "8a4eabb942d797353328de51a6fb9898570502ac553f66768116f3a242975faf", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624889340, "uuid": "3e35c9fb-ddcc-4eca-bc6e-eeed8d7e8d0d", "comment": "Malware payload", "value": "1467859b8a37405b0c95b431efa3f416e2b364c5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624889340, "uuid": "9832d3c0-7eca-4a78-9285-d9b6eac0959d", "comment": "Malware payload", "value": "32c33d5dac267c0c3acfd582c2e976679d4727ae2ba0a5421c5e5c810576cfbd2e9739b8f3fc166aec008aba82c70527", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "TA551", "colour": "#88E765", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624889340, "uuid": "64d9b007-e041-478e-9a39-0d6e34ea59e5", "value": "5933D058F112DC70DB6FED79A1F950A036A707B4F2906DD26C80A2894EE119DCF2B7C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624889340, "uuid": "3a14e4d4-fd63-400f-9f13-cfedf26704e9", "value": "1536:/TxJMfiQIOf7SieU6ZDvxjxcpAr/USvhWkOn:/jjWSiebvxju4/UchWkOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624889340, "uuid": "3de25e41-405f-4581-9b74-8b61f961340a", "value": 51798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624889340, "uuid": "2459708c-27f7-4158-b2fa-941cc4f0d4bf", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624889340, "uuid": "cc1fea67-f726-43dc-a1a2-ffab5c33abd5", "value": "order 06.21.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2fe1f68-d800-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624878334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878334, "uuid": "cdefcecf-afa2-4e7d-aaeb-e8534d26beaf", "comment": "Malware payload (RedLineStealer)", "value": "8f313f743be20a3b886c6b050ba72b3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878334, "uuid": "87429c41-97cb-4861-8e03-130a2f470efb", "comment": "Malware payload (RedLineStealer)", "value": "8b9237a0fa8c893d146cb658d213f6c2db045c7943c14f83abad0b5057b6c45b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878334, "uuid": "ca56d858-9e24-4d8c-a637-59f5051442c0", "comment": "Malware payload (RedLineStealer)", "value": "4a4aa0f5e9ee0db76fb933f49922a94a180df00f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878334, "uuid": "af030cc0-655d-49db-a950-a311f383dccb", "comment": "Malware payload (RedLineStealer)", "value": "379eec75df83610146e9c1b1b7c2be2c2b9d84196c9cff49c98c7895ae02a0c1e4567cf702e3f3e2f158daeaa338c404", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878334, "uuid": "3472f6a7-4e53-41fa-a35c-5ae6e4ed387e", "value": "3164C2C9FAFB5E27C478ADB455C0931213E0ABDDA55ECACCB8C037DF29A93745824606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878334, "uuid": "f0d4afbb-1648-45d7-9efd-90461b118f11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878334, "uuid": "5613cc23-d084-43f5-a59b-5f47e15f9dc1", "value": "6144:MIQr5z1YEFbZkB1UQxw+pS0Nsr3/HgwtSMdBUhT0Im1:Mb9TOB1ny+pLN2tSMdB4wt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624878334, "uuid": "fa24e154-ff10-4878-b7a4-d8dd9b868217", "value": 316056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624878334, "uuid": "b4ddd675-5963-4eb2-b603-9412c1808c26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878334, "uuid": "46c0593d-43cc-440d-a671-d4a583bf7afb", "value": "8b9237a0fa8c893d146cb658d213f6c2db045c7943c14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e15ae0-d858-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624915835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624915835, "uuid": "037b6bfc-57d2-46ec-ba2c-348984edc596", "comment": "Malware payload", "value": "f3c0e1c2c16f0343f699c90ca85ff41b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624915835, "uuid": "9e21a1bd-df11-4e32-abcb-65107bde1a3d", "comment": "Malware payload", "value": "8bd8682e7afe08e4e1337e0303a6c31afc4b01c898d7b81e7dd1f2ea35357146", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624915835, "uuid": "17222dbb-a775-491a-bce6-f04a6f98ad51", "comment": "Malware payload", "value": "89e7d96372f07a055b07b5835837898247adf62a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624915835, "uuid": "015ce844-1ea0-4d9b-b1f1-7dc57e198e5e", "comment": "Malware payload", "value": "2cb4a48ae38e3426be78ef172b4b6346a5999d89922e140e1a21cbda1d12ad883dfac0b35c0c337db9dd489b368bbb87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624915835, "uuid": "0c052240-be74-4b32-a502-70ea279c835c", "value": "28F34AF63308F56FDA3BC570871066FCA5DA2C3099848827E391FF2966B7784592063E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624915835, "uuid": "86a09018-9edf-4407-a05d-d5bba6d5691c", "value": "04f3e63a532f7914b98c31634d4738cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624915835, "uuid": "aae8d92c-df12-49a5-b2ba-1a614e0f6bd9", "value": "1536:ckz2xCMgbsFFIPonUsmI9dgVcTC+VJQNe1xwykZZEt94cE299hjG9m2xCd:clCpbGIP0aI9dYAJQNegyp9rfefCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624915835, "uuid": "63c841f7-a607-4f53-9e2b-b5169df44973", "value": 169136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624915835, "uuid": "840d616f-54fb-4b2a-8dab-27f989e985d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624915835, "uuid": "6162877c-f93e-4594-b345-00a7c0a1eed2", "value": "Required Equipment SPEC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "303ab091-d7e7-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624867351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867351, "uuid": "b29d43a4-914b-4d5a-a247-2b6a5694f00a", "comment": "Malware payload (Gafgyt)", "value": "5e828ebcec3988538c93d3d95d0e5c74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867351, "uuid": "70e4da76-26f2-4038-9da2-67fa780085c8", "comment": "Malware payload (Gafgyt)", "value": "8e9c98e05dbfe19ac8fb07935ff02c5e809689d28e61cf6a4345116d6d3ef2ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867351, "uuid": "44519423-6ae9-4f11-afe1-9e9cf48a5d51", "comment": "Malware payload (Gafgyt)", "value": "98f21820778f77e53c8da6f343e9d7adbff84b20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867351, "uuid": "cbadd401-dbac-4300-bf3f-20782a9295b0", "comment": "Malware payload (Gafgyt)", "value": "3c57dadefb91fe775ada87441e06f59fe3ae8306d793b2f5cbdc7f0f429dbaf2b3c71034f511403651d8a448aa0db4c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867351, "uuid": "2629c1cc-5f8c-4f92-aa73-a8519ffee8e1", "value": "44B32997671C0B43C55B5AF12D7737F18BADEA7112A221C5E50EFF800B72A701622F9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867351, "uuid": "f844d0e8-4bc5-4140-9039-77ecdcadbfdb", "value": "3072:nBK6nfK8J29dY5QW/Hqxm5hw4ciJPm+7VPDu4gQPpR:nB3fKC2965QGHcm5hw4pPm+7VPDu4gQv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624867351, "uuid": "46dc5ce8-2a9e-4566-a799-80b72ba59df7", "value": 115963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624867351, "uuid": "c058614e-8062-4b59-af27-a718b05d92b2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867351, "uuid": "99606a5b-7ab1-435a-803a-4210f363be32", "value": "5e828ebcec3988538c93d3d95d0e5c74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394443cf-d80b-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624882828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882828, "uuid": "0d61565e-3bbc-4c95-b39d-a0c73dc2e5ff", "comment": "Malware payload (Formbook)", "value": "5944fabf845c892e3db31a480e9b60df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882828, "uuid": "da8bd002-391d-4272-8427-1ceded9b9bd6", "comment": "Malware payload (Formbook)", "value": "90dd1c91600d48f948275aca4c3c95b9230ec3e0d2d2446b76f5f42ad2ee2d75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882828, "uuid": "fd2b561a-c066-4648-bf32-000a91990004", "comment": "Malware payload (Formbook)", "value": "e9430e71f2e6444eecd2137b0e37cc204bcac16f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882828, "uuid": "9e7f8876-8f5e-494a-b03b-01d769d05ac7", "comment": "Malware payload (Formbook)", "value": "6b96348d14f7305cee67abccf32fef71eb0807c60c5327b92f886f86cec7152040b6b00fdfc2b692fdcdb17981658297", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882828, "uuid": "34a05528-2719-42f2-9f61-047ae56ad320", "value": "7B25CFA8329071DFC96BCB3589242C54AB217C66131BD22BA453319DBF3DA97CF111FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882828, "uuid": "fdedb9f9-f9d3-46f2-a784-6dc9c790c992", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882828, "uuid": "edc87826-44df-4f02-8d6f-021deb000569", "value": "24576:xj8NM2kqLd4PFJgEVcQqRmB5FOKmMxeX3IbIG0Nhs:+1qPP0Q3B5UhyeXmIGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624882828, "uuid": "09b97f2c-4e09-4c39-9b02-9a028148fa5a", "value": 1011712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624882828, "uuid": "1a440cfd-48c6-4424-a687-d043a87b96d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882828, "uuid": "f8efcb5d-d58e-4fae-8e54-752c91197c01", "value": "PO09876543456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00173cb6-d7b5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624845795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845795, "uuid": "2ba42dee-00f5-4f76-9579-7db83862051d", "comment": "Malware payload (Mirai)", "value": "01e80d07524f749054bff45acd5f1dd8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845795, "uuid": "7d0c957d-6f6c-4585-99c2-cff10c0cd68e", "comment": "Malware payload (Mirai)", "value": "92a958362a50653375f3b682771743f9e2e2b17f7e4954b44a77e0fd812dde1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845795, "uuid": "c50bc7b6-ee45-4607-8f5f-1398b45d6390", "comment": "Malware payload (Mirai)", "value": "d667d9465fcdcc9844d0f049fb807054dfc351c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845795, "uuid": "1bb867ef-87b2-4809-94bd-c4f086c055b2", "comment": "Malware payload (Mirai)", "value": "830c1c406f357c8e1995853681823f72fc66d8cd751b099a1756535f0b2b45473f67196201efbcdef7d78d70b5af75cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845795, "uuid": "2db05ed5-1681-4efe-a4da-67dd597100dd", "value": "9063F6753945F2ACD6E94078F4436EE91D6209283EDCD1E36083143BFF71B88A62DE5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845795, "uuid": "7c58ceca-93be-4339-b8a6-b65ae1d7e3cb", "value": "1536:RWq4mXBnUM+mxqIKaHIZVBIVCCfy0K9UQw:tUM+/IOun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624845795, "uuid": "65bf6b5d-42dc-4377-b935-1c6b76f583fd", "value": 66944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624845795, "uuid": "bca350b9-1343-4e09-812a-75e3f58a5874", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845795, "uuid": "fac0140f-efd1-4aa0-bc4c-b5bf134947c2", "value": "01e80d07524f749054bff45acd5f1dd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeb1ed4c-d7b4-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624845766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845766, "uuid": "59bc16d2-fd4b-45ff-9e8c-9c4708894f02", "comment": "Malware payload (Gafgyt)", "value": "304fe3262146e2897fee33cc6192ccd2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845766, "uuid": "c0023b1f-ab7e-4c7c-b75a-2c48f68a9191", "comment": "Malware payload (Gafgyt)", "value": "92d80764c80bf0c2ecedb1c7dbf0295c130434a8910180f94681482f8b7ec572", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845766, "uuid": "e2693384-d0ed-4e4f-8800-44be82259073", "comment": "Malware payload (Gafgyt)", "value": "9318238d295c4631ffd56a914ade04872be9802d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845766, "uuid": "2d3d8101-3877-4244-8026-0d84dca87a09", "comment": "Malware payload (Gafgyt)", "value": "a7521978d271235e2da41e4108deaac97cba23560e11d8abc39bf4e2227755a3ec8161cd0984f03c2675e0110a307a81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845766, "uuid": "45fb605a-0d1e-4e6a-b61e-bb48d4d261a9", "value": "EDC3F731E8044B1BC2C223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845766, "uuid": "ed2f784c-c455-441e-8e0a-1fecc87fffa0", "value": "3072:6jVlyaL5JCrIpv04stbttiEiTmP46aQyfPlfKsNb:yoCJCN4stbHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624845766, "uuid": "bec5f6b0-4305-4216-b4ea-0a4da291fb62", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624845766, "uuid": "1fcb425e-0ac6-4328-8e92-803582ab0e52", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845766, "uuid": "9fc0b645-5364-4eca-bc4e-3990414c4ca9", "value": "304fe3262146e2897fee33cc6192ccd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df402598-d80a-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624882677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882677, "uuid": "3a82d3ed-e646-48ea-b1ee-9a22f7e4c2dc", "comment": "Malware payload (Formbook)", "value": "6b107659d7e4b9fc7a1fa1c37b2c26ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882677, "uuid": "ca567956-5cba-4324-b871-613999b0717c", "comment": "Malware payload (Formbook)", "value": "940049a73f4604611186b3fe1f93bec8328d4ca2c486499d5be25df5b5d51ca9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882677, "uuid": "5cb84ee9-c200-4d22-a043-fa2034a78d92", "comment": "Malware payload (Formbook)", "value": "3b25f7c71d738f809c7075cfd72da8de990b4f49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882677, "uuid": "a9da8fb1-f5a1-4246-92ef-fb92fd573ee5", "comment": "Malware payload (Formbook)", "value": "61663ff765c50daa41d5c832d0c755c85a043f4b0153783566747f65de4649386f0c84f5b8f1caf29b33049babfb65cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882677, "uuid": "2f027160-e902-44e2-8cfc-6314ce3d365b", "value": "A3F4BF352EED423AF5BA9F7D96A4244157BDF2236F03C92D78B912C90723682C5F113A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882677, "uuid": "15e9dfd4-c64e-42f5-abff-12d24e79540d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882677, "uuid": "2db0a283-a9f2-4244-bf51-129ff96b2eff", "value": "12288:7PeAaS2Wwuo3/g6ix3o0wljWQBNikAEvpBr8kVUPutHCOO:7P/J2Kx3o0wlCQBNNAEjRmWtH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624882677, "uuid": "cdad5c0c-2044-453e-a7ae-b64b02d403e3", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624882677, "uuid": "498a67a5-d15b-4d41-8384-e17bcd79618a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882677, "uuid": "9a1a4d7f-26a1-4478-903a-7c68d8336bfb", "value": "PO KIPO000903 KIND122822.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5064ae21-d7fd-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624876854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624876854, "uuid": "14c164f0-4db6-4d5e-9fb8-d1b805b8d294", "comment": "Malware payload (SnakeKeylogger)", "value": "e694fc89bb1c759161688de25ef0e1bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624876854, "uuid": "0efb8ec1-f790-4d76-8fc0-d0edd7091797", "comment": "Malware payload (SnakeKeylogger)", "value": "9430f961812df2830e363e3e046712adf30d88d5d6c6d5754faa494d305b3599", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624876854, "uuid": "268eef8a-1967-46c8-ac24-c80df89cfdb5", "comment": "Malware payload (SnakeKeylogger)", "value": "bcf95053bf947c48578ed35978aac3d9c860ad5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624876854, "uuid": "77b78559-e33e-459b-904a-404458aebc2a", "comment": "Malware payload (SnakeKeylogger)", "value": "dc604116f36b7d020c9e41486dac19ab981c3c93633dd9b1d4b351542ce2765fa66d0062cd3b3325e57c0940bc192251", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624876854, "uuid": "3206c0c8-ee71-4a7a-a9df-dce738c6fabd", "value": "D315BE243EE95126F5B65F7C89B06041567EFE232F17C87D68B532C91732A42CAB123E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624876854, "uuid": "b26930ca-926c-4594-91ee-d6907173a606", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624876854, "uuid": "74e40f6b-727f-46a6-9eed-08fbe8f75060", "value": "24576:nLDBmkrvPnQypD+FNmUo9DeEEteONP+b:nNr3Qy8FNMYV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624876854, "uuid": "09c5528a-9c4d-4d5d-a7fc-d0d836902e33", "value": 910336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624876854, "uuid": "93e76c30-5574-48f3-b2d5-fc39d13aaac0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624876854, "uuid": "4396a6e5-6e49-4ad0-8e04-146e1d260d56", "value": "SecuriteInfo.com.Trojan.PackedNET.889.23394.7406", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a268997-d818-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1624888466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624888466, "uuid": "326156d2-7a21-4ddc-9ede-55afe5d35cf7", "comment": "Malware payload (GuLoader)", "value": "480c3643169681b464e69674dbe51f54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624888466, "uuid": "f08f1431-ae72-4944-9bde-33c4e9a35da4", "comment": "Malware payload (GuLoader)", "value": "960787fe16f79546c7ad1096a3f5ab0a39cea0f4ad617720a133f1981e7121ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624888466, "uuid": "e7515a67-e267-4a6c-bfe0-fd268991d45a", "comment": "Malware payload (GuLoader)", "value": "b18541f09999c3237095b8a3f0f46377e3901840", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624888466, "uuid": "657810f0-7a4c-4bbe-99ba-11b7a70bb8a9", "comment": "Malware payload (GuLoader)", "value": "e80016917e4de1fc111f9ae60350cc98b330ee93ee59ca1a3518ce81177fcb2d6df7bbe8ef71734f6f018304bb7ad41d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624888466, "uuid": "08201088-b6ab-472a-8b7b-5370f53f0752", "value": "2A936B2376E98E51E6C78BB60C21DCFA152BBC730A436F0761B17A1E3C31153B961B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624888466, "uuid": "f10243a2-afb7-4dbd-83d5-6ba4d07caf8a", "value": "2985ff75f7931350f11c6168668770a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624888466, "uuid": "538d47eb-2243-4040-a537-ef6e16c048cf", "value": "1536:w7fqEJoXv2zeXuM3WNqXRXq4Ugpkh4D+n5UqwlKntEvM5BxBxkEEuC7A:w7q5Xv2EF6qpRUIkWDCM+xjKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624888466, "uuid": "ee6233ba-d9b3-4bb3-881a-eb8c8fb6b70c", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624888466, "uuid": "c309f3b7-e28d-41d1-9c5f-1a1b02174735", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624888466, "uuid": "ca2b68e5-1aa9-4fc7-9b6e-d6ef6ccc0c91", "value": "FILE DOCUMENT 2021 PRODUCT PLAN 994890480994INVOICE QUOTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204e5a9c-d829-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624895671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624895671, "uuid": "5515faf2-4a9b-4dd1-b0af-b854bcd2fcd4", "comment": "Malware payload", "value": "c5d5a1119e7f7c96342b3ad45ac675ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624895671, "uuid": "c9dba285-6e75-47f0-a688-70ee1a0e1afe", "comment": "Malware payload", "value": "9716e2362f0ca6a4243849b615c0464fa30f7bcdd8537cd8d7feda4ea70a7ee6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624895671, "uuid": "704aa0d0-b657-4e51-ad34-d95eb6ca776b", "comment": "Malware payload", "value": "487c930996706a68fb25ccfc60f346664edf593f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624895671, "uuid": "c91cd0f5-026a-485f-aa4d-74c820968012", "comment": "Malware payload", "value": "d4165b8f0355c4850aee22eb2bedf480ee9a0898b5957f1ff5d6f651adcd3dc2fa4b49fd8751b71b4a30ce718b076daa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624895671, "uuid": "384a1c3e-82b0-400f-9043-304039067bd8", "value": "5E15BE202AEA5125E5B65F7D49B0744166BEFE232F17C87D28B532C91733942CAE123E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624895671, "uuid": "574c616e-7658-4741-b5ec-8778cc943f5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624895671, "uuid": "a34a9a50-d61e-47aa-a3a4-76ed5308e6d5", "value": "12288:helMdwuo3TbHiCl6GWTs8nU9F7xuGJNzH4z7XQc34zgv296Pl4acyQSSw7XCnFMF:hLGzLeCAWtw7hax9/SSw7yF9VgPUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624895671, "uuid": "e78192d6-e546-4865-a9f6-5c4b1e501613", "value": 942592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624895671, "uuid": "f82cad68-d95a-4564-8178-3c40a37d7d2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624895671, "uuid": "cac87fea-42fd-4189-836b-a475e177be8a", "value": "RFQ-09088.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab015d8-d807-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624881085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881085, "uuid": "8f28056c-c9e8-48a3-a8cf-518df070aa79", "comment": "Malware payload (AgentTesla)", "value": "a010180ec459f5a24c4840eed0459b99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881085, "uuid": "d9329f57-0638-4d3f-9f5b-e699fb48a705", "comment": "Malware payload (AgentTesla)", "value": "97f269e6e61c7f17d5bcef7ac5c691d4b65a1732eabaeda0e29ad968cbb31d16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881085, "uuid": "89123476-58c2-4bbc-b124-d95f123c84c8", "comment": "Malware payload (AgentTesla)", "value": "7d43ce68bfc6cbdb14ed26f224b8d0560ffa2e76", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881085, "uuid": "1e3ca891-8eb8-4b0b-a51d-48c233c588d2", "comment": "Malware payload (AgentTesla)", "value": "1af49528e5c6c6b881843e7e6a703e420c19526095b53da5c9149555ddfa65a425caccc7ff9faf42ca339ea7323b8b40", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881085, "uuid": "cc7f3d08-9b6a-46ae-a3c1-c30f247ded7e", "value": "BE15BE202AE95125F5B65F7D89B4748156BEFE222F17C83D28B532C91733942CAB133E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881085, "uuid": "244e5ee9-b14b-49df-9abb-b57087533c78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881085, "uuid": "f4855fc2-46bb-4432-adb1-c45d7a5e307c", "value": "12288:nWwuo3zbrR6JuZL+iuUoAY/LxQQFTCNV9YOhA1m1pZ5vELSgv++w7Aro6VTe:nLt+D/LxQQtm8OISpPvEGgmaC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624881085, "uuid": "dbdbfe86-c000-40ea-ac09-1f05b75be577", "value": 942592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624881085, "uuid": "cb6e8e32-1957-43e1-901c-1e3fd800f57f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881085, "uuid": "1d8d452b-5e4b-4e22-951b-cc5989d7199f", "value": "a010180ec459f5a24c4840eed0459b99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e404c99-d86c-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1624924551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624924551, "uuid": "94e52a6a-d792-4f01-9d80-a04ff66dbb22", "comment": "Malware payload (CryptBot)", "value": "032d50453660fc7d23ef208410fc67b7", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624924551, "uuid": "5610526b-bc75-4129-bb65-d1370338e93b", "comment": "Malware payload (CryptBot)", "value": "97fc461fd24104740310bd741f7f8ebf489e640aa93a0556640455e674f82a22", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624924551, "uuid": "cfe7cf64-8551-41d4-a1aa-55c1b26c4238", "comment": "Malware payload (CryptBot)", "value": "2e2e644445b038c2661d790c433ae3f6311ffca5", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624924551, "uuid": "9fba6692-ed73-4eef-a0f9-99c4a98af22a", "comment": "Malware payload (CryptBot)", "value": "b06fbbf11c3d1c33fb8729e535eaaf9c164f956664199ad64f4b449b78cff09d663fc94f76ed76e8093f8cf1a5d3a79f", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624924551, "uuid": "4b8d5681-63bb-471c-a673-a330d342c8c4", "value": "25E53313EBE038F1FCB69AF649754464A199B4212C3FE1B0F787849D3036CA16865B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624924551, "uuid": "9cccae5f-001c-4a93-829f-0c1640062b3f", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624924551, "uuid": "50f865aa-a42c-4cfa-9ac4-6d7358367ec6", "value": "49152:+1MiChfIsR/tm5/kf77VEFVMAYHfwxSz7rJJdusWjMqBLuF9q91IVOGAf:2v4fIM/QFe2FVMBHoo7rJJwvLuFg1ete", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624924551, "uuid": "6ade4493-42d1-4c58-ab46-6a880e1e2c5d", "value": 3114376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624924551, "uuid": "94d3f020-a951-4e19-a04b-8b07c18d260f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624924551, "uuid": "99bfc285-a1d6-4796-8cfa-d0e7d2b61bce", "value": "97FC461FD24104740310BD741F7F8EBF489E640AA93A0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096a4e2f-d819-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1624888760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624888760, "uuid": "b1ce892d-fb46-4665-ad06-781c0891e6aa", "comment": "Malware payload (BitRAT)", "value": "c974bffe4c0caa1106335a643f4aeee6", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624888760, "uuid": "5d9005cb-e0ef-4cfb-9b66-3abbfdd242ef", "comment": "Malware payload (BitRAT)", "value": "986909ccdc258f70bdb98363576fce9dc101142c6528d588f1308edceafb9ab5", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624888760, "uuid": "78bcaf2e-8fb3-43b9-8bdd-cad60191471b", "comment": "Malware payload (BitRAT)", "value": "f7a061b33866185f317e954b31bf9d8607568ec5", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624888760, "uuid": "14ec7d6b-430e-4c7f-9553-868f7fdff3ed", "comment": "Malware payload (BitRAT)", "value": "179a6b1f2ba8c1e50225340c39bb74a0e7f71ea8b83c3120f0d4ff9c18ffcbde4d8ecfc6413f3b776c6d5fede610711c", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624888760, "uuid": "5542f016-b0ac-46cb-853a-2d8d14b9995f", "value": "40C5F12E36F3AAFDE906C1761185CD301EA39DD1A88AE90EB7DE1D673FE0014A90157D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624888760, "uuid": "13c19eb2-5291-4497-a73c-902a23333dba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624888760, "uuid": "e3fe4ff5-4775-4fb3-ab98-b422282c7745", "value": "49152:0uEH9nnoJ2DyFmM9Rub4+UYwjR3TjDVt4XHTC2gnwCwTIfC:0uQO2/M9R5L9DjDLiHTDrrKC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624888760, "uuid": "c04b2147-304d-48eb-8a44-7585d63595ec", "value": 2674176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624888760, "uuid": "bc9795b5-2fed-495f-8faa-a6197c00f541", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624888760, "uuid": "920c5442-0372-481b-9b63-0c576c30f685", "value": "edi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8262d25-d7b6-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624846507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846507, "uuid": "cf6bb97c-84a8-4216-b2f0-1190b3430e09", "comment": "Malware payload (Gafgyt)", "value": "458b3c68f8398b3d4d3a84a062266b63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846507, "uuid": "3f306408-2531-4327-86ac-88ff05745f1a", "comment": "Malware payload (Gafgyt)", "value": "9876b95dc2b560a008a73d033cb745cd9bd123d0efa94ca25e9139e55a7d785c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846507, "uuid": "dff2d25f-ce4e-4937-95f5-adca9f3271d1", "comment": "Malware payload (Gafgyt)", "value": "de29eadb481dd6a2e8886819810087935fbaba26", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846507, "uuid": "933bbe6a-a50c-459c-a18c-9cd5b1309a78", "comment": "Malware payload (Gafgyt)", "value": "3b636517527b61e25925fd5272be85ede597db94c446e8f02b81c95d67716595053490c319f2311adaa7f48eb75d480e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846507, "uuid": "dca7f3c5-f32c-4fcc-8171-c93f08708837", "value": "8BB31A37A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846507, "uuid": "916de95b-b950-4939-8ca8-a1e7ce6e5254", "value": "3072:pC/4rdZHsXsZwwR9HNk5mm/QcuLmHniPNb:pCwrvHwsZwY9HOmm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624846507, "uuid": "b2e91a9a-ca3a-4751-8b2a-cc8fc1fbc478", "value": 116786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624846507, "uuid": "0d655653-1e04-4bc6-8e77-908de2867f4f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846507, "uuid": "b447dd6c-b693-4a13-b0d4-d6f739545daa", "value": "458b3c68f8398b3d4d3a84a062266b63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ecb4cc-d868-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624923054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624923054, "uuid": "17794f50-6716-4d97-b431-6a48d1141116", "comment": "Malware payload (NanoCore)", "value": "205abd11f4195b68cf127514f33b7533", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624923054, "uuid": "cf9ca723-cfaa-4808-ad4d-0af860361f4f", "comment": "Malware payload (NanoCore)", "value": "994a876850c76b1ba0693f3182714023644b5cfc1e531e46dde64b7b47bf5742", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624923054, "uuid": "c6132211-a62e-43bb-a1c1-c4c904d07fe5", "comment": "Malware payload (NanoCore)", "value": "7a5e3523214c5ce5d7577aa7b1dede6f96a24be3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624923054, "uuid": "94e3f5e8-3e2a-482d-bb3e-bdc962d9ed01", "comment": "Malware payload (NanoCore)", "value": "af1c5d10e31a247050c6d97bff393ba44a95563144150355a5bd39efc551ec616d9ce879860309e7a98d666829482fef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624923054, "uuid": "5e5d3ebf-c011-4029-a04c-8ca545db8247", "value": "46C4125977E9496FE28E8679611302525378C2D798C3F3EE18D822F79F263E54A070E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624923054, "uuid": "794dfc6d-5c97-412d-8e71-600d6b09f53e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624923054, "uuid": "34e75e49-4d7d-4dcb-910c-2cd8d71346f1", "value": "12288:WLV6Btpmkft2vA2qb+/RZ/4nDc9IxUVVmKQJWQROy5jsWe6b+zeY:EApfovh5mDMIQVmKd1iY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624923054, "uuid": "d198439b-4064-4b83-8c79-7a9d951f5f87", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624923054, "uuid": "887e6fe4-c280-40b6-b6eb-f59e88b3565a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624923054, "uuid": "07e854eb-8914-4352-b579-1169c13a0a47", "value": "205ABD11F4195B68CF127514F33B7533.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2663fd6-d810-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624885178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624885178, "uuid": "4b2d1ffc-14a6-4f12-8957-c01eafe0be1e", "comment": "Malware payload (Formbook)", "value": "96e92a4922fd91f5f1dba2d9550b0f8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624885178, "uuid": "f51b7f92-b2ec-46d2-b2e6-3e9093b5fcc4", "comment": "Malware payload (Formbook)", "value": "9f988a3199e626f789a99578c1c69f0ccd3e13d7c0d1033c01270cabf7b61de4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624885178, "uuid": "615b33b7-967d-4b20-a620-a527c7c39331", "comment": "Malware payload (Formbook)", "value": "0c1191769d0eb18c6de8d703f540184689900ae7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624885178, "uuid": "5a701ac8-c013-410f-bf4c-17102d1c9c26", "comment": "Malware payload (Formbook)", "value": "3de51a972a61168181c33cd493c028d6fdaf4c2f086fec82947483cf619e40925cc5f7640095b11fb9633585f2854b3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624885178, "uuid": "b11938c1-7019-4b58-82d7-f5fa5a01f7c4", "value": "FCE2B389974405BEE04DD67FE3C28A35EF32879F3926DD196D7E81FB1A162470088B1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624885178, "uuid": "52b5d91a-116f-432a-b4f2-c282e6ad15ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624885178, "uuid": "a84445a4-95e1-4815-af61-3ae5c6d39854", "value": "768:KkYxQZ6++hIduJJ1U1NCOLtuEYzob6vWccgcccI5BrZIYaF/kgWzC747/SPD4uCt:KkYxQZ6++hIduJJ1U1NCOLtuEYzob6vJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624885178, "uuid": "68a3bba9-12ec-4ade-bcf6-7e31d083fc00", "value": 33968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624885178, "uuid": "d13ae309-b7f5-4654-acac-90eb4a092fe3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624885178, "uuid": "a1273a14-bfbc-45d0-8fbd-982b74455270", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.7562.2738", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c10577d8-d800-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624878331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878331, "uuid": "2868abdd-a098-4224-915d-2ee9dc24202f", "comment": "Malware payload", "value": "6b2f67ac804c04cce6b1404a27013ca2", "object_relation": "md5", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878331, "uuid": "32b05fd0-477e-48a5-b23d-3d91722f2955", "comment": "Malware payload", "value": "9f99cf2bdf2e5dbd2ccc3c09ddcc2b4cba11a860b7e74c17a1cdea6910737b11", "object_relation": "sha256", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878331, "uuid": "5fe5f560-f687-4be1-8280-494c89d3810e", "comment": "Malware payload", "value": "1bea1c2715f44fbfe38c80d333dfa5a28921cefb", "object_relation": "sha1", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878331, "uuid": "7d41409e-d804-42c0-8752-449592190a34", "comment": "Malware payload", "value": "168b5e861fc63555aff51e8e7d804d3c28f50298b8aa4a29bfd0ea5f8ce7adbd08b0b54ce50d2d9d0065b13a159f6889", "object_relation": "sha3-384", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878331, "uuid": "d79b310d-3c39-435d-8c29-c54e73a306bc", "value": "ADC2FD6935968256347EC8B6F284D8F70706FFA2D1FC62E1AB775A43410B863C22C9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878331, "uuid": "4c010277-03f7-4de9-96a5-881b8f69bb2e", "value": "768:ouQMhQqFLqNlW7KyYhWmBI2DDDWcccQmrH9lNW:outu0vYhLBGEd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624878331, "uuid": "f2b46ebd-91ae-4189-8375-a3dc11e48fe7", "value": 27449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624878331, "uuid": "c880e542-b96d-4f86-a0d4-5e12adc7b242", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878331, "uuid": "7c66f287-d265-40d3-8764-fb03d9b29ff0", "value": "9f99cf2bdf2e5dbd2ccc3c09ddcc2b4cba11a860b7e74c17a1cdea6910737b11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451e09ef-d858-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624915919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624915919, "uuid": "df9d17df-2a08-4fc3-83f6-4170cde0286c", "comment": "Malware payload (Mirai)", "value": "3bc40db5aca7c1b54cb77e86e08d2e5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624915919, "uuid": "46c747aa-501d-44c0-8004-ea38e7096085", "comment": "Malware payload (Mirai)", "value": "a16f778f66eeb1b58d259fbbd36e9a461500f9e3d24a202b6f8b599bcddf1820", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624915919, "uuid": "835819d3-9f94-4a65-a668-e7de5d9ac1ca", "comment": "Malware payload (Mirai)", "value": "229856e45e1b6ace41e5afc47db897167cdd8cff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624915919, "uuid": "d025ba48-1ef8-4c43-a2ac-2534601bd07c", "comment": "Malware payload (Mirai)", "value": "4566a0d7c5159fba3e618ab49b8fcebfe5271a21b06d934d1af42f4220778c484c67383064f434b6ad74cfd89e84e753", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624915919, "uuid": "3c02c91d-60ae-4303-a8a6-9ec6d15a2ce0", "value": "E8B3D662AC829A2BD6E3137AF6BE558E332037E5D3CE71168C210B1076D595F0CA7F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624915919, "uuid": "fac3f1cd-4cb3-41be-aab9-0166013ff00b", "value": "1536:GIcHq8Yf7hJ8CogGlVOhDtM2zsbw/zYKGgY4HD9i4io/Y6fuz//8P0TANn0tuQ05:iK8Yf7L8CoonHBio/Y6fQAEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624915919, "uuid": "deef8ab5-c50b-49bb-bd87-095e8ce1aaaa", "value": 111932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624915919, "uuid": "3113e86e-189a-4aad-a651-ebc6600ea0c6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624915919, "uuid": "e663ff17-b2f6-4a76-b751-8768a05ab659", "value": "3bc40db5aca7c1b54cb77e86e08d2e5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd88d8d6-d840-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624905840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624905840, "uuid": "63c87b99-d42e-4d6b-9dec-cdadf5d304d1", "comment": "Malware payload", "value": "5d4452a731eacb29e2f21386f2b04ab6", "object_relation": "md5", "Tag": [ { "name": "csv", "colour": "#EA7260", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624905840, "uuid": "693c66d6-474d-4da5-8725-5fe4074f2eda", "comment": "Malware payload", "value": "a4d269b8f1d1de24ed69289a4992f0c3479fed1ebdcff6f14d57bb2430f2e9e9", "object_relation": "sha256", "Tag": [ { "name": "csv", "colour": "#EA7260", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624905840, "uuid": "fcff3a82-61e3-4ce1-96c5-426bcefdc56c", "comment": "Malware payload", "value": "124b52c75a9f3c35cb4da66e28af45fcc19d2bb4", "object_relation": "sha1", "Tag": [ { "name": "csv", "colour": "#EA7260", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624905840, "uuid": "a8f5eb8d-367b-4d03-9d7a-5bb4e3323318", "comment": "Malware payload", "value": "b3d55331721aa0c8371eddfb106a6313b78f9b2a17b29fdeb5b00d90dc5b6febbbe27bce26a2042ce073e8c8623cd345", "object_relation": "sha3-384", "Tag": [ { "name": "csv", "colour": "#EA7260", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624905840, "uuid": "22372399-a57c-4123-bea6-17d90deb686a", "value": "5353CE5E5D9FA544231368693E8BBE22600105E1C117BBD2B87A938B8D127E1CCF65FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624905840, "uuid": "7631db63-053a-48ec-9fc0-c742cb01b46e", "value": "768:5ZZeZXZZVWJvIjNZz808BNQu8uupKKKYLmm+uQAyZZaSNEEJKs44Ahhhl:5ZZeZXZZ6IjNZZKKKYHQAyZZP44Ahhhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624905840, "uuid": "2d95abd4-aa82-41bd-965b-147e76ef0569", "value": 63573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624905840, "uuid": "ea379fde-d657-45cd-89ed-50fc52b947df", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624905840, "uuid": "5b05f184-6a0e-4010-b7ac-008d18cdad0b", "value": "SIPARIS_23.06.2021.csv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d27d1cf-d807-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624881063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881063, "uuid": "7b6fe716-92af-4541-b733-44e4a44e42f1", "comment": "Malware payload (RedLineStealer)", "value": "aeadce21ef9e2c3a8a1dc7f421efee0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881063, "uuid": "4a596b92-ab83-4f77-8454-ae618277ae77", "comment": "Malware payload (RedLineStealer)", "value": "a50230b84026c62ef0581522a24fb4be4d033d756eaf8cf5c9e822c4fa9f46bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881063, "uuid": "c0de7507-18ae-43e3-a230-228f9f37bcf9", "comment": "Malware payload (RedLineStealer)", "value": "638ee046f59b7b94771f25b7812ede67c4697d15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881063, "uuid": "316b7ac6-29d6-471b-b2dd-b088df53c807", "comment": "Malware payload (RedLineStealer)", "value": "54f8784786677bbad743f7ac498a18a9affc3241a4e49d567a00c2865523c10bf36ea1393026b3592123e84d6cd791e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881063, "uuid": "8aa2f95e-56ad-4144-82f1-3313b3bfa649", "value": "6634BF0676C94BA1C8D446B5C2E3442543F2AB47EB33E6497FCC09C90E92BDE499E7C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881063, "uuid": "b649ad90-7d3a-4d2d-b7af-6013271cb40c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881063, "uuid": "30c2a176-1555-420d-bd70-765f8a6b30e5", "value": "6144:GVknW2yRr4snbWkJhHgKk6W4J30KSRbugY+5:GnBQkJ5gK9jSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624881063, "uuid": "06572a15-8e9f-4a99-bbc8-525e52bf4681", "value": 243712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624881063, "uuid": "a6640c4d-3c7d-44f8-bf1f-db7fe2091c5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881063, "uuid": "f5a2cc0b-c941-4187-aff5-0bc7a06b8a78", "value": "aeadce21ef9e2c3a8a1dc7f421efee0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe6939d-d7a3-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624838406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624838406, "uuid": "9077228b-70cd-422b-ac19-2c120842d2ae", "comment": "Malware payload (Mirai)", "value": "aaf3f2bb230a2f15f88507c6a0ea3458", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624838406, "uuid": "1252fefb-650a-4774-9dea-988ab72ad700", "comment": "Malware payload (Mirai)", "value": "a5a452e5f0c83c065a5dfdd6c476d1329ddcf2f44edbd7ced2b0b99f72b22795", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624838406, "uuid": "bc3f5a2e-accb-4465-95f4-b76bc13f0270", "comment": "Malware payload (Mirai)", "value": "58fa24008b008c5bd7170be303307d95bed4daa4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624838406, "uuid": "38a4e485-2b41-4ccb-922a-5c8211bbbe49", "comment": "Malware payload (Mirai)", "value": "09702f41a59b02acb8fd2164cdcfb99bee8c91787e887fd51cc34c525a0e08f55f5eb71a0e886ec99010a9de96e5c107", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624838406, "uuid": "f2453894-f338-4c7e-a104-21f8b7b78e20", "value": "68534B0277684F07FAE61AF4243F1BE483BEED8025E4B588690FC7424635E334999E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624838406, "uuid": "6f06465a-c0ea-4e6a-81cf-2cbfc0c906d1", "value": "768:Sr5Eg6nb5usRVQq8WTUqYhcBJcIGsllk5M9Bv6GG4TlW2c5sjgi+DDiZ/vgBbsVf:2KbpuqJlzk5xGpJgbDOZ/vguN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624838406, "uuid": "f6ab50dd-8797-4f29-9c3b-6225a1098f03", "value": 66468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624838406, "uuid": "f9cedc74-e0f1-40d4-a4bc-7351cf1e3b5f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624838406, "uuid": "975dff34-3b5b-4f59-ac85-04c6f4037842", "value": "aaf3f2bb230a2f15f88507c6a0ea3458", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2426dfe-d7ef-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1624871112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624871112, "uuid": "cd581082-a459-4745-b8fd-69cd4be02e59", "comment": "Malware payload (CobaltStrike)", "value": "1089b93a4a286283523deac740716ebd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624871112, "uuid": "22986a8a-82a5-4209-a1cc-b5504a337963", "comment": "Malware payload (CobaltStrike)", "value": "a5a4d88e2fe16d319aef6f7550ca2379d253a943d467dedc21e7ea3deb19410e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624871112, "uuid": "2cc1112f-4950-4eb7-a4a7-57a8102a33a3", "comment": "Malware payload (CobaltStrike)", "value": "0638b4b285c85709b83148ceeec44948644d6eac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624871112, "uuid": "973b6cf7-0e1a-4489-a364-74f854c1db76", "comment": "Malware payload (CobaltStrike)", "value": "f64f5810c3ae8847e921c45ec8cd2851d81eeb0a1ffe551d04a2ccd312cd9177cf5ccb65a0df5573fa82132c304c352c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624871112, "uuid": "b6739d1d-eeed-4c4a-935b-7cc80d461d41", "value": "AEC52302BEC5A9B1C6320D36091AEB15157CBE508F14CB9FB7D89D1FAA350C0A365EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624871112, "uuid": "de514b81-4a3f-4110-bba5-625f8faf7b04", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624871112, "uuid": "7dc48345-1fc3-43a8-beee-204f71cced3b", "value": "49152:7849/C3dg0+hMc3i6OO8Xn//9khY5Kxw6Oo/zWKigP4+JjbXhDQy3xa:7S3dg0+3i6OOokOKxw69/iKis4+JjDJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624871112, "uuid": "efe53ea6-5b30-4c6b-9880-8ef8bbd41bdd", "value": 2717493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624871112, "uuid": "0ce29242-e0a5-4882-924e-5353191524fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624871112, "uuid": "f5f5795b-3c39-4ceb-8c4d-beb151089959", "value": "1089b93a4a286283523deac740716ebd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de1c10b-d7b5-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624845845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845845, "uuid": "98afe376-1bd9-4540-a382-e78cbc4e89b5", "comment": "Malware payload (Gafgyt)", "value": "2258ac4312d6c4dfe139ea5405279869", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845845, "uuid": "56523b6d-9cca-4dde-a121-0a2542a1e602", "comment": "Malware payload (Gafgyt)", "value": "a71b1b13c01ece59b36e877b7fe93308286e098f8f0c42b217579003e4137aa4", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845845, "uuid": "a4b488d4-8b6e-45b8-a54b-63f540faccb0", "comment": "Malware payload (Gafgyt)", "value": "7e0f3663205af34ce26a6f8b8e4251d94e0d9150", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845845, "uuid": "01bc9da6-ffe3-4848-9bc6-0e4bd7acd96a", "comment": "Malware payload (Gafgyt)", "value": "26d5c50cc6e6a1a374b0209c4f123ac5df0385d97b0ac4d30b8470694f1275234f3760074d19eabd50c71117dea80554", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845845, "uuid": "1f759782-c607-4dd6-be15-d93e1b92ebee", "value": "66B33B376251C97AC08356F427EBC5729D13BCBB0B32219A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845845, "uuid": "be6fb496-3371-448d-a727-9b146244191e", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeAR+TRCm7FnVqfJXFWbNb:T9a2aLqkrMssm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624845845, "uuid": "0e84608e-c716-44dd-8797-689ffaf0da46", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624845845, "uuid": "cb99b242-f780-469f-8d95-1d444a7668a2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845845, "uuid": "f1b33c91-8402-433c-b3ba-c7ead85acd04", "value": "2258ac4312d6c4dfe139ea5405279869", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3399af-d842-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624906613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624906613, "uuid": "e570ac3d-61e9-4213-a66d-23f357b9f202", "comment": "Malware payload", "value": "2c5ab5b0e57c6429dfaddfeb0b6eefad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624906613, "uuid": "094c2184-2b51-4d86-ad55-7fbb38eb6c6c", "comment": "Malware payload", "value": "a74314ee9404f7363f9dfde6509456e726384e66484588c6f3a99e5ba846c69c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624906613, "uuid": "4cfcefa4-fde7-4585-85af-294dab8bab93", "comment": "Malware payload", "value": "44732c3b0be0233a2774be80d97f9366254d2b74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624906613, "uuid": "5242f5dd-d53c-4642-9ee0-6171188a6806", "comment": "Malware payload", "value": "cc8743f4240bfece44b8f46384e18866ec4ba12cd9dc04896ae17a4a577b795a6dc0029cb6538dfee3f2f4a62ee7b507", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624906613, "uuid": "0701d02e-ff58-42a2-9b1a-4ccb95a3419c", "value": "5303D18FE8783CC8D69C4D3AD99C11A9BD4CB486825ED29857E60D9BDA4FC077E0D40C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624906613, "uuid": "cf2e3a6d-2555-4475-82a8-e24d01362fe2", "value": "768:Hdi2CrRvrGAH5rvSePYhWxmQ8q+ZiJhJEdt4nXilCi96YXzqulANpWRhd:9i2QxGAH57TuM1FiUe6Gzqod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624906613, "uuid": "a134bd78-01ae-4cb9-a8b8-4984ace1a6f8", "value": 38028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624906613, "uuid": "4de3a080-4a22-414d-a35b-844be36f29d2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624906613, "uuid": "6c25916d-6a04-49ed-8439-85c6bb17fe93", "value": "2c5ab5b0e57c6429dfaddfeb0b6eefad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "655da372-d803-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624879466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879466, "uuid": "ecc2770b-f878-4262-b41c-0990579c1b48", "comment": "Malware payload (AgentTesla)", "value": "bc16b8416398b0fb0026be982e81a903", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879466, "uuid": "63a56441-6d17-4bac-a4e9-cc4d537da7fa", "comment": "Malware payload (AgentTesla)", "value": "a841562af528c284fe0e30a11862603d4c97f16cc0f81113d85fcc72d7ff9f6d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879466, "uuid": "84355797-94e2-400b-a4f9-4333f52b76cf", "comment": "Malware payload (AgentTesla)", "value": "f36d2cd6edf8f951179530539e009982bf0217de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879466, "uuid": "43ed573d-bfe1-4b5f-a342-b74bcb71453e", "comment": "Malware payload (AgentTesla)", "value": "a40d8b96579c15cd2368c14837369316aa1c4bee061c3a92ff6f7eb34209f9427d6706e7644f1fe17ce210ef6a4c5ca7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879466, "uuid": "4b447400-cb88-48ba-affd-9a20680ae8ae", "value": "694512E878C80659C0E96079F7364B79A3293E3639D88A3B719C3366F93C4742D63794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879466, "uuid": "5d33b503-8bff-4f89-be40-956756b16d0f", "value": "24576:b3gSL5RxZ9rZ5C1vAfMHFifnGZTzltlFtHOTPkzhSLVVU6wTy7I:b3tL5RxfrXCFAfyU6FtHOTPkSLVETCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624879466, "uuid": "fc106f08-8a8c-416a-8af0-b70bec023359", "value": 1263048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624879466, "uuid": "53d1749f-7d36-4d59-a9bc-f550eaa58447", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879466, "uuid": "bcb86116-4bf0-49ca-8050-83a369be971c", "value": "JUNE 2021-SOA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ed62964-d7e9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624868315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868315, "uuid": "7b8378a9-49f6-4762-84d0-46693cfbab6d", "comment": "Malware payload (Mirai)", "value": "3ce49f12bb2bb7e1d79d31bca9b969ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868315, "uuid": "273bb5ea-0f82-43e3-81a1-f7182c748dad", "comment": "Malware payload (Mirai)", "value": "a932a88477ee7b2a2904acac5f723f736f393edcc26aaa96f493a27a47fb81df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868315, "uuid": "dee4a794-86f3-4001-9fd1-37b5a8829536", "comment": "Malware payload (Mirai)", "value": "6611d10d1d0f37f223aaa001bb1f6c15f569b52b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868315, "uuid": "427c7214-b4de-4812-bd38-ede154ac92fc", "comment": "Malware payload (Mirai)", "value": "ab49bf18f41e5f585ddb0a9353570797045b3ee928b384f8f9f1367507a76c46b8f55c24427b88a6228caf8ca7271651", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624868315, "uuid": "449998b9-a94e-4290-8ec5-722aa964287b", "value": "7EC209957981AA6EC2C1E176FA3E629D735163D8C2DF33138A105B117E87A1E1EA3F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624868315, "uuid": "01ad824c-8e02-4e29-9ca9-4de7b8fbbbba", "value": "768:K35sR+vPGsT0gGuyKZVDyPmup2XXvq8QWz2kugyLE1:8K+h1Guy+V+mo2Hycy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624868315, "uuid": "636e561f-bcf9-4fc6-930a-39dde15e3fdc", "value": 26972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624868315, "uuid": "34aa78d3-0662-4cab-a843-4650396982ad", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624868315, "uuid": "50846529-3afa-4d24-896f-7ec741508d55", "value": "3ce49f12bb2bb7e1d79d31bca9b969ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f505a8-d840-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624905820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624905820, "uuid": "cd097761-497f-46c4-849a-c71a0f90d438", "comment": "Malware payload", "value": "e5cf5166f0d46a95a29ac3887fe4856a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624905820, "uuid": "95c09dca-4f29-4220-82f3-88b20e82d686", "comment": "Malware payload", "value": "a98d5bccc785dbf5f1d3930aa6ce1c293097b5e4228a1d34b40dbb9ff875f9c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624905820, "uuid": "317d272c-437a-4a7a-898f-579c73928150", "comment": "Malware payload", "value": "92edf813b82c5a48708f0172aaccb18b183f82af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624905820, "uuid": "cfa3aede-df6b-4269-b7de-32502ec6a463", "comment": "Malware payload", "value": "95b89b30c25166080af5c94e0aa26e903ab44089ee69b7cebf3b544c48ad7eb7815b5701e9b81e958e35f4c0cdebfb4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624905820, "uuid": "314eaffd-af75-4640-b618-be6aeb5ef085", "value": "CBF2F137908949D0FEFE5DFD0985ABD503C107E69A634FA293795218CCA05C3A92F8D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624905820, "uuid": "c6f3b6b0-7a2e-4b7a-b513-68a2748e846b", "value": "768:KOOz8lPPpQDMIfsvpmhA4SHr6tB56GSwBr8n74lRR8Pnb4uVcqgw02TWXE:FOaZcIRmmFHeL9rw74fc4u+qgw0cWXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624905820, "uuid": "0711c9d8-f631-4acd-ae17-cef11c70c649", "value": 35184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624905820, "uuid": "d5df6a02-ee3b-4f8f-811f-55ae71f37fbe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624905820, "uuid": "6524fa0e-515d-41bd-bce6-661ec44f0ef0", "value": "e5cf5166f0d46a95a29ac3887fe4856a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9eb6e7a-d7b4-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624845785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845785, "uuid": "a75628c0-74db-450a-8cfc-fce3694fc299", "comment": "Malware payload (Mirai)", "value": "1ebfbdceb797ba7e25576c85456df3a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845785, "uuid": "6bfaf37c-bb52-4fa1-a7ca-e381e4f3ce2a", "comment": "Malware payload (Mirai)", "value": "aa5943c304242188d368731d900c8bbeb34773eae854c74626a8f27374a6961c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845785, "uuid": "d4b58546-2e01-4340-bd9b-54a43cce73f4", "comment": "Malware payload (Mirai)", "value": "d6dec52223563386af0235f1e13ebdce1fbd60f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845785, "uuid": "304fd918-3206-4917-912a-52def64a3ad1", "comment": "Malware payload (Mirai)", "value": "f35ad0070357c69a41ce04b5e1bbaf2fe10a8c1790144a21fa1311e11fb76b8c65202167dc7e6a1f0a3010c3d25cb46e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845785, "uuid": "b257c1be-8a5d-4b7f-8ceb-4e87003b7b1b", "value": "31538D66D5B85DA4D49849B0762CCDB44783A404AAD33FF1C683CF694807AECF509BFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845785, "uuid": "1b8aac55-7510-4cc2-8611-2203704acf68", "value": "768:K/BAQypMQaevVKqGwBsZmhwHzFtXWvAMDiPV44g5N2tS7jDtzL5QfOv0QD6in3ki:K/2HmQaewO2xUDESPz8YUPXOpUCgA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624845785, "uuid": "9b2551df-0b83-4d62-9527-f9aeda12fc1d", "value": 63840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624845785, "uuid": "95d33fc1-8742-4519-9c95-b2024e7cd92b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845785, "uuid": "29291abc-25e6-4179-b2f0-9ca855fa7de0", "value": "1ebfbdceb797ba7e25576c85456df3a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48bdbff1-d812-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624885860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624885860, "uuid": "faae4b61-58cb-4422-a38e-08ee3ca3ff8e", "comment": "Malware payload (RedLineStealer)", "value": "1d9f9848100ac9b001d04ccde39207d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624885860, "uuid": "9aeed578-48df-4cfc-8c34-01f62f214fa5", "comment": "Malware payload (RedLineStealer)", "value": "ac64b119e5e058da8ff2c0a9f20e9273e1eb82f1734d142236c39b9b86df10bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624885860, "uuid": "024f5029-2f81-4177-8a00-0d7ab211dcce", "comment": "Malware payload (RedLineStealer)", "value": "874dbb34de2f5d82a399fa49aa136dc7e45642fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624885860, "uuid": "8280d3b8-84f6-44fa-a28e-c7566205696f", "comment": "Malware payload (RedLineStealer)", "value": "f18fabc3edbe9c953a3008346a472b9e0fda281789bd8a6d0860062df01070751a6b113f3a84a36e89caf131424e5a80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624885860, "uuid": "fb53b3d0-08a2-4121-93d1-9b7dbe58fad9", "value": "01741528647FC01985E3EEA12DDCA8FBD99A95E3640C743701B4633B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624885860, "uuid": "e2842384-5447-43d2-a9e4-c78cf4dec5af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624885860, "uuid": "6070d869-7e02-4e46-a66d-ad84a4dd8652", "value": "6144:745Yqofb4b/Eaie1uBW7L6bc6Tv/30y0hvp+E1:85Y3fb4b/Hie1uBQL6bc6Tv/3n0hvp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624885860, "uuid": "70f95ede-c177-4aad-9f40-ae33c32c01c2", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624885860, "uuid": "f895422b-d510-4f01-8e25-812ad5105daa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624885860, "uuid": "01ac0e03-197e-4e46-8f51-e034e3244f58", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250fa5e2-d817-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624887948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624887948, "uuid": "68e227b6-8b4f-4bf8-8a58-56ba7a6a60d6", "comment": "Malware payload (NanoCore)", "value": "ac1a85521ed7e7d1f7bb19145008aa96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624887948, "uuid": "64f96880-41f1-4b70-aff4-7780923a149f", "comment": "Malware payload (NanoCore)", "value": "ad0503c4cdc684c28e25e49db49e73b5727066438f181050124b5eb9e488a3d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624887948, "uuid": "4ea1af29-e8e1-4002-b0c6-24829da5ee5c", "comment": "Malware payload (NanoCore)", "value": "2e8aba28000a14f6ae4ad5ee9c6dbe14124c5db9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624887948, "uuid": "f39a5ec7-2123-409f-92b7-5948069c1919", "comment": "Malware payload (NanoCore)", "value": "4bd42300102ad4b9733558fb4b43ef9d6aaed5195fa915b4e360524abf8f55ac6ca5227dbe346d5122d612e00a9fd37a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624887948, "uuid": "9a3428f4-5b12-4931-adf2-79daef2712fc", "value": "95D4DF003ABC6B52E978D7F95DE1242017FA3D6F7A6AE2082DC171DB2672F404A51F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624887948, "uuid": "a0ac4f70-157f-4794-9ef8-81020bad3527", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624887948, "uuid": "afc48302-4401-4a7b-b0b3-bb65ca9a3b1e", "value": "6144:xcGnzulalQ2+dE4IpSEMRoCwTejfclcDaHYiwzmJ/tXpG656HuuHlxBwxK6bhI:xdu3d1qSoT6j/a4ipR6HuAGPb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624887948, "uuid": "50fd0334-f334-4abc-9c1f-e905ef3ade0c", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624887948, "uuid": "69d30768-519c-4abf-b82b-0f05081731ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624887948, "uuid": "c2d3510d-3f35-49bd-95ab-64a38ab2f0f5", "value": "1000005536 - UCML.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e672029b-d858-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624916189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624916189, "uuid": "5a7330ff-b4f7-493c-9f6e-b3e96e81bf69", "comment": "Malware payload (Mirai)", "value": "4ad915d23eebbfce27a551a0c73bf344", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624916189, "uuid": "bde98424-cdf0-40aa-b735-2a4e87c3d85e", "comment": "Malware payload (Mirai)", "value": "ae542aa6976829d8a000c61a29e6647c9a5653029e94ee3a430890aa23a50f51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624916189, "uuid": "e3f50b91-7802-49bd-b3b4-281907b4a69f", "comment": "Malware payload (Mirai)", "value": "c72d7e334c2ddea8c55f9c722d26db3c73e70096", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624916189, "uuid": "6c5bbd72-c217-4841-b2bb-54d73b929eec", "comment": "Malware payload (Mirai)", "value": "cb4fc12c691609fe96c16f8891d03ff89896aa74e4e5af5a1948a7389901a5a15785769e1938f26124ff2cbc827805db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624916189, "uuid": "361a2eca-a303-4fe6-bc67-f9695f879de0", "value": "C8B30A89B4024E2CFA4BD9FD54254E0AED51638162930F1B56ABFED37C73167BE02D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624916189, "uuid": "8fe252c8-1587-48d7-8443-e5d414218692", "value": "1536:4AKxngHMYctli9a83TF74ZOCTz81lsXF6BYsU1bXc8dIW:figx2lE3T5oOwAxBj+bXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624916189, "uuid": "7e8285b5-ef59-4b20-bf5e-e73ca5a1ae44", "value": 108028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624916189, "uuid": "50db8da3-d2ee-457b-a6b2-65fc97b42d39", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624916189, "uuid": "9bea2cad-19ba-4952-8ee9-d7a8898dec22", "value": "4ad915d23eebbfce27a551a0c73bf344", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dada6f4-d84d-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1624911343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624911343, "uuid": "a87ab690-5c76-48e2-b129-506513e9025d", "comment": "Malware payload (AZORult)", "value": "2318bb093fbf67c6bbdedbad36df2644", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624911343, "uuid": "f8aa74d8-9290-45d2-bb8e-96f9f616cf80", "comment": "Malware payload (AZORult)", "value": "ae7fb60037077ad6e8c624f7f4b2ee162d7552671015f96b452e975663c63bf2", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624911343, "uuid": "bd5f3ad0-b76f-4282-b9a9-1fde46ee3a5a", "comment": "Malware payload (AZORult)", "value": "e7afd4bcb15d1a51c841491789e30c44025d1be7", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624911343, "uuid": "ae0bee75-7b7f-4a41-8401-5f62bb5f4681", "comment": "Malware payload (AZORult)", "value": "85b20acc10f134fb9d66bf6b5051aa3a95e2bb8c6c9c94cbc93f87d389528d897bf2189b523f66a06f47c38bf91087cb", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624911343, "uuid": "17602457-8907-4caf-9f28-7fe483b7a576", "value": "FD54AF2179E54034E6B3A3B644F9A67206BEBD710A31C99F67DC465C4F38890E339B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624911343, "uuid": "9f993e67-8b61-41a2-828d-c2948b0f99f9", "value": "be9896e4b8f7e4e94bbb1c9947267b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624911343, "uuid": "7dbcdb0f-62be-4e23-b95b-edca706b6d6c", "value": "6144:oR8Df683DNunGRrrgiIbBNd8SP6C3RqGs482Z:o2DfB3D4QgiIdsnGs4LZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624911343, "uuid": "52d470b8-189c-4742-9013-6603d844bf9d", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624911343, "uuid": "5e63a885-6c83-4f1a-8a0e-c11c35e0cd27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624911343, "uuid": "aa55852c-9f69-4f78-b29f-70aeae442529", "value": "AE7FB60037077AD6E8C624F7F4B2EE162D7552671015F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96bf7692-d7b6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624846477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846477, "uuid": "fb12da42-5886-4716-bdb0-cc6c5d424004", "comment": "Malware payload (Mirai)", "value": "f51ad463c0b073617d8ad65a93275014", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846477, "uuid": "6f8caacf-d222-4fbb-a6d2-ce1b266f92f6", "comment": "Malware payload (Mirai)", "value": "ae841d2f766f500a88ff898bad4975a35f848c1d43a265fd75023c31283b67e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846477, "uuid": "639a3bd3-38af-445c-9d0c-ebf4fef20dd5", "comment": "Malware payload (Mirai)", "value": "386f9d0ba2d0b2d66070cda85595f7f4f57dff09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846477, "uuid": "d1209519-2035-4033-ba7e-bd190cdaed86", "comment": "Malware payload (Mirai)", "value": "9dca605766bc6aebb89371923a785c04feb54216418e5847e0f40b6d7b1316a804a48130ec0de87071a6b841ef5c447a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846477, "uuid": "36f0e9da-9b0a-481e-9fa7-d53ab79aab76", "value": "17732925B87A2E17C0E4927E12FB8615F2F6370E1474862D3D750F8EFF64684A94A273", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846477, "uuid": "e1f25371-0cc9-4363-a14b-d7d3d2dff969", "value": "768:b7s6xF6ukVDoKKeScPiSviZSPz7e/+V1NK+6OajfnuaCWu1Ic68HquXglrpzwIyB:/s6IVDlScP773HqVVEhIukx7kGL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624846477, "uuid": "481ecc42-7896-4ed4-a49a-e5aa1a833034", "value": 75096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624846477, "uuid": "d51d31ec-92ac-45aa-afc8-51cb69bc59be", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846477, "uuid": "5780e1d2-5477-4fe2-b4de-64c64a8fd532", "value": "f51ad463c0b073617d8ad65a93275014", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7919fe07-d807-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1624881217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881217, "uuid": "550906f6-e2ef-40d8-8063-32d0a4be177a", "comment": "Malware payload (Smoke Loader)", "value": "8254bad320e6efd4f780285492d5a5b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881217, "uuid": "b6a0682c-6aca-4aa6-ae71-5ae765a09add", "comment": "Malware payload (Smoke Loader)", "value": "aec980989772ede0dc405ab1f0cc49a0246daaa765a6edf93a54c8e146894546", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881217, "uuid": "3f966390-fa60-4f21-8ba6-f7e9aaafbabd", "comment": "Malware payload (Smoke Loader)", "value": "2a4f00307de0719241e47e5aa3cb8ed4aeda3f51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881217, "uuid": "ea9af77e-c6c5-4863-a13a-5e9502e79b77", "comment": "Malware payload (Smoke Loader)", "value": "4d5d150b3089d5b6b2351ac0958580cb0b417ab05923dc63a691a738c1c1580939bd7a01eec432668f849f0cb0662143", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881217, "uuid": "e9d94b16-f7a2-48c9-84fd-af6bc874a680", "value": "2E747C00BB51C035EAF316F44A7A93ADA53DBAF19B2490CB52D52AEE57342E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881217, "uuid": "e14176a4-6b62-4d99-97de-33606b7db4ba", "value": "203005f6a9207faf3149acf4bd59a7bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881217, "uuid": "f9d1508b-2feb-4e38-baf8-d544e0fbfb38", "value": "6144:QZ24QLLGPoQtcsnhzAavuPhRx1hxwMVpbc9vh6hPrNEiY4M:QUoQQysnhz/uPhRDhxwmpbcVkhjyidM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624881217, "uuid": "13a1ac0e-0838-4960-9be8-729f230514e8", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624881217, "uuid": "3ddb7162-6619-4e9f-bad1-0a810e64564f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881217, "uuid": "f406c3c7-a204-4187-9f67-eff2259c4827", "value": "8254bad320e6efd4f780285492d5a5b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2a20b8-d7d3-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1624858806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624858806, "uuid": "62f3c565-180a-42fe-a1df-d947eb4cfff3", "comment": "Malware payload (Dridex)", "value": "a645843910112f9a5ae386ca87c03e97", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624858806, "uuid": "ca844bf5-552c-4319-b85a-7e277a43b013", "comment": "Malware payload (Dridex)", "value": "af158f524186d5bb8f0cd61679c2c0b7a874261ae23251c45b0054789e60156e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624858806, "uuid": "62c0d7cb-950a-4375-ba50-3f69f20d746a", "comment": "Malware payload (Dridex)", "value": "3f047cb47258dfdcea41cd443c9686cf024667ba", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624858806, "uuid": "56d1e971-9db6-4afa-9109-63088c5399b2", "comment": "Malware payload (Dridex)", "value": "15e318aa0ff4b0f1fc5d77706b735cea9e461e4cb749d939ebc4719fab4d6942887e5da0b7770e1ad5463fcbefae21d2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624858806, "uuid": "7d559cb3-9c74-4777-942b-7884a6ecee0f", "value": "D535024AFFE8C608D1B91AF297B3C2AF5620BD2150B955AE13C4FC897C326C19913B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624858806, "uuid": "f773c5ba-aec9-4318-95fa-873002350a83", "value": "8c4e238e10f1a7b2664e39da969a80bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624858806, "uuid": "c7bea070-5d45-4249-bf7f-eb86634167da", "value": "6144:cWAIsOLTEcDpn9IkQFqgrHojg6aH+LJLvJdT2BC0+eekTdFyDPckaS:UIsOnNp1V8ojg3IXVuvODPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624858806, "uuid": "b83ede52-cc3c-402c-97dd-1a7891df6027", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624858806, "uuid": "272ce352-55e1-46e9-abae-16e31a272aad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624858806, "uuid": "b6be379d-001c-4b40-bdb4-0b5c4f1dc6b7", "value": "a645843910112f9a5ae386ca87c03e97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e17df8c-d857-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624915397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624915397, "uuid": "81ba8b7a-eaea-432a-bc0d-4e08892e06fc", "comment": "Malware payload (Mirai)", "value": "7c331f110fd7973fa6c0cc6941986c9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624915397, "uuid": "bad7ede3-4894-4655-91ce-c59cca10a297", "comment": "Malware payload (Mirai)", "value": "af4d8d87badc848d2d2026721979572c71ddb5a1e0832043c0e887603fdc9da7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624915397, "uuid": "4f3a9cc4-7b35-411a-9b85-707c54d37fe6", "comment": "Malware payload (Mirai)", "value": "529900ba0d76d827cb769da6091ec798ced8e32e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624915397, "uuid": "de73caf7-d545-4e4c-9edd-642790f12561", "comment": "Malware payload (Mirai)", "value": "1cc5fbdd5acb9fe8b7db392127b21ac20dc0cb0eb0361894b22cda62e6a4ac6bf27beeef731340f3f12cf869f79cc1c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624915397, "uuid": "772c6433-5700-4992-9880-386170004906", "value": "184302706A4C93FDC3766DEEC1FA83A1ECEB917A6D94B9A5A144185C60113009CFABF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624915397, "uuid": "100cc2a7-7cef-4fdc-a6b6-54c5408837ed", "value": "1536:1FBn23bd9cLu2BNrimUSWi0LV7FcB1agc5S:fI38lzypLV7Fwag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624915397, "uuid": "cb8f948a-15d0-44f7-b03a-032bd123c8d1", "value": 56024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624915397, "uuid": "66c366b4-b8d6-40a5-a874-e0dd6f735e55", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624915397, "uuid": "0e5c0e84-743e-4a07-9375-edd84583d74c", "value": "7c331f110fd7973fa6c0cc6941986c9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0246854a-d842-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624906358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624906358, "uuid": "41088149-e59e-406e-834c-0cd748a9a721", "comment": "Malware payload", "value": "9584b992c8e3425ecffa37d09049eb56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624906358, "uuid": "fac1f3fe-40a2-4541-b3b3-88bf3a5c1791", "comment": "Malware payload", "value": "af58ddd92fea10c97e6f04fe1dc584d8cbbe8e5e4bfcb5d985f0ff208259928c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624906358, "uuid": "326c3fe7-2b4b-4eb7-8485-9031063fc5cb", "comment": "Malware payload", "value": "79dd4e0d3d2b5e79ee64d0213b9545bcef72cfa0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624906358, "uuid": "dc407ca9-2700-41be-963d-410d0b0a2a28", "comment": "Malware payload", "value": "ffa0a5fd4793722292bf51e15dc3da733a167b63ab112da877e213232b21dac10f57153647e930b7ff044a1136b01031", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624906358, "uuid": "35936ac4-fed6-4e4b-bea4-62b6e72e3bda", "value": "5513E01954C8E364BEA01DB75F310629B747A5B6CC2F563F3209CE98E2D1977C9AC40B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624906358, "uuid": "6b66fb24-2b34-47c9-9149-205601725bfc", "value": "768:UdAbVhKbDwOehgy58Gn39RNRN/SXAjUtOfEMMSq3U7qa:UGibgUGn39LAtOfELub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624906358, "uuid": "54aa9e8b-4833-41cd-9425-8069194a949e", "value": 42488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624906358, "uuid": "ed29a576-9b28-49a9-a3b1-ae1d9c6f3f8b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624906358, "uuid": "71504379-55db-4d56-887b-fe3cace3469b", "value": "9584b992c8e3425ecffa37d09049eb56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944345f6-d847-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624908750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624908750, "uuid": "c13f8f29-e3f9-45d9-a2f8-5b5f98b5c4cb", "comment": "Malware payload", "value": "24fb3fd5b93f3b94032982fa355480bd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624908750, "uuid": "16c4fb6d-2b27-4c0d-8a57-24efeab1b1db", "comment": "Malware payload", "value": "afed88f8ac59a80677c76e7a0d51ef6f564d8ce1f3ac97c7e49d29100d4e6ffc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624908750, "uuid": "bc62e014-caa9-448d-9c9f-61691f640b98", "comment": "Malware payload", "value": "f7255a24af4304d18986a9d019ddb85d5dd09bea", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624908750, "uuid": "5e89e930-7f92-44ad-b521-815950eeecc6", "comment": "Malware payload", "value": "3a0cf326f7b0dc1a880ba9eead37dee79212ef7f28d5d9998315f07bf4a5646bab0353298452216e3debbecde95974b0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624908750, "uuid": "86cea302-fa17-4b4b-8e42-9cbf1d518537", "value": "D6E56D21F900903AF6EB00FBC3F7457DAD789B20135550D742C079EAAB66ED97932A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624908750, "uuid": "acf24525-7da0-469a-ac0a-5d0383ce3ee8", "value": "e877652137f9a4cc34a0b63661b3ba6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624908750, "uuid": "af3dab5d-8097-4d65-b629-29f7fbecf5d7", "value": "49152:QvpSnKuvTx53YV/6BSjGElRroOcMKOKmMm7WHgKLES5fQCnNId1aDAgMckR84+wt:7ln3YcBSjFlRroOcXOhgXkR84VW4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624908750, "uuid": "4b917225-e1b0-44cf-ae72-579272048296", "value": 3099269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624908750, "uuid": "1eddf7c9-942d-4f93-b8c8-74d476e61a3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624908750, "uuid": "99b78642-d207-4b7d-9dcc-adfabcf70ba5", "value": "sep2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "215a6c4c-d7b5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624845851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845851, "uuid": "43ec1e50-ede7-419c-ab47-5fbe253632f3", "comment": "Malware payload (Mirai)", "value": "7f0f240b5254c8f1b5ea7b884006d0f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845851, "uuid": "a393e990-cb77-4c55-8b70-d00335f2afbd", "comment": "Malware payload (Mirai)", "value": "b047fd4a94ea77d3c04fe79795dc72d901f17badc6621f536af8a766c2bf9145", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845851, "uuid": "2461beea-8ac1-473c-b75e-ea66d5c452e0", "comment": "Malware payload (Mirai)", "value": "005dbd5093e29a9e4570909a0190eda757867792", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845851, "uuid": "62069ca3-4975-441f-a6b8-15e324b8b190", "comment": "Malware payload (Mirai)", "value": "f9802921e75bea699235766c7c2fab04eb920539542e54da384cb58ac7f0ac6faf140c43b0c381aff53abfd59371da3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845851, "uuid": "8d41385c-5ce4-44c8-8745-9ccaeda43880", "value": "5B630985F8C745F5C8074A3460BBF33FDA32D6BA40705A6DEF59AE32DA37A015212399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845851, "uuid": "f610c5ab-d46a-4d52-ba2f-0aa5a3c23913", "value": "768:HNlq/jqP7jqWYIlupudaHhOOvMLXmHeogHH3Cvwet22AVq3wWu7K29zcqxY3IWp3:HzrP7QIlOudSxvwCqXWw9Y3JpajqOZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624845851, "uuid": "19922b37-b4c3-460a-962a-a262093997a8", "value": 71312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624845851, "uuid": "e50eaa07-5a35-4a3e-a738-8f9be8ba1fe6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845851, "uuid": "55aea473-076e-4a9a-bf6b-2fabcc3ec343", "value": "7f0f240b5254c8f1b5ea7b884006d0f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdbda9ac-d7c1-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624851267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624851267, "uuid": "bf5feba7-f662-4814-9ea1-d89ec56589de", "comment": "Malware payload (Loki)", "value": "0ae27e53ea156c7841481faa9468b6b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624851267, "uuid": "165fe173-f57d-4d98-9af8-eeb95527e9fe", "comment": "Malware payload (Loki)", "value": "b05d4c847f6c158729a1d150d30c75319e6e238044928baaa631ecd053335463", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624851267, "uuid": "614ddf8d-dea6-4420-ac95-edce49018d93", "comment": "Malware payload (Loki)", "value": "1e41ae6930dbe904c7f4e9a415541e6900613458", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624851267, "uuid": "3ea25afd-4755-4cab-8d5c-b40907e7b25e", "comment": "Malware payload (Loki)", "value": "867740c779137b4f020fbe0d3dfadfe619f317c728da5898a28c1cdd31969e65b9496c68cddc3226a2f546deea724eee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624851267, "uuid": "b19cad71-90ad-46a5-bedc-59c2a2870eb3", "value": "5415BEAC329072DFCA6BCA358D642C54AB70BC62531BC22B9453358DAE3D597CF111FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624851267, "uuid": "250c5916-7958-4202-84a4-a02ad9b8917c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624851267, "uuid": "ba9a6aad-c39d-49a1-bb35-b271f4c14a09", "value": "12288:f8G6F8g1b9weVBTxuPuUuUrja92AhfEjg/pip8EptWr1IwI64xp4RUDWKB+xRooq:JLJefT6ru92fQpUrWZIwZ4xN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624851267, "uuid": "f7e4f3d5-4b09-45e9-a752-72cb0ea30939", "value": 956416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624851267, "uuid": "5d6ad519-fbbe-4b3e-a813-0f39e8dfbff7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624851267, "uuid": "f08d55d0-9cb0-4223-96b8-6b9ba2a5033a", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.19727.19296", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb9706e-d800-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624878299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878299, "uuid": "b6d25596-fb2a-45bb-9d4e-c5bec4da0d16", "comment": "Malware payload", "value": "bb1570ca408cf76448102c7ecbbe322c", "object_relation": "md5", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878299, "uuid": "031f4258-3b26-420f-a4a0-ad9dc065cb39", "comment": "Malware payload", "value": "b0baf071692d63267aaf41bd3db933826523b59e8fca49655e1656ce0c656c71", "object_relation": "sha256", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878299, "uuid": "61cc10dd-772d-4d36-9686-78cc7f88913e", "comment": "Malware payload", "value": "0445c648174ca1930c2cdb0b89902cd4e984a9ea", "object_relation": "sha1", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878299, "uuid": "929de52c-c8a6-48de-8879-b4f09f7fa8f9", "comment": "Malware payload", "value": "4b708be060724b11c39706f8684a64d545736c3886f600a3e01108043ed98137da5a76685c0f3fd53db7ca88892a436a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878299, "uuid": "ec985c26-9868-40d6-96cc-5e5135217f14", "value": "9D76339D76B2C370C12AD6BB4C3C79224EBBD45E1634C17FCC185A0359A581F22BAB97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878299, "uuid": "89a82b0a-d845-4c3e-a5d0-d2a835f48782", "value": "196608:qLcWN3KlidmQtekNXjglGHglGKglG05Pu0uCET7+y:MNxJHgKgBgtM1+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624878299, "uuid": "32148491-cb95-4e14-942e-06f0db135c91", "value": 7400440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624878299, "uuid": "d453e76c-ec3f-463d-929a-0559b2f64ed7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878299, "uuid": "f82903aa-00af-43d7-bbd9-f1d8ec00e54a", "value": "31.214.157.40_#DarkRadiation_by_@r3dbU7z.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a5227a-d7b4-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624845772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845772, "uuid": "8cb7773c-8cf9-4cb2-969e-49e948ffc239", "comment": "Malware payload (Gafgyt)", "value": "03adac8c1e30d83a9f034d9740a53169", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845772, "uuid": "aa4d3b10-eb6e-4010-80d9-425cbe92c1ba", "comment": "Malware payload (Gafgyt)", "value": "b1d2bcf1f3c0d293ee39a244c0894387d6a90eb53d51a2db8a07877b2feea6a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845772, "uuid": "bfc56df2-4814-4b33-bfbe-a88896c41733", "comment": "Malware payload (Gafgyt)", "value": "c004435b9e346e526ada465bb74d2a754f9126c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845772, "uuid": "04ef3d1b-a66d-4599-bd37-1098fc0aba67", "comment": "Malware payload (Gafgyt)", "value": "4ecbd3eb6738715c760e79ab402adad53835659a3e91fefb314adbe54c0c00165478ef3dae97e354db02a32b730fbaaf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845772, "uuid": "ed53a74f-e416-4a64-a140-f99be04e4131", "value": "29A3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845772, "uuid": "8d9cc34d-966b-4ad6-94f1-a61b83f18c3f", "value": "3072:wW8FUmgujld6Mkxm6AJ+4fTHmmFVcqq0GnDZT:wJFv4Lm6AJ+4fTHmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624845772, "uuid": "fefa94fc-af77-4eee-971c-fd0131fa4098", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624845772, "uuid": "791c9a73-d91a-4056-9046-8c7723c2014b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845772, "uuid": "816465e5-53f8-4cf7-9b1a-79f72e0c0bfc", "value": "03adac8c1e30d83a9f034d9740a53169", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e4c247-d7e6-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624867056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867056, "uuid": "52f2c0d1-ecae-4fd5-83e8-cfac790ebc2c", "comment": "Malware payload (Gafgyt)", "value": "f29bc347ca19b3ce5c255f87bdbeac4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867056, "uuid": "f88be0b7-51d0-4fbd-8aef-6cc12ecf318c", "comment": "Malware payload (Gafgyt)", "value": "b21162906feee6101ce6a357c35791fec424015208e72536c9b94d81655b445c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867056, "uuid": "846aa9e7-ea36-4e46-bd6f-a1f67edaf181", "comment": "Malware payload (Gafgyt)", "value": "9cb27720e7259890ca945065335becdc73c37e48", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624867056, "uuid": "6c2247bd-477d-42b4-b26e-92c024af0917", "comment": "Malware payload (Gafgyt)", "value": "6f27a920ed6d454524cfe74c632d10aa59eafd11d266c0514cf45d3ac6bc197cdd71d88ea5ea7ca9845652af6359b99d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867056, "uuid": "fe16220e-14de-47b2-b793-9e37b80d9452", "value": "58E3666E3E21BFBEE268863107F75F70D395219226919382E26CDB185FB128D1C5F790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867056, "uuid": "9d367d27-bea1-41ea-96d3-7c3eff926e4a", "value": "3072:BCUINrKHFj9nvoYDV5hKXMtso7F7RGkSF+1GPSe5R:4R8xv3V5hKXMWo7F7RGkSF+1GPSe5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624867056, "uuid": "4f12e165-2d93-4083-b4ee-b65c55d800e6", "value": 154114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624867056, "uuid": "fc0eb473-7ca2-4cb8-8d18-81a4a6be4160", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624867056, "uuid": "e877ff5e-2606-4779-8309-5dd7849e957f", "value": "f29bc347ca19b3ce5c255f87bdbeac4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b95976-d822-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624892653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624892653, "uuid": "f72db278-9999-47be-bf7c-8a0c47a56b1b", "comment": "Malware payload", "value": "b1b812080af542692b22558bf87af1dd", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624892653, "uuid": "b03c8e37-dd9c-4833-8f56-76e51c9e9b81", "comment": "Malware payload", "value": "b45b0613f994769e460de419e2aac46863e303e833d43369f2647bac3a8260e6", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624892653, "uuid": "5b5b3388-8efa-44b8-bdec-95da8585a613", "comment": "Malware payload", "value": "6809a07ceba8afaeec6ef48e17347101a56a605d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624892653, "uuid": "0b344166-93ef-4eba-86a8-56e7f409f1eb", "comment": "Malware payload", "value": "e2f61ce11b9c6513dd834aa5d61bc3a9c38cee58381403ede15d0789e466f467c2a269d3637e0b1692eaebd981cc9725", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624892653, "uuid": "7921f387-824f-491b-95dc-aa257f6cc6a2", "value": "0865AD11F6878232CC93127D456EE3A11A3AED604B70C2877298779E6EF1BC067357DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624892653, "uuid": "bf9e894a-7132-4f78-9354-38052eee2422", "value": "24576:QvAq23Nn7BjlpOu3dARHdYLAd2LHPG1n9LNNpbCClCtRGLovJz:QvAF3Nn7BxwutARHdYLAdSHPG19zpbCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624892653, "uuid": "6eb2cbf5-c5a1-4e84-856e-e24787491d24", "value": 1447016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624892653, "uuid": "dea416a5-c523-4ae0-9663-92e974d3f2b6", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624892653, "uuid": "ced846f4-1ae8-4591-9e85-1905814d3838", "value": "b1b812080af542692b22558bf87af1dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce67ca79-d800-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624878353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878353, "uuid": "e60843d2-4af1-435d-a2b7-f761c6ae5f5b", "comment": "Malware payload (SnakeKeylogger)", "value": "5d289323cd5d516c6d9721e127530dee", "object_relation": "md5", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878353, "uuid": "2c8bc53c-4959-4192-b3e8-5646288ac12a", "comment": "Malware payload (SnakeKeylogger)", "value": "b4f24bab25dad894baf946a1f35664f1e9c1906d84d770c42d42397620191335", "object_relation": "sha256", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878353, "uuid": "b88f6127-19c1-40f0-87d8-474d9375ce70", "comment": "Malware payload (SnakeKeylogger)", "value": "1bac77cd264d443f4ff417dcaaf94a84b198ae6b", "object_relation": "sha1", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878353, "uuid": "fc63f563-8545-4515-bb32-14fa3dc396bd", "comment": "Malware payload (SnakeKeylogger)", "value": "d9186f9c6da37f49a67ff990f512f442feb850564f3d82b3293cb73c4f2cb910ff2d051f51dd6a2e003a341107a89236", "object_relation": "sha3-384", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878353, "uuid": "61ae9236-2379-4b31-a5ad-09225c01a0ec", "value": "CB15BE242AE95126F5B61F7D49B02081567DFE626F17C83D28B532C91B33A42CAF137E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878353, "uuid": "8e3aee70-11d7-47da-b1a3-e6b6f2f8eaa1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878353, "uuid": "c1bde426-0d93-42c2-9a33-452b3dbecc73", "value": "12288:lSwuo3NbRdnruSh3xm0MXv6jU7kVbsTWR2tvhK4/9Ue7+aTqmyWD4b:lpdlySnOijU7CEu+hhlC12U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624878353, "uuid": "17f82893-ce32-483b-aec1-1e1a21cbfe8a", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624878353, "uuid": "532f3323-d0d2-4472-99b2-f414243b43c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878353, "uuid": "7a266058-4344-43a7-928b-f2294249aff4", "value": "BED905857574.COM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6a7ca4-d848-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624909064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624909064, "uuid": "0fd47782-ae67-4c8b-8e3c-3c4513e5e571", "comment": "Malware payload (Mirai)", "value": "dd519bdb1f3fe6afeb9825b38471d461", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624909064, "uuid": "c94a1168-3512-46b5-9a84-7a9e52bb49c2", "comment": "Malware payload (Mirai)", "value": "b5bbd8cbec11e2ffc342c98ebf78381c633bbde2886929f673c80e1e0ce7bb30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624909064, "uuid": "9c328f00-1031-4f82-b1a0-5f4a8a327a46", "comment": "Malware payload (Mirai)", "value": "0da6d889d95db8c9635aa0c3dfaaec7247085bef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624909064, "uuid": "4e871cd9-623c-4305-afd7-1a292a68df83", "comment": "Malware payload (Mirai)", "value": "831971a86e7550a3f74f740d03ce3ad67aaaa76966f93b9026f82c41eb795d0703c8711ae95973a1648583e866e4575a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624909064, "uuid": "b4c8b009-ba18-4a7e-ac71-3ec27503ce7f", "value": "99E3840EBE158F7CFAA7863847FB9E15964833C62691C452D07CDB519D5028F302BFAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624909064, "uuid": "078707a9-3ee2-4b09-85c4-9bfc4e20e2d9", "value": "3072:cqKS+b3Urxaltz+iGrCxQLrrvcCOaHguhJTfaR8UOQbasYaG7cBzcF3GAVtRVZ/L:YS+b3Urxaltz+iGrCxQLrrvcCOaHguhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624909064, "uuid": "961d5c65-04de-436c-89f0-77537631745e", "value": 146784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624909064, "uuid": "4d53a030-38eb-4ab6-9a12-6bb4571dfab7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624909064, "uuid": "188a3c95-71f6-4752-8cfa-30b93ffa18a5", "value": "dd519bdb1f3fe6afeb9825b38471d461", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1280ca4-d839-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624902866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624902866, "uuid": "63143b38-abb3-47b9-98e4-2f24a74cdf44", "comment": "Malware payload (AgentTesla)", "value": "c6099579a1d9cbe8a747a46fce3e0907", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624902866, "uuid": "ff448873-263a-41a6-a508-4836491faba5", "comment": "Malware payload (AgentTesla)", "value": "b6ff5d41d744f289b0e536d5e7c244490ade99fcc44772d645648e6c9f769a6c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624902866, "uuid": "f56e8ca7-5e35-4f6e-98c3-5931c3412d04", "comment": "Malware payload (AgentTesla)", "value": "9f93e4a92262f750289314e3ebff6e65cd7154ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624902866, "uuid": "518f4f23-fc51-4905-a33c-acf8dbca14f3", "comment": "Malware payload (AgentTesla)", "value": "88c52be23181a9aceeb74e1b709354f349b543d9ae85650955dc1563239b2c394d9379ca75c75f3a9b6fceaec1993554", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624902866, "uuid": "b6b19c92-e19a-4c4e-a39a-731976a76281", "value": "98C4C04E2CD58459E0E17F716CF061862A37BCAA2225D18FA9C7FE199F727405FC262C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624902866, "uuid": "0aa97ae5-0e5c-40e7-bdf8-bcb8eff6b3dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624902866, "uuid": "a244d7e4-1625-46b5-88a0-fcfc8276ac70", "value": "12288:5IH2x+B1EO4ikCqjxNNruHgavtuptahMVBAV4mf:c2y1r+BNNCHF4RVBAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624902866, "uuid": "7c7c334e-d2a8-46a4-a906-83c6bafb60dc", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624902866, "uuid": "e7f26ab3-442d-4b7f-ab0d-3e40305461b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624902866, "uuid": "a55563b9-d6b7-4dd2-bb72-2f9c1ccafcb1", "value": "AL Naser General Services PO609521.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0beb5dc0-d83b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624903367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624903367, "uuid": "2a2497e1-5ab2-4bba-949f-2fd5f8715a90", "comment": "Malware payload (Mirai)", "value": "f603d5e7910d9b3ca87d8d9bb003379b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624903367, "uuid": "edd9e46a-c7a3-44ba-9b21-3962b138d88a", "comment": "Malware payload (Mirai)", "value": "b7823930992bbcadc7c994804f1bfc90397c6656802b8afae083039e2f9e21a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624903367, "uuid": "55f5eb75-32f0-42bf-9f54-e838f31130a9", "comment": "Malware payload (Mirai)", "value": "be8e6320d15d27366644414daaf5a0074b6b424f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624903367, "uuid": "4928de4d-04b9-43b6-a543-2ffd5e6098fe", "comment": "Malware payload (Mirai)", "value": "438ff974e86e40727a2760884f779349f48840efa2d74a857c4382d92bc95ccb34aa29840ee840beeabadf96778c8f4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624903367, "uuid": "a8533349-ce12-4c47-9d08-83c08baf69ed", "value": "5CC2D1DFB49A7985CC1C5CBC219C5AD115A9A2C3234B9F0837603DCDA6B645FF89C8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624903367, "uuid": "6e4b1bf9-d5ee-4f7d-8516-18ffe30c954e", "value": "768:MuCUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdB2YWC:5CrJgHiOJrfwmQrctn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624903367, "uuid": "0fa527f0-c23a-4afe-ac0b-36e9e177fced", "value": 27244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624903367, "uuid": "5c517968-38ce-452b-9b35-7761cbdb29d4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624903367, "uuid": "2d36e932-0395-4850-8db8-d4cbac6388a7", "value": "f603d5e7910d9b3ca87d8d9bb003379b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f99783b-d7f6-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624873980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624873980, "uuid": "d53479ac-430a-4031-99d4-e04a545be282", "comment": "Malware payload (Formbook)", "value": "34ea341a86ef62ca56e400e0df97f3c5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624873980, "uuid": "a9b146e3-e934-4084-b0a3-c20d6cba77cc", "comment": "Malware payload (Formbook)", "value": "b7ec359d9ce5edd99910dc32f7a07ad50dd056fb26791a6aed260a65b6cb684d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624873980, "uuid": "c44642f5-41f0-4fe0-8eb1-6fd5239c43ba", "comment": "Malware payload (Formbook)", "value": "1f4e17d70b8ce0af1887457f85f8bf96aa7f05ba", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624873980, "uuid": "d217a6ad-d9fe-4bc4-993c-65cf75622154", "comment": "Malware payload (Formbook)", "value": "23ae83b4e64c2723b3257a441541642123ce34da3590ab5f2d8dcdd9436550ed0c90f805f6adb3a302a7617cb54a9faf", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624873980, "uuid": "9c1837a8-1016-452c-aa4c-afeeb230bbb4", "value": "6CE423A25A73B2F4E86802B5E1C57286E12B38751D4A1056F3B9F2F0F1F1E8B6512D1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624873980, "uuid": "3f747430-174d-489e-b375-e5d703d235fd", "value": "12288:fk0J4lC9riwwbswPbZrpLqwlDkPERJW2enM8Yux0w5i6fgJUWtdb/B6CLrZTEI:M0eCEwwbpDZlqwlhRJiMdu+w5+rtdbbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624873980, "uuid": "7697a8a5-82b0-4067-88fa-f26c61e70a46", "value": 708516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624873980, "uuid": "aec5cb6a-cab2-4f65-9661-00a2298cb86c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624873980, "uuid": "b467c292-cec0-4008-b78c-9aa125bf0072", "value": "new order 20217602.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c231f20-d7b5-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624845815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845815, "uuid": "b69ca773-cd86-4e29-a262-7d1bc8f25987", "comment": "Malware payload (Gafgyt)", "value": "8d72c294f15a70648353ca3cc247051b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845815, "uuid": "e7036c35-60e9-4bc1-9200-640ac2560945", "comment": "Malware payload (Gafgyt)", "value": "b9b21a11b80b8e5c8f031a11ce4030f795b5c23b06b7b97a6a5f82ce9bd24376", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845815, "uuid": "b2199ac4-6c1d-482d-b5cc-0f6e6842aef3", "comment": "Malware payload (Gafgyt)", "value": "ec536408b10ef645026dce11fab07a963b6bc6d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624845815, "uuid": "6f72d22c-d756-40e3-89d1-64fae134c626", "comment": "Malware payload (Gafgyt)", "value": "042e97b4bb65b19ef056bee33bde97ef148da1731771caf38f2d6c970122c034f6bafd9e38acbcfb1e1332a0dd81905f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845815, "uuid": "3ee63d58-76df-4121-a248-d5fed0cacddf", "value": "6EE32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845815, "uuid": "35744b9b-0e84-437a-8527-5bbfe0c29b96", "value": "3072:Cv/WwsLgaq353qHiCOvhOpNqkDQHbeskmhxQwoVSUNu:KPLaq351hOpNqkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624845815, "uuid": "8fe8c49d-7e0a-4206-a797-afcfbf9d9d7c", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624845815, "uuid": "3c8ee109-2e49-4a75-b4f5-72fc083bb64f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624845815, "uuid": "1640c21c-70ff-498e-b056-06d56867d804", "value": "8d72c294f15a70648353ca3cc247051b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9303373e-d861-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1624919915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624919915, "uuid": "714beb9d-0cd6-48e3-969d-43f2ddc673df", "comment": "Malware payload (GuLoader)", "value": "d2573aac3ed1e520ac235b3c1381c5b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624919915, "uuid": "2df8966e-fc3c-4d52-ae91-f4c079593a20", "comment": "Malware payload (GuLoader)", "value": "baba954a0c432476966f7449ec7685f00cef2b563d88e77e8b89cee7284cfe2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624919915, "uuid": "b2f79536-d4b3-4fa1-8ee2-0fae5393f554", "comment": "Malware payload (GuLoader)", "value": "48c01d3b297e710074c9f8c782926bc2df9e0513", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624919915, "uuid": "701184f6-050c-42b4-923a-34729c19ec67", "comment": "Malware payload (GuLoader)", "value": "98316ff32f3f51a14ae454532ad9a09efa662bcf57dde65d6ebc086db1b1247e527b05df092ca7f4d9b4876a4a16f40a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624919915, "uuid": "d3992163-ed7d-4a6f-a6e7-6ffd8e7d1c7f", "value": "9AE34127A9409149D8F18033ED1A5412350924AB7D435EDBB3F2AA5AE73C9C3FAFD607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624919915, "uuid": "ece0fb8f-361a-478d-bb69-0c06b310c455", "value": "32122f333e5389674e4bc7e05959e542", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624919915, "uuid": "e3d7edfa-a1b0-4cce-9e04-d43ba3acb329", "value": "1536:th/8uSUkCvfadlOYD2XfcYYCGIQ1d/ZMSVwT2AaYR5ja9iTTDuv:thUUlv/ffcYgVDZxVwT2OR5jZHDuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624919915, "uuid": "c45a51f8-ab86-4885-928f-03ab088927f8", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624919915, "uuid": "d049577e-1c42-4dbe-bfe0-5bd83f379b4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624919915, "uuid": "49a1aa6e-fada-48da-98e0-add607f8c18f", "value": "SecuriteInfo.com.__vbaHresultCheckObj.9643.14911", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce800604-d7aa-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624841417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624841417, "uuid": "7e4f812c-307d-4d6e-8d88-f077669cec2e", "comment": "Malware payload (Mirai)", "value": "11ccba077aa4e88feeda568f6a8389bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624841417, "uuid": "bc592096-75ce-4060-8aff-a79766e96f8f", "comment": "Malware payload (Mirai)", "value": "bc1e67bca85a3282894527e49d0758cd3dc6b7084562143a5600e99c2287daa2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624841417, "uuid": "cc9cc8f1-1f2f-4527-ac04-96c23134785e", "comment": "Malware payload (Mirai)", "value": "98d913fdbf82f717dfc2336fb03aea1f8bafd94e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624841417, "uuid": "84325e44-1c90-4563-b110-96430f021228", "comment": "Malware payload (Mirai)", "value": "e2571e0ec461469e161193a336c91bff272e1de0f42fb8863cad2c78e70226a9c89c6901eece429077354f134e693e54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624841417, "uuid": "c4dd5bb9-19df-4d3d-a402-6d38d6255036", "value": "D6735C34A97E2F26C0C4A17E52F78750B2E5220F2AB4965D7CB20F4FFF24544A8562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624841417, "uuid": "86efbce8-fb8b-44ce-a8f3-270fb7009db2", "value": "1536:vsnCSemCLLWeKNJ+1kbOSYcpC636v/bcYSZMFFi:rS1+SYccv/gpKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624841417, "uuid": "ddf978e4-6586-4e22-9146-e432e521e8e8", "value": 75388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624841417, "uuid": "9cad21c7-ec3b-4257-bf71-cb33701d7459", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624841417, "uuid": "90a1dc70-22aa-4a1d-a446-a8d58181253f", "value": "11ccba077aa4e88feeda568f6a8389bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d9a5c9-d803-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624879653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879653, "uuid": "1ccec45f-9fe7-4740-873b-1c10baec71ba", "comment": "Malware payload", "value": "770a86a4da87dbc729076cfc2fef6fe5", "object_relation": "md5", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879653, "uuid": "2f28303a-ab57-4352-b6c7-ce7817fe7138", "comment": "Malware payload", "value": "bc6e4b879228c248b7ff9aebbf857e94354829a98b6aea9b1c187005cbc2e0d0", "object_relation": "sha256", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879653, "uuid": "56b3a7cb-089f-4542-b8da-83d2c9a6b87a", "comment": "Malware payload", "value": "10b1a99710c87fd8dad89c200b7ee7ed8388deae", "object_relation": "sha1", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879653, "uuid": "ebfff12e-5f20-46cb-88b8-c1902bdc2be4", "comment": "Malware payload", "value": "07037492e2c7559083cb1025aa21902816cd024ba28e85913dc48eaccbabfda03caa75c5a5f32d24b076abf6381bd5ef", "object_relation": "sha3-384", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879653, "uuid": "31485c57-f347-4d2d-8709-149fb8283c2a", "value": "142168465C4B09743401C6387B846D24E145C11FE6479F38B67ED3E42F84628F3EA75E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879653, "uuid": "b7d47c57-7275-4913-b43a-d560ef7e5c05", "value": "24:3euAalq4d/bzrQWQ6XyYA/JpL085kwhfcmgsKcpm6pkfbOAt/1d/XcW:37Aipd/bz8vVYABpx7UhcppkfJRL/XZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624879653, "uuid": "c374ecc4-f81b-40fe-9c51-d3597b7ff0b3", "value": 1314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624879653, "uuid": "fcbd01b2-2794-453c-a891-e4e54595efb3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879653, "uuid": "9595deee-9186-4399-a258-85b950c41cbf", "value": "bc6e4b879228c248b7ff9aebbf857e94354829a98b6aea9b1c187005cbc2e0d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b853c9e1-d7d0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624857701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857701, "uuid": "61e5a5dc-bf31-43cc-81aa-2d48933b742f", "comment": "Malware payload (AgentTesla)", "value": "28abc107bed1731700d86be37d13372e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857701, "uuid": "0826c4df-5d7f-4482-b0eb-14d1cc663f88", "comment": "Malware payload (AgentTesla)", "value": "bc8360103df66d8b14dabef68fb2de9960e66e278277356c81740a18d7d49bdd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857701, "uuid": "d37507cc-5853-4c2c-bf70-7bd7058a942c", "comment": "Malware payload (AgentTesla)", "value": "65f379d3d7500aafbe9be0f24f222b790bce95e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857701, "uuid": "24fee742-46ba-49ec-8977-545b496f6695", "comment": "Malware payload (AgentTesla)", "value": "a3c09b3a29c6aee74e42fb53cdb2778afb7e8ce42f733887e3cc688a5f0f9f902736eacb1bf4d9d489daa346ebb886bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857701, "uuid": "52b1679e-fe72-4316-85ea-2d894cbe4d01", "value": "DB15023172C166A7CBBD17380822A24023F1AD412A26D63E5C82764D6B75FE74F2377E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857701, "uuid": "3f78ca56-2ede-40fc-92f5-66394df6f3b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857701, "uuid": "c020d636-9cc2-47c4-8e3c-4fcc45fc7508", "value": "24576:ACtUdi1Ds7KuSOkCnfmZTRV3ekiGNNPjI5:rkKuBT+ZdxUcLI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624857701, "uuid": "5ff1f1a2-0d1f-4d19-a1e1-e533df818fc7", "value": 900096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624857701, "uuid": "cd5dd30e-4c27-4d9f-9c85-aa5f0a0b91b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857701, "uuid": "e75b93a9-20ed-4a8d-98e5-b67cd1ea799a", "value": "proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea52fd5d-d858-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624916196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624916196, "uuid": "1a35cb71-e7ae-4813-8908-a233b32b16fa", "comment": "Malware payload (Mirai)", "value": "9d36de785a74bdb509cec20c9961e680", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624916196, "uuid": "19a656cd-ccf4-499b-9ab8-167ae15d6a0e", "comment": "Malware payload (Mirai)", "value": "be243f410e7c60533bc2864f203ccfba29338aef450ee4067c1c7f35099963f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624916196, "uuid": "6826724f-f7d3-4e28-813f-59e413bbfba4", "comment": "Malware payload (Mirai)", "value": "76daaba7a367bca171b158ddf352d14304ecb508", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624916196, "uuid": "7fc7f9df-fb6a-4118-9799-88b6712210b2", "comment": "Malware payload (Mirai)", "value": "3115ad918f2f1054719a8df846c7bd4eef8003488de8128be432f2bb59057a36ee2fd044b00bbd067ab27a1fe0d5ec99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624916196, "uuid": "22b6e3f2-e95a-4e5f-89e9-a78087f3ae29", "value": "19C30941BC828925C5DA03BAF53D15CE332623EAE3DEB113DD115F2077C692B0DA7A96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624916196, "uuid": "43926b5b-3aab-4b41-a3be-83e18d8f821d", "value": "3072:yfzSlB+THI3po11LcEytUoY0qCnoobXECAGA11utd:S+n+THI3po11LcEytUoYbCnoAXECe11m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624916196, "uuid": "198e3aeb-f6ab-457c-8cf7-d5a1d70f8431", "value": 124628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624916196, "uuid": "4076ceb0-0881-4326-b863-3e065d88da7e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624916196, "uuid": "28b645ec-af99-45f2-89b2-0320a36e4e77", "value": "9d36de785a74bdb509cec20c9961e680", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760ea9cf-d7e9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624868327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868327, "uuid": "5925c742-446f-4554-9f82-9ff1df33cad1", "comment": "Malware payload (Mirai)", "value": "45dfd74cb86d10050c5d08deec681b2b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868327, "uuid": "4144065b-d034-40ad-bc40-0da8f2d904c8", "comment": "Malware payload (Mirai)", "value": "bfc38b8a6ca2276eb3335963eb169c0ccb8b61af460b582561fb046b4ceeafb0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868327, "uuid": "b8bfa021-72c8-4768-ba38-6cab55156169", "comment": "Malware payload (Mirai)", "value": "1f8fbbd5274de3ca17063c4080371ce266b3c563", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868327, "uuid": "eda2a57c-607b-4c18-af13-c6a909e75905", "comment": "Malware payload (Mirai)", "value": "a717b67a7a3729a8075e65ead5b0400bb999214edb81191dd2abadc6ac63599ed7d2fd1f6c8e4efb35c9c5702379f5e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624868327, "uuid": "1820a79d-ef97-4cec-9675-4ea114b645b6", "value": "4DF21A9AB800AD7CF81BFB7E94078909B531775546920B3363B3FC87ADB22AC5923D45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624868327, "uuid": "5b30760e-b2ba-41bd-988c-388fa4ad86d3", "value": "768:UyFPo5Etx4+5QaPVxN8erUy+1ievPAIGpkuW:U6JDnPVxN8erK1iegILuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624868327, "uuid": "354fede6-beb9-4b32-8d75-c10ea0ba90fb", "value": 36188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624868327, "uuid": "3978ee12-7db8-444d-8dc3-e66fb5c87d4c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624868327, "uuid": "1f24d9b2-c146-432a-ad16-42b3a219222b", "value": "45dfd74cb86d10050c5d08deec681b2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a2a82b-d7d3-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624859038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624859038, "uuid": "767e68c8-6398-4408-8a01-a4300b221aea", "comment": "Malware payload (RedLineStealer)", "value": "3fd3f0607af2aa6280579184901dd62a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624859038, "uuid": "ee9fd628-cadd-4642-8bdd-1a35f1977e51", "comment": "Malware payload (RedLineStealer)", "value": "c00564fe9ca6352ae07dbe37e40878f0f9f718c93afb568963979e46851f2da0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624859038, "uuid": "a8b2f99a-7dce-463c-acce-f1c15e880c68", "comment": "Malware payload (RedLineStealer)", "value": "5a92b273eb92e90692a0a76dda334a0e079b0e6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624859038, "uuid": "1e610dd4-c32f-47c7-ba4c-c62b553fb3eb", "comment": "Malware payload (RedLineStealer)", "value": "220574d48767aef1e448c744b317f09468f62652a5789d0ec5b07d30f249b7ceac329235c8a3a96cb448fbd0cdb20976", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624859038, "uuid": "fcbad9b4-8b17-4177-96c0-05ba24e87afb", "value": "B9949D10F691C035E5F612F85DBAD3BCA53DBAE0AB2050CB62D52AEE47746E1AC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624859038, "uuid": "16ba3348-aff3-4dc3-b07a-3f6f3afcc57c", "value": "a962653d955d84619f2983b46b5dc610", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624859038, "uuid": "8fe264a3-c19a-450c-9bdd-516fb66aba1c", "value": "12288:9XPfQTLgSQpeQSl6lFIpkB+q5/zQAjArOZ:ZffS8e3li+izQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624859038, "uuid": "676a123a-c70d-4a5f-a2b1-841030689920", "value": 418816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624859038, "uuid": "cffdc842-3a2e-4fe0-ab0b-ebd40930ea40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624859038, "uuid": "41376787-5617-4d29-9581-8d39be73f359", "value": "3fd3f0607af2aa6280579184901dd62a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3dc173b-d7d0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624857666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857666, "uuid": "0a16cf12-bb14-44b8-a56a-dea6ebe7e0d2", "comment": "Malware payload (AgentTesla)", "value": "516f2d7f6901c0d5e9154dc062dfe994", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857666, "uuid": "4254919b-5606-4598-92eb-d5539ce30806", "comment": "Malware payload (AgentTesla)", "value": "c084f4aecf97e5c7753b9c2fe2a44862926cb2df16df73d4db4af797cb2ea952", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857666, "uuid": "374897ce-77c1-4926-b326-dd14b17ccf03", "comment": "Malware payload (AgentTesla)", "value": "cc9784b497413f0b79a15483312801c03a01245d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857666, "uuid": "57e70939-7c60-48af-93e7-81a7229998a3", "comment": "Malware payload (AgentTesla)", "value": "fe2d78ee214a7364f697d8cc2f4018970e2c879ef5d6d26d767fd6b4be2eabba4bd217b42cc786c071f0e388d8bc2bda", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857666, "uuid": "b7d7046d-3fdc-40f3-82b4-da83a6a4f0dc", "value": "40E423CC4F025B2C19EB9E1DAE991688F5D109A1C60A876C72CD61D399CC543DCFBCBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857666, "uuid": "f72d42b2-bde1-4dea-b05a-1cfa91f26dea", "value": "12288:iv4gJ9o1//iDZgYU+CUyy1+DjjJz/RvFA5x2gnuNj+6ASUtQNj6oSDnAZ:iZboYDZ5Mu+DBRv6kNKnwZ6PjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624857666, "uuid": "e8754922-1a7c-4cfb-82da-665349a4d7e2", "value": 722751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624857666, "uuid": "5956d67b-0b0d-4859-a298-1a3a85ddb95b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857666, "uuid": "dd088ed4-0b23-45eb-870f-09dce30262ea", "value": "WaybillDoc_3227610761.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c04e1d-d80a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624882506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882506, "uuid": "007bdcb2-57d0-42b7-9407-f52499e2fe66", "comment": "Malware payload (AgentTesla)", "value": "a784e5f1116446c6cbb0aec492b3d182", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882506, "uuid": "f24e8dc4-5274-466b-ad73-fa1961a5d3ad", "comment": "Malware payload (AgentTesla)", "value": "c0ed7f53b0c28409c5ab30405d4dfc5c30e38fa14bbd7f85c7d92ba2604fbae6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882506, "uuid": "1a2e6616-ab6b-408f-af6e-0c4aa96c0f26", "comment": "Malware payload (AgentTesla)", "value": "1061441d8fcbb622840332a3e554fe292c88514c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882506, "uuid": "2201d181-4348-450b-926e-ac397ce465d2", "comment": "Malware payload (AgentTesla)", "value": "3f760b229124a4a6fd74b52469029fa9e027f1781ced7970bc74e4a1c3bc55dbe22d55200c2de1fc48dda6b65b4544a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882506, "uuid": "a4227fc5-64ac-4093-aba3-d572caba6555", "value": "C08402283AE8502CE17BAE7969F036469E7E72A32913E86D14D043461F13F51DDA3F39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882506, "uuid": "6bd4d96d-aa37-46db-9af3-6ccc537077db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882506, "uuid": "45f3557e-b36b-44f0-8059-2294d8ec6fca", "value": "6144:SLwu2IcMC8yy+k1zY9/okqNs8gMqrVSIdEgJF9eQmq/1qOrZY4boHeUM:SLh2FMmyMe1N6MeT5JWQsOVY4Ye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624882506, "uuid": "ea751416-0353-42b5-9ab3-f7c8cdbfff4f", "value": 394752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624882506, "uuid": "114bb32c-7cc4-4a10-906c-e62d60c07899", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882506, "uuid": "4835044b-c7eb-4f3c-abd7-b8b065bbc014", "value": "Outstanding_payment202047654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6add364a-d7e9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624868308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868308, "uuid": "7f5d05cd-6253-424f-976b-ccaf1de8d341", "comment": "Malware payload (Mirai)", "value": "2f84f069f6870d86837a9ed179574623", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868308, "uuid": "786d25e7-92bc-4e75-a2fd-a6d80a9e7613", "comment": "Malware payload (Mirai)", "value": "c3dd1560d67e283da4ae83f0e7cbd9d757156e842e11abe9aaeabf7b3f27f929", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868308, "uuid": "0a032e61-5925-418f-ba9f-6f9aa629ef5d", "comment": "Malware payload (Mirai)", "value": "69ecf4da84a13abaa5475af8cb61cd448d6a1cb6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868308, "uuid": "a1cb5f93-3731-4499-8dc6-a12d2cdecbfa", "comment": "Malware payload (Mirai)", "value": "918b24bc75dcfb9a65e2d3deded2173612c10b34754636462273a90b6903b136903a0e5d5c261a01cb2deb45666709ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624868308, "uuid": "f6d183a7-a323-46cf-840a-24e0672fabe1", "value": "01033A21BA621E17C4D4A47A52FB0329B2F1135F25B8D72E7C720E89FF4494076A36F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624868308, "uuid": "231a5eae-7cea-4f0d-8480-2b45a8197c2f", "value": "768:5BOoatfvtPX453G9H5NCE50zP1yO+OSg+mLiSGPn:DOftfVg5W9Z7E+I8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624868308, "uuid": "8082f5aa-ae63-41fc-9df1-76fe780e6abb", "value": 39736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624868308, "uuid": "526effde-d5d8-4261-af8d-8aab22d156bd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624868308, "uuid": "444e65af-58a8-446e-a279-64e5e937601d", "value": "2f84f069f6870d86837a9ed179574623", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b0e479-d7c2-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624851648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624851648, "uuid": "2dee95ea-b97e-4aed-ad5c-24896edc4158", "comment": "Malware payload (RedLineStealer)", "value": "a05a5eaca4c68abe6579cff91f035396", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624851648, "uuid": "9bbecfef-b295-4686-b057-0c5610e8fc22", "comment": "Malware payload (RedLineStealer)", "value": "c421f3e8c0cfcb94579ecc36eadbea0b5965b1e650bd522d0fe94e690ed2eecf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624851648, "uuid": "a9870e67-afdc-4579-8650-ff4056775fde", "comment": "Malware payload (RedLineStealer)", "value": "38bc726c1b7a797271c806c2d2b8a97b9f31afb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624851648, "uuid": "eb30597f-2ab6-4ca8-9889-04fbb20ead1a", "comment": "Malware payload (RedLineStealer)", "value": "08c3e2888cd2e84fcca84c4389db11e8c76127ad09fb33663b1a0615077fcac7f4945aa3ec2d1f6358a6f5ba62b20980", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624851648, "uuid": "703dfafb-0a7a-44a2-b890-bac9c0276d13", "value": "7C934C54A3AC8A15D7BE0F7574B0511E03F0C28A7012E7AB8ECC788B2E567973615BF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624851648, "uuid": "2b258f96-c239-4f98-8771-59e2a56e9648", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624851648, "uuid": "b0a5bd58-682f-4347-b738-af034849c9e7", "value": "1536:1Sqh5YlzWTY1OmkZKZiFcbQJTHbRA1jLoRcU6yMddLrk2KR8N:IqLXTWO9ZZ1JvcwRcNysdU2sQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624851648, "uuid": "f7675612-4912-4b10-9f10-671c85f25a43", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624851648, "uuid": "f1f99482-0bdf-4bc3-8240-04fd3d527f27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624851648, "uuid": "54c206e3-b3b5-41c1-8cdd-12c17cef5a82", "value": "a05a5eaca4c68abe6579cff91f035396.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee87af09-d80a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624882702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882702, "uuid": "667c52d1-6d3a-4541-be42-792794574296", "comment": "Malware payload (AgentTesla)", "value": "d3c5df631956a9dd5c4b86ef3d688037", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882702, "uuid": "c2605609-3600-4644-bffc-58bc95d31f0b", "comment": "Malware payload (AgentTesla)", "value": "c4614f0ee18704ff806df19113192bcfae1d9132d83a58d2ff00f1666dffa23a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882702, "uuid": "dc83d3e2-ec69-4532-94a1-093eddde6d50", "comment": "Malware payload (AgentTesla)", "value": "d4a092758aabe5a2e3628f3e41621dcd988d2b9d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882702, "uuid": "ced592e9-63b9-459c-95cf-166812bdc8cf", "comment": "Malware payload (AgentTesla)", "value": "88f2ff05ec8bd8546d2571205e4333856d22327f5940b3922f56a267037485759c733e508a530b6a1f48220978c9dbb2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882702, "uuid": "e6d30e3d-1e21-49f3-8bc2-a7981faf4e2a", "value": "8DF4BF352EA94136F1F69FBD95A4644157BDF2236F03C86D78B912C90723A82C9F123B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882702, "uuid": "b0edfcd9-d9b9-491e-bf74-1a4ee8ab85ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882702, "uuid": "25b6f510-048f-473a-9208-d15cb4685a3d", "value": "12288:Nvj2alEqwuo3BE3e3H/78tDeHAlMLoYxms0+ZOn1q+91reRLj+oGtqiJP:Nv6OEyW789dyxzOngE1CZj+owJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624882702, "uuid": "257d0e3e-038f-49e6-9b79-6cd8c0b47cc3", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624882702, "uuid": "65d87f77-934a-44c9-a014-1d9fb1d444b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882702, "uuid": "c0859a31-6f4d-4385-8e99-6c7636992101", "value": "Scan097766.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c95c45-d803-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624879549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879549, "uuid": "4bdae3d8-0973-4688-9979-f3b6b9c4fba2", "comment": "Malware payload", "value": "3b512ebe6403a75297f37f73eb3fd81b", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879549, "uuid": "388af9ce-d6f2-4eae-a8eb-5f2e3032ddc6", "comment": "Malware payload", "value": "c4ea61fbcb7d6d02280ac5ff9d41fe65ab42caeaededfe21d46caccca3d69611", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879549, "uuid": "5635a8cf-0d17-4988-90c9-a46b5e1b095e", "comment": "Malware payload", "value": "6ab23d06b933f9e312e926bc5601690538fdd1c4", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879549, "uuid": "ae263d66-320c-4453-931e-31b047795ddb", "comment": "Malware payload", "value": "c11363ca512f48fcd9ee4cb62ff9d957e97235b0966315e4abd44a564bf50b5272ca569984b63106a8e0819a2bd73ada", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879549, "uuid": "f5364b96-d6f2-46f7-99f1-c671b1388a94", "value": "644512046CCE6AC7E1B75ABD2302C20DAFFCED6EE6A9A1151585B12C37F1972074B127", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879549, "uuid": "e5e21dcd-7d3e-471f-b963-01fa2c040595", "value": "24576:deJ1r0bfD155LKR7wN17Nh3bY1ojIQv2hbhPoqWhn:dogZ558wNy1TQv2hbhAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624879549, "uuid": "20393033-43ad-4c6c-b87a-8670e8d6da84", "value": 1227336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624879549, "uuid": "aa3f2a37-4408-48f9-b907-a98f969a04cb", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879549, "uuid": "cb83528e-77da-4399-a4e8-f86a7541742d", "value": "PO20210628.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f9082c-d7d8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624861000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624861000, "uuid": "033ff404-687a-4ec6-8159-3d64dc5e4c5f", "comment": "Malware payload (AgentTesla)", "value": "7ed00eed06a792bea8e808c3b824db88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624861000, "uuid": "146db7f6-86ad-4182-bac0-d1e973bb370c", "comment": "Malware payload (AgentTesla)", "value": "c5808930a7bae7680c98a7ad4e5501b23c3cd1095d2ec4a7ea874a28e985dfd5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624861000, "uuid": "f68db227-8f5f-4f6a-badc-a0c4cee727a1", "comment": "Malware payload (AgentTesla)", "value": "8a385bcd833f7f1ed15725e07f94d0109b1d3192", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624861000, "uuid": "6fed25c7-2171-4a41-acc9-7712e323567a", "comment": "Malware payload (AgentTesla)", "value": "e29bc2372e7dfd89161311d04ec9192f519f362261a40e419f4a00896361b8e37bf61dc936626053211acec2fc7a7c3a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624861000, "uuid": "4142ff64-2378-4cef-acaa-c1e7bfc686e4", "value": "1A25AD24BAE55425F4B65F7D8970A051117EFE226F17883D34B932890B33682C9E2B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624861000, "uuid": "48c1da5f-09d8-4a95-ba86-e9df24ead161", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624861000, "uuid": "188eee4b-9ce1-4ff3-b38f-6a4115e1549e", "value": "12288:tAwuo3ybgv35yT+N65fCSOCtoKsOjprHp8vWWIP7XKBy5OIul2uoBpb:tgExO+oCRCtBjptuN85FM2uGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624861000, "uuid": "1a4b1b3a-71cf-4a60-aa18-47ffa401b741", "value": 1020928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624861000, "uuid": "438323f6-58e9-427c-9b9c-f7cf754d58ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624861000, "uuid": "0623bc5f-8ba6-4e23-bd13-141fb29d522d", "value": "10220178_2464_2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "940c53ed-d803-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624879544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879544, "uuid": "158dc12e-0a6c-4cb9-97cf-ed6ffc141b55", "comment": "Malware payload (RaccoonStealer)", "value": "00881b7dbc8707508244306c2ed3aaaf", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879544, "uuid": "15335fdf-62cf-44d2-b968-8e8327042ee6", "comment": "Malware payload (RaccoonStealer)", "value": "c5a4161ad71fd05a414d9e2bdc1324074604ebf821f8cd821253e5d0e24f5748", "object_relation": "sha256", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879544, "uuid": "15d9011b-8305-4e4d-a09e-79f2ef834be0", "comment": "Malware payload (RaccoonStealer)", "value": "2a4af9309c90211d9804b9a34ebbb0aea4f16c6f", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879544, "uuid": "f5f0d61b-7d1e-4a2c-9f99-a06b0e4142f4", "comment": "Malware payload (RaccoonStealer)", "value": "4640296222b88bd05d950dca4f0b7d70776d80c5c947a2b4373664a55eb9d3acf0ace3c2bf4c55b73f85678fd309e77f", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879544, "uuid": "e96640e5-6f18-471e-af4a-c0392d488755", "value": "0445122A6E6BC231D43754B3BC6096FA2827D84CD74C9D621C133617563DBE0ABC2B6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879544, "uuid": "a9797090-40a7-487a-b80d-757cc952288a", "value": "24576:PrchxNAKD1VS+tSeQNWhzvUm2wLCvxl8TaGxtq0UblDW4OsrBT+Bm:PrcnNNAeQNWRvUuLC5iT7qxF7C4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624879544, "uuid": "6a91b7f3-8a9f-40f8-ac55-f26ab9d55988", "value": 1236840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624879544, "uuid": "9367bcc2-0cbc-4711-a5ab-ca0538f409d6", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879544, "uuid": "bfe9d4f5-e414-4f64-bcae-b13a52f8e1ed", "value": "Purchase Order June 2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f97a3762-d837-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1624902048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624902048, "uuid": "7a92d141-3711-47ad-9688-286a8e0f1f3d", "comment": "Malware payload (BitRAT)", "value": "033e60b9306106332107840d1eb2477e", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624902048, "uuid": "c77bc3c4-d66f-4c79-b2b2-58febfe8c4bb", "comment": "Malware payload (BitRAT)", "value": "c6513d7fed8e4f4e3bdb5a632f06090ef81fa880b92d42f088acdfb23fc316e6", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624902048, "uuid": "98b45809-9ff5-4015-bd4c-6b2c25ca42c2", "comment": "Malware payload (BitRAT)", "value": "4efc5dbab121d59e12dcf15f9262add9d8575048", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624902048, "uuid": "64e2945b-4510-4847-a447-cbc20daca6e8", "comment": "Malware payload (BitRAT)", "value": "114438409879fa4fecff3dd592117a105d1332df3fe86c9a68f8c38663af2185cd27f6d1cb005236fcdf21502df7842a", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624902048, "uuid": "63bfb15c-b5cb-47e4-9fef-b94857da648b", "value": "61B5DF1D07E3AA6DE50AC1F610868D0C1AB0AD65FD89EB0A766F38B10F33D17AD42577", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624902048, "uuid": "631bee09-1a05-4de3-b09e-758e0ad09939", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624902048, "uuid": "327e06c2-ff8b-47ad-a363-a2c389b6eaa7", "value": "49152:5/Ez4k21GRRnmt1paYkRmAf6fPb0V1pS9zt0jLCU/8NABR4GA:Z2T2+nyMCAfkwD/jL2N6+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624902048, "uuid": "8f18fa5a-e083-4375-aa14-ac0bf9913407", "value": 2355712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624902048, "uuid": "97a0aa2a-22bf-43dc-80db-912a8ba81a9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624902048, "uuid": "e24a8fc6-b705-4e80-a5bd-210be992a9b3", "value": "033E60B9306106332107840D1EB2477E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e706b26a-d7c9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624854772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624854772, "uuid": "987b14e1-febb-4565-9b52-e0d987657aa6", "comment": "Malware payload (AgentTesla)", "value": "91600aa0773ba97ed2b5a45d39ecd16d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624854772, "uuid": "0ee480ae-72ed-48e6-b34c-a9499c8b81be", "comment": "Malware payload (AgentTesla)", "value": "c85157f36c52660741960b4e39e4864f195b677ccc1db7f2df86e5e85e65a497", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624854772, "uuid": "2fee309e-fdfe-4186-8481-9a67e31b6a53", "comment": "Malware payload (AgentTesla)", "value": "71a16489b5df9636a16827337aed8a51a8ec82b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624854772, "uuid": "26427162-c97c-4ffa-9a2c-8c3c7815aa03", "comment": "Malware payload (AgentTesla)", "value": "c1cc355f3114afc3fb736b3d5889789ae3b7e1f17503e70c2bed653d2a9ca8bb3fcd7d23c13fe316e820acd189aead51", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624854772, "uuid": "65b6edd4-dc97-4263-9439-0e3d868c0905", "value": "4B94022879F98158F67BAF7695F0255145AABE2B2923D40E19D1320B2F337C1CD82E3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624854772, "uuid": "50d1cb05-8f8d-4de3-8f56-b6bec7b6b63a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624854772, "uuid": "7b16c863-f11a-41b5-854b-6b82eb9c200c", "value": "6144:ycSu2zzAjfujTvCwum90CGA61/xGy4AKJd2lJj51Qx53OdWZiStuBGH+vm:ycj2zkSjL7um90v/wy4d2HAIW1tH+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624854772, "uuid": "968fc1b7-bddb-42ec-a6eb-5b316ac8660e", "value": 434688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624854772, "uuid": "2fd77b23-f6f2-488d-b615-bfd5288528cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624854772, "uuid": "cef4f9db-5544-4ca3-a50d-27f3a1bfd68b", "value": "SecuriteInfo.com.Artemis91600AA0773B.28624.27347", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c592585-d80a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624882538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882538, "uuid": "bfff96ff-03dc-47a7-975d-9ced916c873b", "comment": "Malware payload (AgentTesla)", "value": "49385dc95a499cf09db2272e355f3faf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882538, "uuid": "e10cde5e-e498-4148-822e-72aad5d969be", "comment": "Malware payload (AgentTesla)", "value": "c903e9eb1090ce3ac58709c05f04256fbb2acbfdcae9b09702b5b32aec899cf9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882538, "uuid": "e3fd3ece-75b0-41ae-ad96-ad155b5f6ac5", "comment": "Malware payload (AgentTesla)", "value": "daa7972cb57a8e77226ff9792caf1c911be17c33", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882538, "uuid": "3c43f99e-31b8-4259-804f-ddbc1a792e74", "comment": "Malware payload (AgentTesla)", "value": "e79cd3ab97f38ab571255ff8f4a942f1899db8a39732792311f6845bca786b89df20e70bc7aab6c956878dc9046ed6f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882538, "uuid": "93452cde-fd8b-4a8f-9b86-6bb42b14af0a", "value": "8E15BE202EE95126F5B65F7C89B0244156BDFE622F17C87D28B532891733A43CAF127E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882538, "uuid": "30d78804-d682-4e7a-bd57-aefcf04158e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882538, "uuid": "82b0e3d4-024b-420a-9ef8-976effe28c3d", "value": "24576:SAJJcgoxAkb3r3d35TjfU2SUwj1EL6CwZ:5wbxh3r3jE1EeCwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624882538, "uuid": "1b278a49-d78c-4a54-85fb-1ee1dd5971d6", "value": 946688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624882538, "uuid": "83e3deb4-7ec1-4163-bc0e-69c90b6f3147", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882538, "uuid": "75f8640a-a380-407d-82f9-c5b1a30a878d", "value": "Scan doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055d3de4-d842-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624906363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624906363, "uuid": "b1eda576-b2f6-4405-91a2-beda613d4463", "comment": "Malware payload", "value": "5bac09a90e10468ec0fea2b1f56017c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624906363, "uuid": "6fe0707b-173a-4dd2-bfd4-8d249ea9893c", "comment": "Malware payload", "value": "c97cda763454e133cbc38dfd3a400ccdf594107f771b34425cfb979cb426432d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624906363, "uuid": "691aac08-e65a-42ae-bfb9-0c1674d23323", "comment": "Malware payload", "value": "2436d918c256ae3e2d058873c8aef5765e5eb058", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624906363, "uuid": "af6f97f5-223b-4ba8-8ae1-7e0ea995d5af", "comment": "Malware payload", "value": "c91f45ddd96c1f84e27690ca72af883905a11072b675c0b8626a952056c30f2470120c73d987ad649494a3444273ed7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624906363, "uuid": "f56709c1-a0ea-4ec5-9654-2b298230fa7a", "value": "FDF2E0343266B5ECF83244F1565447483A710FF491E3FC1791A3A6A7AF9406EB8A36BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624906363, "uuid": "a0da24b2-49be-444b-b456-6fa0bbaa4e09", "value": "768:DHkmWBWfJ1WnzqzmH81AnYgq2XLcRQDs0JgGlzDpxYsj:DHz1OGmH81AYgAtsVrYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624906363, "uuid": "eef29ab6-b1b0-4111-b508-531329313c9b", "value": 37272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624906363, "uuid": "f9424710-d0ad-4a40-bbd9-cc0e2f9d856e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624906363, "uuid": "02ff9c26-0584-4633-9a6d-5f79aa91503e", "value": "5bac09a90e10468ec0fea2b1f56017c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae687b7-d7b6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624846484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846484, "uuid": "50972734-5f14-4de9-b317-b0987da4475c", "comment": "Malware payload (Mirai)", "value": "317c5f5ef9be0517efd1159d3b64a7b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846484, "uuid": "ee440f34-79c0-4426-a896-0ea263e2b1d3", "comment": "Malware payload (Mirai)", "value": "cbb73da8871c997bed6ebe4114dfe81aba07b951deb185df53b98dc0fbaac8b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846484, "uuid": "62e32ae9-624d-4189-8d3e-6fa1d06df53c", "comment": "Malware payload (Mirai)", "value": "ad14a2abc4405d5e99794bef745f260f8475d708", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846484, "uuid": "34fca42d-a554-438f-bb1e-85312552dfaa", "comment": "Malware payload (Mirai)", "value": "aa74bd3550154fd49b5404ee1093869e38976620b37b6be232063b44ffa0b6121d882cef003ca6058162d590f0e60848", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846484, "uuid": "c9f85c84-3fdc-47c1-9a20-869a0e1a9471", "value": "5693504E6E714F7DFFAD823897B79E209309339616A1C684C1ACEE025E70389741FB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846484, "uuid": "fcd0d831-3d06-42bf-82ac-40b473c9e5d6", "value": "1536:fUNyqwipEXzKt4kKSdkVz+lW8QYExjSk7IB6S3sWXHwpvJQEHAB:8mkKSdG+lW8QYExjLMb3sWXHwpvJrH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624846484, "uuid": "3556c5f4-5a47-47f8-bbde-f4048c0a66c8", "value": 92268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624846484, "uuid": "9c16f38f-90f5-4586-957a-95722b864303", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846484, "uuid": "20e1508e-2810-480e-a9b4-cded594c3e40", "value": "317c5f5ef9be0517efd1159d3b64a7b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba963ee-d7d0-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624857626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857626, "uuid": "1c227beb-4eb0-456b-a3c2-962c31be03db", "comment": "Malware payload (SnakeKeylogger)", "value": "6cb5843f813dbe6aae3c331a1454473f", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857626, "uuid": "085fbc3f-f709-48a0-8d45-a7421d246e0a", "comment": "Malware payload (SnakeKeylogger)", "value": "cf0979e009966dcbd4bbfd300daafddf3f36a3b7e384adb4b91e0e97fb7d40ba", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857626, "uuid": "3b786aa8-2162-4f49-a940-38c98fd4511d", "comment": "Malware payload (SnakeKeylogger)", "value": "d6c5f99f0927b91c1c317662576f488a7eb98b13", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857626, "uuid": "5b96067e-6aee-4638-9d05-1dbe9eacaf94", "comment": "Malware payload (SnakeKeylogger)", "value": "f4ab7b595cc7d2e965c97622f140e648ee6b473530a7cc5c97399de845becd11c4ad352be2d22e8194bfaddc074c66be", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857626, "uuid": "c6080836-d404-4323-be24-4898dd148055", "value": "ADE42339338015C4F714DB3DB2A8CF22ECD365B98771C6C3926E95A178891EF8325A68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857626, "uuid": "cb21eca3-9708-4998-b40d-9d4dccd9b860", "value": "12288:o7IAuIlVtncMWGgbZi4TznCOBdMe8piS6l5aItAKwOKaGR+2OCS9IAJAIn:o7IAIhbZi0CGdMemIAxWDbtJAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624857626, "uuid": "252117e9-618f-4108-844c-a063a1dc620a", "value": 657728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624857626, "uuid": "6ffd8a4c-84da-4bf6-b0d6-27cb4c6552d5", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857626, "uuid": "da905452-e1fc-4929-9e4b-1f7a119cf6d1", "value": "MIP17-MTA002 TBE Clarification Rev. A - EASTERN.Tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf539483-d81b-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1624889951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624889951, "uuid": "d3f8f290-8cbf-4386-9272-1c7116c24446", "comment": "Malware payload (GuLoader)", "value": "039d19e28f3d690e493ea61968d21737", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624889951, "uuid": "bf97ae14-36ae-4870-aee7-d026a88e3ff7", "comment": "Malware payload (GuLoader)", "value": "cf3c44db34ac38044d1f9dd8dcb93fc67165d59338467f099caaaa25fdcf5ae8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624889951, "uuid": "9058e652-fb3d-4be3-9dac-08fc2e3cf296", "comment": "Malware payload (GuLoader)", "value": "9c18aff684a6d542935bfde39f031609797d429d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624889951, "uuid": "ecc7db77-2f87-47a9-be30-228c97558cb9", "comment": "Malware payload (GuLoader)", "value": "92a82efa0521ef8313e1174ce64c0229d148244ca5d6de8c9a26dfcca730ddcb76a4f09108fcb82c1b4cd14bcc2ee65e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624889951, "uuid": "0b81bd0f-cd9c-443e-bd6b-42319a18c882", "value": "5D9349237AF84CA5E1CB4AB10C71DDB9265A6C231A435F87787077AD3C398037971A2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624889951, "uuid": "cfef918d-5bdf-40c5-a479-e7ea7057a521", "value": "2985ff75f7931350f11c6168668770a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624889951, "uuid": "74a0b275-98c6-4240-868c-2bee4e91ffc0", "value": "1536:aRBpAO6MStqZIp+Saj23JSa1juwCxJtEDx9dxcYnkbuJDB:a+O6MStqK8SAaJ58uZxFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624889951, "uuid": "2abbeb69-1e42-4117-81e9-c5677522c102", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624889951, "uuid": "017d0331-aa72-4d49-8546-760354520943", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624889951, "uuid": "7e3efce3-73a4-462e-88c7-b64edcfbb7aa", "value": "SKMBT Ref 6-26-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea839a9-d7d7-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624860664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624860664, "uuid": "e6a206a2-dc68-4c0f-b81b-5157e6a078ac", "comment": "Malware payload (Loki)", "value": "a5a0d8c50db20164b4897cd982926e08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624860664, "uuid": "791ad6b9-afae-480e-a9a4-083ba3d0aa29", "comment": "Malware payload (Loki)", "value": "d01ae8d985a333d9c39bad55b8129b73451f037bff556a08ddb7f7efc17818fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624860664, "uuid": "96fa3b07-411f-4378-bf5e-c4ee7ec19d82", "comment": "Malware payload (Loki)", "value": "430ae871a18ea43cb87cf3d8030ec4eb14043284", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624860664, "uuid": "6071fc7f-0123-419d-81f8-336c9660f997", "comment": "Malware payload (Loki)", "value": "41055e92c5e3cccd6034d66262ac37dfb12e6dc802e5d30e203f63704bc1326ab052e9341398ed3c75d1eb84461cebab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624860664, "uuid": "04720e11-1884-4615-b18d-0a100d901666", "value": "D0046DE17740E8B0DA7E8470A70719F82C8E6C79884586C7C2C1352E36F6797E771B96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624860664, "uuid": "4b36cd15-b035-4d20-af3d-2e0cc7f6be7e", "value": "4244c8904c5bfe48e604806d30e28aae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624860664, "uuid": "6b3084b7-dc8f-48b3-9360-074163ca0838", "value": "1536:Ij3kNKA2xhjR8geZUQN1bq15UzZBoeMPQmvO4NqAH9fxtSJet8eNdqPEVBP181t3:U0NKA2xNmgeVN1ppmzqAd1/ct2LKk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624860664, "uuid": "8ffd8c9e-efbb-44da-8b2b-f736d72c8bc6", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624860664, "uuid": "84ccbf2b-6d07-47e6-8f81-135896880105", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624860664, "uuid": "193a4402-c952-474a-9290-67469530ea56", "value": "new order no. Hc511 for June.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e414d492-d7d9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624861639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624861639, "uuid": "2df2c447-f2e2-4843-9418-107ab3ac51bc", "comment": "Malware payload", "value": "d6b881d9850c06b8a003079c7f6c0727", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624861639, "uuid": "f25b92c9-c9d3-459f-b5b8-7c386a41da5f", "comment": "Malware payload", "value": "d082a1af4b67474b36c4abc0a5af1297a87a6aeb93eebd23085d5f2402b43f52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624861639, "uuid": "96de1cc9-ecbe-4e60-9a00-4003b6e25258", "comment": "Malware payload", "value": "981216fcb48431a3e7e26711291bb8f2235b2211", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624861639, "uuid": "44ac386c-490b-47fa-b1e6-2b5e88170fd1", "comment": "Malware payload", "value": "b2894b9e3aec710df5b844987b8fad417fbb9247ddff59aae7104a3870a7b8820a797cfb3b9836639816b2a6e03be845", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624861639, "uuid": "46cc551a-aabd-40a4-b8c6-afa2ddb58442", "value": "C445336374D8CA36DF634B751C74481347ADFC8E4831B23B77446EEE3A700529A287AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624861639, "uuid": "17bf7fd9-5ed8-49b6-a622-68ef80fe0a8b", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624861639, "uuid": "ee7cf197-0f52-464e-9f8b-759f3e75b0a2", "value": "24576:ZF1ZUJ64YXVEKMND4ryfiz5mWeevLEQMQQ3AJhMMguHCDD3fsu2boJGEf/A:/1ZUJxaVEKYwGQoipyOhfguH6PcjUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624861639, "uuid": "7479e3aa-c05b-4d93-bc04-c8ea83a6b7da", "value": 1240186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624861639, "uuid": "3f373ef1-c1d2-4b29-9cb4-6936cf4a1a77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624861639, "uuid": "d36ea7ce-8100-46df-82bb-35b9f9064f20", "value": "d6b881d9850c06b8a003079c7f6c0727", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1c39f0-d800-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624878350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878350, "uuid": "77ca7b4d-ae95-4d54-a292-64a61a3438ea", "comment": "Malware payload", "value": "219202aa2355b68ee4ea61056fb13b37", "object_relation": "md5", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878350, "uuid": "520becda-dc84-4cbd-a547-a4904a82b88f", "comment": "Malware payload", "value": "d0d3743384e400568587d1bd4b768f7555cc13ad163f5b0c3ed66fdc2d29b810", "object_relation": "sha256", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878350, "uuid": "aa5cd576-7f26-43f5-b567-8acf45998704", "comment": "Malware payload", "value": "e437221542112affc30e036921e4395b72fe6504", "object_relation": "sha1", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878350, "uuid": "7b2da59f-3548-4e5f-853e-5231170de0b8", "comment": "Malware payload", "value": "aeaaddd33e63c2737ba41357f61c115a059b521b02d9677eddf292eb71dd1db1880cfa8d6b867936adecbc24fbccfe89", "object_relation": "sha3-384", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878350, "uuid": "97fde365-2e47-41ba-b5eb-4a82a2633f0a", "value": "0F922E71C8E06B36358A481F7CB1FD58930572D6AEF24618F4EE69944FBA830E7158F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878350, "uuid": "0dea01d0-61d3-4f35-b031-930cf3240323", "value": "384:HnQp7wcw96cc666c06U6Ut04vo0Os6UP4vo0OB4vo0Oq6Th6t:HQpcbMcRDcpJUt0vhUPvBvzTIt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624878350, "uuid": "56fd80ae-caf2-4435-95a8-9c0cb21a7bc0", "value": 19801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624878350, "uuid": "d088eab9-302a-4965-b55a-8163f4e32d16", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878350, "uuid": "4ccd0908-e3a6-4c14-bb28-43ca89a6239b", "value": "d0d3743384e400568587d1bd4b768f7555cc13ad163f5b0c3ed66fdc2d29b810", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaaba2f0-d821-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624892467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624892467, "uuid": "d4256d28-a783-470b-ae2c-341d0f49b8d1", "comment": "Malware payload (NanoCore)", "value": "ee0091b9d740cfb069435c3075bf5988", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624892467, "uuid": "acb3a609-73b8-4aed-992f-6ee84c477142", "comment": "Malware payload (NanoCore)", "value": "d101e393b85225ee4736ff59419df94b13d253755f8e6e0f08777bacf259b672", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624892467, "uuid": "136a582b-1daf-46ed-935c-60776dfdec22", "comment": "Malware payload (NanoCore)", "value": "558fc89c24f1911ee14ca1068dd10e30ad2364d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624892467, "uuid": "2fe87b2b-1c07-47f1-aed8-ab80abb02e08", "comment": "Malware payload (NanoCore)", "value": "7e4f10173a7c15ca7fe52a392498cac1606be242d883a57009b100229710cbe6cedfcc0d4d1a19d15b235ef76e101a63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624892467, "uuid": "451d6de7-8c04-4411-b312-e1ee49df6c01", "value": "F305E0343AEA5118F177EF744AF475D59AAFB7733B06D82E2051034E4B13A42CE91A3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624892467, "uuid": "d1a5448c-17eb-4514-8c51-289360caf27d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624892467, "uuid": "825eb0c3-cd53-41ef-8720-6fec5848e5c3", "value": "12288:byJZaF9GF2FcJ/voxb5QU9ony1seiYPaYFVHbERqTH0EyrnCA8FymO4mWC2YGvGB:bNjqJib51OyIYFwZuX8m+WC2YkGRgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624892467, "uuid": "05ddd820-08d9-483e-9650-4bf8012fa2b0", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624892467, "uuid": "a55beb81-533e-4609-9335-1bd87cba54ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624892467, "uuid": "b7a69d43-59ab-4e0a-bc74-09448aa62eb0", "value": "ee0091b9d740cfb069435c3075bf5988.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9982fbb2-d81a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624889432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624889432, "uuid": "b26d6cf3-d685-4ab9-ba4e-6639fd3f6d71", "comment": "Malware payload (AgentTesla)", "value": "e36359dbe0ab2f963234a1ba382cc70e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624889432, "uuid": "64a6d7ca-1a97-44c4-b72e-b50ab669388e", "comment": "Malware payload (AgentTesla)", "value": "d23d5bd5b15617bcf7426b94f5d10cffbe4a5fcdabe6429816879cb433fa4d80", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624889432, "uuid": "d4696d06-1d3f-4db5-8939-edce3965cfba", "comment": "Malware payload (AgentTesla)", "value": "48868f8ed57cf7c932b231d1d54c641a954187a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624889432, "uuid": "277fb746-ccbe-4d30-baec-514fa193dc06", "comment": "Malware payload (AgentTesla)", "value": "37a2e7e95ce966d4c66a34149933011c3af4d736dfcad8d1419068c7f38d331faeb5bd6d2363ba3e92f423420c2e7e23", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624889432, "uuid": "4a0f2453-c5bc-4b51-9982-045490193082", "value": "7DC4D04076F81BC2E67997FB1DE2545187FD2D2F692AE2082EC172CB6672F400951FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624889432, "uuid": "f03fb998-c3b9-4529-b5ca-592724e257a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624889432, "uuid": "7a68fea0-90d6-4dd5-adaf-d784e71fa04b", "value": "12288:1udBVsXT8xn3NHGLvgJVupJXjJIhEVmwpmmMi:wBVM8rGLvQM7XjJIhcmRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624889432, "uuid": "91118b1a-e583-4447-8e23-e4372ee44b5c", "value": 559616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624889432, "uuid": "9c169cdd-e9ac-4736-8161-844ba29e040c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624889432, "uuid": "16922a56-c9bc-4182-aabc-e53d60e4d747", "value": "PO200024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c627be36-d7b6-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624846557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846557, "uuid": "ed2800f0-81f8-4496-8abd-f1e73fead2cd", "comment": "Malware payload (Gafgyt)", "value": "a3e5e2db4f7f0bff2254f626854844b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846557, "uuid": "2972388c-857b-4db6-8ef8-ec4ecd27ef40", "comment": "Malware payload (Gafgyt)", "value": "d4ad4fb74615b84afc210828070a2f97c1ef4ed1e36e37431ffd5f440168cb8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846557, "uuid": "5d29cf4d-d7dd-4e41-9683-4c84926dd223", "comment": "Malware payload (Gafgyt)", "value": "707d17d2d1b6cf5244b05a110efebf5d9694b9d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846557, "uuid": "9ba3ca50-1669-454b-9c91-b01a89999c34", "comment": "Malware payload (Gafgyt)", "value": "3cf586f77037306cdb8da63d3a092985adf460d8a607ccc2e3e6eb315981e6e112bb50e4ee00c1621eb26b300b3b2738", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846557, "uuid": "69c84044-054e-49fb-971b-fa2fefead2fd", "value": "52B3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846557, "uuid": "e9bbe1c5-e766-4d97-837b-8f536ebc0768", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZioamm/QcuLB1niDNb:YuFX0GIk1MHyphXamm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624846557, "uuid": "0b95a836-7317-47e4-9b1f-c892ce2dd5d0", "value": 118090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624846557, "uuid": "df0c3d0d-645d-4ee5-a7ac-fc301f83b4b3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846557, "uuid": "4831723a-f4be-4de5-bcd3-1337651bc14f", "value": "a3e5e2db4f7f0bff2254f626854844b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ef0eff-d864-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1624921262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624921262, "uuid": "e7909fab-629d-4f48-a686-cdcae6abdedd", "comment": "Malware payload (Stop)", "value": "7915c2f4364406d2ed1fb883dc58ed4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624921262, "uuid": "742ecd0d-0eda-4452-aa12-03e07d51d179", "comment": "Malware payload (Stop)", "value": "d56681bb83bd1e54372061cf2e24017106e1fc6a26a86388c907db320e105060", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624921262, "uuid": "bcc14039-69fc-43a8-9d53-dbfde8914d0a", "comment": "Malware payload (Stop)", "value": "ee7629f0238a07d5f990dc0e625542fc106d81f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624921262, "uuid": "8a4cd77c-4008-452f-9b8c-d1748d37d802", "comment": "Malware payload (Stop)", "value": "8bb5b877c1fa94e4409c0076630bf907bb0757625a2627907b310eaf7daac7a07b59ad0c25684ada6128a4efc376fe8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624921262, "uuid": "f3a88a9e-af41-4e4d-b189-bb669071a8df", "value": "4A150100BA91C031F5F315F8993592AC993EBDA15BA450CF12D9EADD63386E2EC31367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624921262, "uuid": "19802875-eb10-4453-a80d-7bbc4caf40d5", "value": "5387efa108146c925b39d07106b3a7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624921262, "uuid": "c743c629-fee3-4acb-9dc0-a32e38f3eec4", "value": "12288:082xcwXoQxcEfjeY8SsGXIQq7cxRIqMnTiaYFTvJGQ8gVdlL9hlmQEo:0VxAkj/8qXQ7OqMvIgV/Lz4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624921262, "uuid": "92693571-d853-4543-9f00-c46f0a13759b", "value": 891392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624921262, "uuid": "d04589ad-7ae6-45c1-9d74-86ed8ca803f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624921262, "uuid": "733f8610-e09a-49ab-af74-6cb005d7ff59", "value": "7915C2F4364406D2ED1FB883DC58ED4E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3aa5bd5-d840-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624905823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624905823, "uuid": "86ca5cca-dc0a-4dba-9c3c-430586a6963e", "comment": "Malware payload", "value": "3052104aae0be113dda27e92ba77da55", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624905823, "uuid": "a5ed89b4-627b-4d8a-92c6-8d7eefab1200", "comment": "Malware payload", "value": "d5e940d782ea46730d6a3c3b443912f8060d916b3d569bab653bfd2d3ba4d945", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624905823, "uuid": "b1aa5819-b93b-4c74-8209-768ec9e42193", "comment": "Malware payload", "value": "057a49d14507b52eedecebc353648066884e5c8e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624905823, "uuid": "d83444d8-79ee-4688-9818-292615707b8a", "comment": "Malware payload", "value": "48165a697543c558a888fca9486608aa6fbac6e904e1b0b48bab383a3c1a2a12101d6c61f373293b83b2474db74463df", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624905823, "uuid": "4ffee309-df22-4b6e-80a6-01b99e8fac08", "value": "8C6423EEB8EEB4A4FE61F834E5DED6D3704008534A12C46339251FBB6C46F358A059D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624905823, "uuid": "44cdd634-d262-4510-a3a4-be2f73540a73", "value": "6144:CuCThBpXOvo8VzVOVg9tmHwFO/UsvRdqV22ZYe2sNI:JCDEo8z19tmHIOssv2VrZ52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624905823, "uuid": "fcd2e8b0-868b-4c2e-8635-22d3750940be", "value": 325945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624905823, "uuid": "c84e7d26-65a5-47fe-b2ed-ff9410f7482b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624905823, "uuid": "baffcd30-b25a-4f8f-ba81-ceb476507a09", "value": "OBBOTA.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0f931e-d864-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624921081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624921081, "uuid": "032c2992-9ef0-4b51-82a8-1bfe3edd13c8", "comment": "Malware payload", "value": "e199f02ffcf1b1769c8aeb580f627267", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624921081, "uuid": "31196ccf-eb28-47da-96ef-e7270ca22f9b", "comment": "Malware payload", "value": "d6762eff16452434ac1acc127f082906cc1ae5b0ff026d0d4fe725711db47763", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624921081, "uuid": "2c6895a7-484e-4a6f-ad0a-0f7fb2dd8950", "comment": "Malware payload", "value": "9586ebc83a1b6949e08820b46faf72ee5b132bca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624921081, "uuid": "c225c060-cfb2-418c-8b67-413053987947", "comment": "Malware payload", "value": "7dc1a6203dfb4e11c6cd08763090968b18de0a2aece226f790f042719bbc7b22588d2e76bdd5d98ea844909b1d7e465c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624921081, "uuid": "e13358b9-22fd-4e3d-8216-3e1ae36ee327", "value": "5BA32CF7E57561EDC676B33625CFA8F7E07070B826F6640E6BC5294D23108890EA713A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624921081, "uuid": "fd8ed882-c0d6-474e-929b-11703d4d9cc3", "value": "3072:Hb+XoBHfYu/gggwgggwgggwgggwgggPskLoCf:Hpco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624921081, "uuid": "b7a4b81e-7b8b-4bc1-a2b0-a09ff79dd4d7", "value": 105232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624921081, "uuid": "74ecefd4-f464-4f44-9ce5-ce3b7ebae2eb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624921081, "uuid": "6ba10f4e-62ac-489b-a470-3f85fef6f94d", "value": "d6762eff16452434ac1acc127f082906cc1ae5b0ff026d0d4fe725711db47763.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7029a05a-d847-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624908690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624908690, "uuid": "b10b615b-ae10-4ed8-a4e7-2f00913a6ac2", "comment": "Malware payload", "value": "7282d45e6e4b90fb4ae95ff95e36e4c0", "object_relation": "md5", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624908690, "uuid": "050253e7-ec1d-4273-9276-873c7b425f27", "comment": "Malware payload", "value": "d6d22450a3cb3552c14ad7af8deb1df1b2d94aea2761cf5107b18a4e4c43882a", "object_relation": "sha256", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624908690, "uuid": "17983156-d037-4044-8a31-9c9f74242798", "comment": "Malware payload", "value": "377ea39b7097c62cc5ea43bfe15ab4fd4cc5bc45", "object_relation": "sha1", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624908690, "uuid": "d55c3ac2-073a-4fde-bdaa-f3f735d5cbe8", "comment": "Malware payload", "value": "6808db999371d981c0dc850694d4f7179aa4d7fcf2c690de132f049808486a684d8fba41a719ebd0b7513bc9e5f22fd7", "object_relation": "sha3-384", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624908690, "uuid": "b34f90dc-ec62-4712-a08a-8da8a6f34090", "value": "3333C018F112DC61DB1FED7896F910B076B707F4F2A06CA5AC90D24D4AB109E8A777C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624908690, "uuid": "dbca9d9e-3d1e-4b8d-a14b-0df494f2a9bc", "value": "1536:/pBuio9Ym0QIOf7SieU6ZDvxjxcpAr/USvhWj9/://9m0WSiebvxju4/UchWjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624908690, "uuid": "394cb704-a311-4676-b134-bf4d5326759d", "value": 51718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624908690, "uuid": "a1f0ff8f-76ea-4609-af65-30b377be0d24", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624908690, "uuid": "509a9c41-15dd-469b-b68a-8b68c3b49bff", "value": "0621.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0fb2390-d806-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624880881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624880881, "uuid": "6ca9fcfe-fd06-4351-a6ab-b8cab74fb73b", "comment": "Malware payload (Loki)", "value": "1377082a9426aad3c55bcc506cdce14a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624880881, "uuid": "24fbc408-0a15-4529-a802-f97f652017b0", "comment": "Malware payload (Loki)", "value": "d8344cceed5e1829a6e2e47de5f216768faee744caacaa3c579347c344ddcb65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624880881, "uuid": "d765395f-2073-42cc-a542-baffc208d50a", "comment": "Malware payload (Loki)", "value": "01234e0dfa0a36dc7511405b7b6c4e01c1619b37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624880881, "uuid": "3a739756-9e99-4ddc-a68a-55dbedc64741", "comment": "Malware payload (Loki)", "value": "373b9a542c65387f696d68e26347734e5c4d0d9fc053492c3e6566793d1b2109db0e3c799f0520dfdd527ac4c2cc4319", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624880881, "uuid": "2586b5f2-b5f9-4ce4-ac9d-5ca2e5c44522", "value": "8115BE68329071DFCA37CB3189242C54AB617C66631BD22BA053359DAF3D697CF112FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624880881, "uuid": "6132f75f-83d3-45d1-bf0d-db33cf0d9b68", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624880881, "uuid": "d17d65ec-25ed-4a19-80f3-00ce38e2fe50", "value": "24576:j4HQAJNSVznemY/GhfuDz4rL0tcMtCVKrI:jcJNSVzCtI4/CVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624880881, "uuid": "eed22c2f-41e9-40dc-8c03-dda89750a151", "value": 944640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624880881, "uuid": "0374f1bf-1b2f-4f55-b182-f88ad884709c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624880881, "uuid": "b148e5c3-091e-434c-972e-082717d83607", "value": "1377082a9426aad3c55bcc506cdce14a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f18caa-d840-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624905852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624905852, "uuid": "20fe9cec-57ff-4fe6-93a5-88d7ee336a49", "comment": "Malware payload", "value": "d2884e2646535407b81da9e5ac802356", "object_relation": "md5", "Tag": [ { "name": "csv", "colour": "#EA7260", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624905852, "uuid": "b09b2aa6-8901-4d48-a221-6e8d721b4293", "comment": "Malware payload", "value": "d839465f8a4f8a3d8c47f4057a72defc5c3d792d4e50014d5231aff519e36ffa", "object_relation": "sha256", "Tag": [ { "name": "csv", "colour": "#EA7260", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624905852, "uuid": "b8cba1c2-40b1-4299-92c4-cb0878d800b6", "comment": "Malware payload", "value": "fda916c868b745d525cdab4368ba9080c4fdb094", "object_relation": "sha1", "Tag": [ { "name": "csv", "colour": "#EA7260", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624905852, "uuid": "7aab9a92-037d-4674-98f3-4a75c8fbf541", "comment": "Malware payload", "value": "5e872f7ccdc41b65d7aaec12bbc8a098c0b96707caf3883cd74530a5fc7e524b3e3c38ac66d04f966977a6484f35393f", "object_relation": "sha3-384", "Tag": [ { "name": "csv", "colour": "#EA7260", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624905852, "uuid": "0b69f510-4e79-421c-a5cc-d43c530fe75c", "value": "F8A3CF7C21F32845935329514AB3BD514863DBEEF5AAF0C0B624A31E35A43FAB97472C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624905852, "uuid": "eeb5ec9e-2211-494e-bace-bacd23f7be99", "value": "1536:QMMMvK1b9btoKopMMD1dd/t/29TTTL3EEELoYPfGzGzkwbbGsX:QMMM51dd/B29TTTL6oYP+aBbbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624905852, "uuid": "7192a7c7-290c-4628-ade5-551337369ce0", "value": 98451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624905852, "uuid": "79176a2a-833d-442a-a6a1-a15af69a534c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624905852, "uuid": "9cc49293-e098-43ff-8110-1c1afe39c9b0", "value": "21_06_2021_sipari.csv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8b3193f-d840-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624905832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624905832, "uuid": "694b64f7-c513-4152-bcac-4f7ba5e91e22", "comment": "Malware payload", "value": "d24f9baab815c7a3ff7968d843e6d1b9", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624905832, "uuid": "224d4f21-d968-41bf-afdf-ce8c0f51f778", "comment": "Malware payload", "value": "d90b70a7edb41d5d5479a56f391fc999a276968e30e8efdacfc24f402efa4ad2", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624905832, "uuid": "4e56f87a-7e0c-45cc-b13b-82607075e598", "comment": "Malware payload", "value": "db69d57c8f440cf478e93d6e2b485e751068ca38", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624905832, "uuid": "8b0f14da-258d-431b-b074-c8f66fcfa74d", "comment": "Malware payload", "value": "fa4d9da5058bba3e915c929c79627ddfba902b79f45d4202c77db1119c3d628ce27c001042b689b8e9ff8ae6fe8e7235", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624905832, "uuid": "72be951b-cd82-4182-a7af-abd150a01d25", "value": "FA6423097AF1A541E0FF92F8041A729F875845F71A0ACF2B23397DDC548269DE4AD6CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624905832, "uuid": "d8ffefa8-2309-497d-be1e-9a36a9ab54e7", "value": "6144:uGM5z3DUIG7synUWuDmQFnqUMiw8DJkWm7Mt/xCWIIkKEJ+SsUTT:KtbgsynUhjVqUMiPDiAz0kSVTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624905832, "uuid": "1df74569-210d-4940-b2ea-e5abfea3abcc", "value": 326279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624905832, "uuid": "38a3e6c6-c9dd-482d-87e3-4b1e9ca2e15f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624905832, "uuid": "dd58b7e2-8456-4d78-b50d-8f688536cb91", "value": "ULPPOR.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1a58a4-d869-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624923531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624923531, "uuid": "7a1177ec-f0cf-4661-948d-231d0968b60c", "comment": "Malware payload (Mirai)", "value": "fd91a73c16b3961916fd94ec05d2eda2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624923531, "uuid": "d301c703-6aed-4f9d-8a75-a7ef6c442148", "comment": "Malware payload (Mirai)", "value": "d911acc28e6d0ef9ce85658b22b80832050fa8a67459bb7ff3e2036d3e15cb51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624923531, "uuid": "63e4d819-972f-440f-81e9-832290c307d6", "comment": "Malware payload (Mirai)", "value": "739dcd6b81c945c7c555255c16547780b77c0ec2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624923531, "uuid": "8af61cc4-31ba-43b9-af31-5c655e7b591b", "comment": "Malware payload (Mirai)", "value": "3317f97d1830ee9e17f515e528ad50a0b7501e75744db8389c06eddadee6826d4f7143bf95328d4ffb5f427ce460236d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624923531, "uuid": "9a1f1cec-701c-46fb-89b1-17f19206f939", "value": "00E2D1F26A8A8C7775700976E69E07CB316206B7C48F3176B57C417DBB9288504F6321", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624923531, "uuid": "960936b5-c28f-404d-8582-1a049f50abec", "value": "768:icxcQ94O/lzwkFRWYAVspYpjkrix6y3UG:7xcUdlzwkFRysSxss6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624923531, "uuid": "da4e7e3f-af67-4b98-abf1-facec277b274", "value": 31896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624923531, "uuid": "4af0042b-6825-4850-ac9c-4e86849e88e3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624923531, "uuid": "88e72af3-1d01-4d36-8a8c-741e50c09f97", "value": "SecuriteInfo.com.Linux.Mirai.27.11688.28944", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "317a7f5a-d824-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624893552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624893552, "uuid": "e6aa868f-beab-4e20-9df3-a2f57f319ebb", "comment": "Malware payload", "value": "627c71b8827ba5e653385c061359f296", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624893552, "uuid": "9e166fc6-2803-4e12-bba7-8484482e9877", "comment": "Malware payload", "value": "d979d2932d4cf4bb0337b58347093e963a7bf35312f6001e5b1eeeb2209c1f45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624893552, "uuid": "67bb266f-09d9-41df-8dc5-2d009866979e", "comment": "Malware payload", "value": "2ed7ba5f82a13ef975ad6995479a26e971126915", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624893552, "uuid": "3fe8f742-2b20-460b-902c-cff056ce2de5", "comment": "Malware payload", "value": "5728567ecd1e3451d56cc2fc9052c4b64939c5e2f8333819e388defde212d43c76398a8f8d5023b01517a56cc7b0b939", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624893552, "uuid": "c91abf71-57d0-4b3b-901f-e4a4900ff945", "value": "C315BE242AE95126F5B65F7C89B03041567EFE622F13C87C68B532C91733A43CAB127E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624893552, "uuid": "4bcf2e3b-8b62-4f97-bbed-7b44eb4477b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624893552, "uuid": "a0265c01-615b-4df0-b2ea-5e01f4964c39", "value": "12288:ycwuo3QbJdRri4xFWSQjT107rF8GwB9Pc1uYOJXi/TbQrRYh2Xcc9L+35u5k:yq7jWVHlAfQr2m9LE51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624893552, "uuid": "ba093980-6e76-417f-832b-49172ec71ecd", "value": 931328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624893552, "uuid": "c6d98635-ff5e-4646-acd0-3f1334b34cd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624893552, "uuid": "922ca5ef-3127-4d06-b502-7dd800a8a8e9", "value": "v1tP4Y5x218SYjd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85e2f60-d800-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624878316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878316, "uuid": "4fd55bb1-1980-4540-a8fe-1912df7e3a8b", "comment": "Malware payload", "value": "f64a6a99c383d72701829ae11a7deb04", "object_relation": "md5", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878316, "uuid": "915f4f30-537c-4111-9e8b-43783d96c86b", "comment": "Malware payload", "value": "da68dc9d5571ef4729adda86f5a21d3f4478ddbae2de937f34f57f450d8a3c76", "object_relation": "sha256", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878316, "uuid": "1789d6e2-5cd1-4236-9a56-5bd1020c4f39", "comment": "Malware payload", "value": "36407477fb8d38549015cc158f09bdff7df80f3c", "object_relation": "sha1", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878316, "uuid": "42070b70-e6c6-417b-bb9a-c3f915a83e21", "comment": "Malware payload", "value": "b73014380d403bf5490e6be01c7e50e4d90406d5e3ed6e685666b89e033a9a6e5d097e4d5b1145ec71286414751b638c", "object_relation": "sha3-384", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878316, "uuid": "2082575a-8f5a-43c1-aeb1-366163aee84b", "value": "D191A8E836D0D2F6285E873ED9614124942DD0D3DB682D1C97FEE9A2603DC36703F514", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878316, "uuid": "fb204d7a-76ed-4fb8-8a51-277b396db840", "value": "96:9+91VjJUMBx2pLNYj89c+/Px2pLz31kh5i1/hdHJ:9+9TJ7Bx2pL289c+3x2pLz3OhgZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624878316, "uuid": "23ad7be2-e981-46ad-99e4-82f0db4114d5", "value": 4392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624878316, "uuid": "c4f698ab-af6f-441b-831c-db5df8839d3c", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878316, "uuid": "5c32eb7b-1a6c-4dbf-9d24-c57dd2f533fb", "value": "da68dc9d5571ef4729adda86f5a21d3f4478ddbae2de937f34f57f450d8a3c76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c26f1404-d7b6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624846551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846551, "uuid": "a7288b4c-495a-437b-a2ed-0082dcaff0fc", "comment": "Malware payload (Mirai)", "value": "ca23dc87780430fa1d6e4bb301b4358d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846551, "uuid": "e1440cb0-2f6f-40b7-8e5d-a33be91207c2", "comment": "Malware payload (Mirai)", "value": "dc0cea1182d0d0b819754fecac60e9a53cb9c669384b3ce68cb63dbc060aebf2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846551, "uuid": "3420f4e6-6355-49e8-b6ec-6ffda1cac6ad", "comment": "Malware payload (Mirai)", "value": "325aaba1e344b773d263779a5c49ff8ce578308e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846551, "uuid": "ef653934-fcda-4da6-b7dd-fa97f1ce067b", "comment": "Malware payload (Mirai)", "value": "c5bbb594519607a80be41f0562f251a66011c4b737abbaa398b6766e982dd1113fa564bc8fedfda972f342a195cacaf0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846551, "uuid": "9c9bf12b-3c2f-4e3d-965b-059d4be32d0a", "value": "1CE34C86FA408A13C5C61B76FAAF42493322DB55E3DB73068D185FF43F86A5E4E13606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846551, "uuid": "39b4e0af-c9d1-4181-8ba0-81fa46954e19", "value": "3072:Hib6klR8ucU1JYqNAOvjXXEOav0YQgftaXWZ2M/9vo/r:OPR5cU/hXXEOavNQEaX9M/9vo/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624846551, "uuid": "7a25707f-20e3-4974-b3b8-360f1dac15a2", "value": 144079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624846551, "uuid": "3d3745ff-cd6b-4c2f-bc6f-cbb18bd8c474", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846551, "uuid": "6a18be0c-9a65-449c-b341-64a66b9ea107", "value": "ca23dc87780430fa1d6e4bb301b4358d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f793bf7-d83f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624905091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624905091, "uuid": "9638f6bc-2274-4c22-b6f5-4f6ea3284d99", "comment": "Malware payload", "value": "bc08865591026a001634c565dd94366f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624905091, "uuid": "178e1b55-0725-4170-9add-b3d116ad2030", "comment": "Malware payload", "value": "df282dc8473ef5d4d872f62d72da72471dd0bdce8b71c428197f74d86bcb329f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624905091, "uuid": "f2852055-d984-4b0a-8490-8217810dab57", "comment": "Malware payload", "value": "95fa6a7142b722600d920ae6fed0525702a69e83", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624905091, "uuid": "bf05832b-9dba-4154-b8a2-09e869dcf093", "comment": "Malware payload", "value": "ea42bccdfb6d4fecdb5b80802f74e40bd4268e8be870c0a868a7d9d511233ddcbf8a1106c70709ede0a92ca94caa823e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624905091, "uuid": "67537877-f896-4883-8281-40691d09b264", "value": "4AF2E1A109859621DCE718F9FD7C037D22182BB1CCA639D26835022DE8A9D61F9D0BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624905091, "uuid": "ee7668ef-3a07-4136-bcdd-eb701ecd29d2", "value": "768:VWL/3AIqMD7D5unD8SlIWvG3DeQ20UNSVuISAEQZ0f3Ue:VWL/3ZqM74nD8a23qQmNeuYn+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624905091, "uuid": "31be7f48-7124-43dc-a533-4682535c9a52", "value": 36656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624905091, "uuid": "8093e181-c3e8-4678-b5f4-61d15ef0419a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624905091, "uuid": "3cd271e4-c4eb-43d3-801b-333d3a27ee1b", "value": "bc08865591026a001634c565dd94366f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf397e03-d800-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624878355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878355, "uuid": "4a423ccb-5553-43b7-a7ae-c66010213ce1", "comment": "Malware payload", "value": "8224c9faafd5f4a8678bfa511fc4b5e2", "object_relation": "md5", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878355, "uuid": "34a27a14-1a77-4536-b56b-20bd8ec391a4", "comment": "Malware payload", "value": "e380c4b48cec730db1e32cc6a5bea752549bf0b1fb5e7d4a20776ef4f39a8842", "object_relation": "sha256", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878355, "uuid": "0bedac71-a172-4b81-9a60-e1dc9991ea81", "comment": "Malware payload", "value": "215d777140728b748fc264ef203ebd27b2388666", "object_relation": "sha1", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878355, "uuid": "9d39a3ce-1463-4c77-a33b-ce1a5f34d29a", "comment": "Malware payload", "value": "f1b2c5d4a4143c03237e16231598779c4063da3052a31e11530ae4810662ce03648b346fccacb2b8956d8241d6f1b25c", "object_relation": "sha3-384", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878355, "uuid": "d3f04e1e-f093-4a39-bbc0-9941368a66f6", "value": "7D820E7089E16B353489882F7CB1FD48D30122E6AEF24218F4ED69945FB6C30EB218F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878355, "uuid": "dc988753-7160-4220-a7e0-859e536d6dcc", "value": "384:wydCpDwMwt6x7666x04vo0Or6T4vo0OBdRK:wECpEL8xmDx0vWTvvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624878355, "uuid": "c5d31e5f-b898-42ec-84f0-ab634b554ced", "value": 17676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624878355, "uuid": "d1521619-297c-4a87-9e47-0e5fe4e1dd54", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878355, "uuid": "dfbaf66e-b08a-40ea-bcee-9dc66d0e5943", "value": "e380c4b48cec730db1e32cc6a5bea752549bf0b1fb5e7d4a20776ef4f39a8842", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23218dc0-d80a-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1624882361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882361, "uuid": "596b55c6-7b20-4a38-9f7f-c88c7202b773", "comment": "Malware payload (TrickBot)", "value": "bfd4fa35c69de603510dbd2ed94c12ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "p1", "colour": "#F0E65C", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882361, "uuid": "e79a95da-ff54-4309-9604-8f645bb9a91f", "comment": "Malware payload (TrickBot)", "value": "e387b4d5f18119293154fe71b36bdc460382539496dae504885afb529d110077", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "p1", "colour": "#F0E65C", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882361, "uuid": "790b9692-83d2-4868-85b8-0840dd976d8d", "comment": "Malware payload (TrickBot)", "value": "a51e4e4c39bcb793d03074da84aa064038ee46e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "p1", "colour": "#F0E65C", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624882361, "uuid": "e32fe812-946e-46f1-8458-a48ffca72b77", "comment": "Malware payload (TrickBot)", "value": "9231fc931fb90f2ea52ed764c0cef0941d5e361ad11faa40c3e4ea68f03b957a021d8cf1e9860b07a20faa2152bc3eb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "p1", "colour": "#F0E65C", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882361, "uuid": "e8dadf3c-b712-4d8d-b332-759a7bed419c", "value": "8CD4BE0676D481F3D1A706B14FD31ABCDAAAF8A81F33C66B2395092C4D75E42C636F25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882361, "uuid": "6db85730-d4f9-49b6-9b25-78fc2e7e0972", "value": "6ff3f62c7101b8c3f803def59318d7b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882361, "uuid": "7ee9e48f-84f0-426e-8cb7-e260275855b0", "value": "12288:tP1NmsZica3m6LNwNn+07tGrcmQHc4J3G+i7fDFk5kK:tbFa3m6LNEtGI7Hc4E+Am5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624882361, "uuid": "ae5c1e46-91f8-4794-aaa6-1b792d4da510", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624882361, "uuid": "61f8f7d9-4d75-4893-a1c1-0c12a3bfc498", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624882361, "uuid": "0a8cbbd0-619b-4de6-a4eb-17cb5bfba3d4", "value": "e387b4d5f18119293154fe71b36bdc460382539496dae504885afb529d110077.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f4a3f4-d839-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624902851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624902851, "uuid": "290b5331-355f-4afa-a91d-6632aed962fa", "comment": "Malware payload (Mirai)", "value": "e05906cf1384c2569b75cd3082c95f57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624902851, "uuid": "81fd2193-8ffe-4e0f-a7b0-6d962443e889", "comment": "Malware payload (Mirai)", "value": "e3c27fcf71b837412612273c8238d0ae69a697e4d2a17cbe364fca1b646c6e6b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624902851, "uuid": "a651db72-0a67-47b7-b592-a888b281b462", "comment": "Malware payload (Mirai)", "value": "44a602a87b4fff1b35c7f867ea98082c03e43823", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624902851, "uuid": "70c674ab-9704-4625-901e-2d5ee72fd679", "comment": "Malware payload (Mirai)", "value": "e58f825fbf823c49d9eb4a851fc91d6821bf6b1dffdba30d779243392f62a7ce261f542ae7eea64c286cd1feaafe3e63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624902851, "uuid": "4c477f60-de08-45bf-8d36-9a8f5533034a", "value": "68C2E0981B8919E9C2F9C17C07B81BAC19A40BA7F819DC8578FCF7619D8E4753023ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624902851, "uuid": "985fba60-ea92-4788-8c98-dcab88823f13", "value": "768:f2G214DFyosXqgvV9o1ndB08VeJgGlzDpbuR1Jl:f2GdDgosaaO1ndLKVJuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624902851, "uuid": "63d8de02-ac45-4d43-9d48-4b32cab0bdb7", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624902851, "uuid": "7557ea2d-26d8-4cb2-b932-ee9a46f4dd72", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624902851, "uuid": "341be0cd-43f0-4657-8739-bb07d90eae78", "value": "e05906cf1384c2569b75cd3082c95f57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c86f46db-d7e2-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624865459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624865459, "uuid": "f5c25e0e-e195-4d7e-a361-184bd29124b5", "comment": "Malware payload (RedLineStealer)", "value": "a730469a20e416d89ca44e2cb1bb76ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624865459, "uuid": "a5d85e52-037e-4282-b805-a66a3777cb75", "comment": "Malware payload (RedLineStealer)", "value": "e428642687996febb3be8602fdb7e548721248ea5c7d2231b9d2ff47006fe4aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624865459, "uuid": "ca6fb18f-7708-43d6-8bb0-c9f33fb9394a", "comment": "Malware payload (RedLineStealer)", "value": "51dd87747307f2606449e24a45c6e01d27374503", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624865459, "uuid": "37e3a34c-4b37-4605-8252-c1b38dd11759", "comment": "Malware payload (RedLineStealer)", "value": "dc7f99bf1d9686d43b7397f3470b463d02d0a53e44716bf704a838bbddc21930bc05275f3fd0ec169378235cf99c76bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624865459, "uuid": "84319524-bbf1-4ff7-b1ed-63a6daab9c84", "value": "4194AE10E6A1C035F1B241F49A76D3BC653DB9E19B2050CB63D5EAEE2A346E2EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624865459, "uuid": "741022b0-263e-45d7-8079-5044d47a9d63", "value": "fa9874ea3b40c6a14dcd08fa8e3175b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624865459, "uuid": "c1b486de-ca72-4be5-850a-478d71c6a1ed", "value": "6144:Z4mKJxyf2i4iEMyXMYsJnpODPO703rEgbkIIUOIOCf7Z3iD7kE:NK3yui4MyXRIn3iEgbkIIUOIJlo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624865459, "uuid": "2e68f669-6882-44f2-99df-d9c63bbc754f", "value": 429568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624865459, "uuid": "c346c9db-881f-4eb2-a401-c6fd49de2e75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624865459, "uuid": "9f31d4d5-af1e-4126-b03f-627424e09aed", "value": "a730469a20e416d89ca44e2cb1bb76ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720ad9a8-d7e9-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624868320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868320, "uuid": "62cf59f0-b8a3-47ed-a450-086d5cd1a76e", "comment": "Malware payload (Mirai)", "value": "ffd2a72fc27bc1372c31b86b80ade297", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868320, "uuid": "ec12bcf2-8930-4174-a949-a6f742a98e29", "comment": "Malware payload (Mirai)", "value": "e489003b848da94f2f647a64c0759339c6add1b578e949b5ba213b902c69b0eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868320, "uuid": "78ecef60-2b6f-4614-842f-93b405b9234a", "comment": "Malware payload (Mirai)", "value": "3ea2f94dc4641df1cca523ac5c03abcd62a61f6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624868320, "uuid": "d507daa7-cc2a-40e3-b38e-4c092f7b111b", "comment": "Malware payload (Mirai)", "value": "fcb2a479627224a4b1a5f0d2459cb0c855e91ff4af7e7f652ab6b77a38d7830b742e4fbc6c62c479f5d9896c2b2fc665", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624868320, "uuid": "4365e9dd-75cb-4147-9575-7b7f684444ff", "value": "17E25BA2C4796F98E30A42F4A4748E3C5713F615E7AB5EFA0615835AC003ADCBA193F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624868320, "uuid": "8a93d939-a28e-437e-97d8-9d7fd3974c87", "value": "768:tMaXTZlqqoOY8GUNwGZg/1Cjou7QbkxZ4Jh1:tMaXXjY8Gmwz/1zuekxZ4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624868320, "uuid": "a8307982-ea17-47a0-8514-93b4f6177c5a", "value": 32004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624868320, "uuid": "4b06ad92-57d7-4a51-b666-e8651f3e1563", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624868320, "uuid": "7ddbefb1-49c9-4819-83b2-0e2e4cd42f7b", "value": "ffd2a72fc27bc1372c31b86b80ade297", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ff1419-d817-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624888213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624888213, "uuid": "a1cc10c8-325c-4f19-9fe2-a093b0ff409d", "comment": "Malware payload (AgentTesla)", "value": "8b403fbd10f3babfca6baef2f5e7f8f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624888213, "uuid": "5202c61f-7f2a-494c-9dfc-a5da320628f4", "comment": "Malware payload (AgentTesla)", "value": "e62d94d18fecf24b0de7f8298685b35e6afecfeeddcc8ec73f038b6c2eddf2e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624888213, "uuid": "d553dfab-0d92-4e94-9972-981c27a084fe", "comment": "Malware payload (AgentTesla)", "value": "c6616bb92b8fbf49e39117f8b26ce661f6d40411", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624888213, "uuid": "0a4c1f5c-457d-430c-ad38-5f165fe7fd2c", "comment": "Malware payload (AgentTesla)", "value": "3e37fb7b96c20b6b8b8b0535014a5e7d032926891a4563b15a43e5144e7ea85c060a6a0c04b33f890855768f651971c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624888213, "uuid": "de765f66-90ff-4822-919a-334566e73163", "value": "CF456E90B594885AF8BB0FFDAD26642011EBBE5E5A51C00C25B9774A17B334290EFF1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624888213, "uuid": "fde23b18-d000-41f0-969b-6a6fb7cee839", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624888213, "uuid": "c970cd47-faa8-410a-bd12-c50b8c54d12e", "value": "24576:hgKqMQSyNAH2WHnzUPcCFQ8kHg42ERqbKClV2OrltPrD8S:u+QteFn6fFQa42EwpldQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624888213, "uuid": "35125022-ff13-471f-b8dc-4ba67da3771d", "value": 1200640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624888213, "uuid": "9a35d48b-0300-49ee-a148-4a38a7f7b7f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624888213, "uuid": "e0387056-ffad-41c0-a805-127dc136a338", "value": "8b403fbd10f3babfca6baef2f5e7f8f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0a1d56-d83a-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624903098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624903098, "uuid": "0ac37db4-5b63-4750-91c0-55c3b701d35e", "comment": "Malware payload (Mirai)", "value": "a6127124714a07fbe94811d39bfc5d0f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624903098, "uuid": "64316f6e-d7e6-4a51-8c4c-eefdf7594a4d", "comment": "Malware payload (Mirai)", "value": "e897fd1317a2d863aee305fbe22852bbee785f835eec4f7e78a6964a31f77dec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624903098, "uuid": "92a454c5-ffcc-4fd5-8389-7c86831ca65e", "comment": "Malware payload (Mirai)", "value": "beba4789ca29d5f99d8156427400f242f4da90cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624903098, "uuid": "243ce594-fc4b-401a-8f0a-6ffb4d6c75d8", "comment": "Malware payload (Mirai)", "value": "6057fb924b73119f204189597bac2a19c6e67648ea8b15fff8fa27711642b2dc9cc31907c623a0713800312ac1c88bb9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624903098, "uuid": "fed95209-9a29-41e1-927c-b4e0915ac0e5", "value": "B6B2D01DC0AE2EB4FEDB7D395941E2817B615BDF3A618DC02BC15A120622D2C1F9CAD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624903098, "uuid": "6d558f1c-8347-4b18-8d53-f199bfdaf459", "value": "384:2OA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIo2oSM4uVcqgw05VS:2AApCdvwJr69VJoA8FZtxCo8JoJ4uVcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624903098, "uuid": "dfa61da5-59fd-41dc-8e5f-435964b0d013", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624903098, "uuid": "75657fb8-9811-43fc-bbb7-3b5ff2c965af", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624903098, "uuid": "c102b59f-3807-4f55-b9a8-31b5059f67b2", "value": "a6127124714a07fbe94811d39bfc5d0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d639ba3-d803-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624879479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879479, "uuid": "8d8fbf6c-d811-43a4-b555-80cb367f5de1", "comment": "Malware payload (RaccoonStealer)", "value": "da750029bfc8d0fd52d52b10812d8cfc", "object_relation": "md5", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879479, "uuid": "62d86a1b-4115-4532-b5e3-f2b85c583ef1", "comment": "Malware payload (RaccoonStealer)", "value": "e992951d71d4d84d63cfa6bfbb4aaeddecd3ed2970a93a1a3e9df56720ae78e1", "object_relation": "sha256", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879479, "uuid": "8b2a2cdf-1ba6-4a67-85f0-22213598b683", "comment": "Malware payload (RaccoonStealer)", "value": "e77aaaf9643060b68a84b7c749661baeea038ba0", "object_relation": "sha1", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879479, "uuid": "d0db6246-d4ff-4945-87f4-6f789a999a09", "comment": "Malware payload (RaccoonStealer)", "value": "43da80f7bcef4a029e471243b5a2e75684bec6c8260fdd94f6f0df7020ae7a870e6c7ad1c1738d3a7fd7cf5d16a27358", "object_relation": "sha3-384", "Tag": [ { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879479, "uuid": "84d4b129-6bef-4416-bff7-642937d7e75f", "value": "4D551210BA568E93D3F75CB8D03903E557AE6D157B1BE4062236B8F06737870A7E98E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879479, "uuid": "dfddee7f-52fb-429a-9fcc-d3a87348f3dd", "value": "24576:rygOVofCiQd8Ks+iSrRXUYd+ecOF9LR5Tgf9cpXKJjc1x3xWw4Sb1:rGCfgd2OUYkOF9LR508qjcj3xWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624879479, "uuid": "95857992-f347-49c8-a9e5-95abf59393a5", "value": 1328280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624879479, "uuid": "a28c167d-2c12-4947-af98-565a482b517a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879479, "uuid": "7abc1c70-34d0-4aab-9414-b0f60c50a6d8", "value": "Panchakanya Product Catalog.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f696b33-d860-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624919265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624919265, "uuid": "5dc6d144-0632-48f0-800b-36f3a4618545", "comment": "Malware payload", "value": "395249d3e6dae1caff6b5b2e1f75bacd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624919265, "uuid": "61c7c767-86c0-47b3-b2f2-19e90b253d7e", "comment": "Malware payload", "value": "ea1872b2835128e3cb49a0bc27e4727ca33c4e6eba1e80422db19b505f965bc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624919265, "uuid": "ee321cf8-d568-470f-b77c-42aaee0b500d", "comment": "Malware payload", "value": "29f16c046a344e0d0adfea80d5d7958d6b6b8cfa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624919265, "uuid": "b06f5f0c-27d8-46c6-a64b-265fde9fd3a8", "comment": "Malware payload", "value": "72e4b955f45be6b799f4f4892451ae7098f753265e8ce9c2d8792f06bfe7fe328f15326f96d7c9010052a27385d75b2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624919265, "uuid": "6af0f3b1-a082-4588-8054-074d2f2e8c36", "value": "45A33CF7E57561ECC676B33625CFA8F7E07070B826F5240E6BC5294D23209890DA723A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624919265, "uuid": "37e2b3b1-9351-433c-b86e-c0bc442dc6f8", "value": "3072:db+XoBHfYu9gggwgggwgggwgggwggg9k+LoS:dpyvo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624919265, "uuid": "e7a36b0b-3ccf-4fcc-a720-37ad985dc1f5", "value": 105232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624919265, "uuid": "5359888b-66d6-457c-9052-e44126bc6da9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624919265, "uuid": "e291f581-3429-4ed5-aea6-9249f60af160", "value": "ea1872b2835128e3cb49a0bc27e4727ca33c4e6eba1e80422db19b505f965bc4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d01c17-d836-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624901421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624901421, "uuid": "b181566a-3240-4592-ba32-c0322cb7dd14", "comment": "Malware payload", "value": "4b38bf487f4aa6586432e09b84c135c0", "object_relation": "md5", "Tag": [ { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624901421, "uuid": "8f778cb5-2c16-40b7-89f4-9d5275201fff", "comment": "Malware payload", "value": "ea1b98909c12d3958fc940b25577316bbbb7b7357cd03a7d16b274ee114e587e", "object_relation": "sha256", "Tag": [ { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624901421, "uuid": "88a9f8e9-da63-4aa3-b292-0c98ff4930fc", "comment": "Malware payload", "value": "8c61e3da75c6ad2233da4cad25821858974c49ff", "object_relation": "sha1", "Tag": [ { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624901421, "uuid": "1712c82d-eb33-41e0-8b98-e53de12a4b8e", "comment": "Malware payload", "value": "c41c3a311debd009da65c162e80ea47d229dce78218509dfdb0de70f3446df143d6ebf8e334eff9daa652ccf2add39bc", "object_relation": "sha3-384", "Tag": [ { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624901421, "uuid": "bb7dfcae-ee2c-483b-9a9c-d65b518656b5", "value": "F1A3E1CED6A0D115DD57023A63DC66B13E6C37D90385279986DD2AFD2E06EF3688083E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624901421, "uuid": "cf1b7f24-85e7-4d3e-9c06-a289b809d2f5", "value": "1536:Xyk0wwlEOvfPGE1iOplEIZXRXh9mpkY3/kdFimxqETeZFVQIF1CEOaHmYhgFLbfk:rUlEOvWcrEI9CQdYebeZFq7jwgZSuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624901421, "uuid": "ccfc5e0c-c0f7-42b5-9712-dd878e29f1af", "value": 104200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624901421, "uuid": "249df6b6-543a-48ad-8dda-9f30f1276800", "value": "image/png", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624901421, "uuid": "26583a25-e494-4ac5-b903-04fd12796d33", "value": "28-06-2021 Pichincha app.PNG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c00fa815-d7ec-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624869739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624869739, "uuid": "d9041fe9-b3b9-4871-b1c5-748332510773", "comment": "Malware payload (Formbook)", "value": "72c0ad8a90304582b82feb6482c84836", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624869739, "uuid": "27beda1a-afd2-4ed5-ad36-8a653d210d38", "comment": "Malware payload (Formbook)", "value": "eb171136fc6278864dd32189da39106fe93b9ce615e3a72311c2a32c583e1738", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624869739, "uuid": "ef28e1cf-e4b1-4f08-95a4-622812584e22", "comment": "Malware payload (Formbook)", "value": "00efcb9bef85ebf69a48d81c46c659b431905e92", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624869739, "uuid": "c3a2dc5a-8963-464d-be03-5df023190174", "comment": "Malware payload (Formbook)", "value": "6988ab874966326acbe8f0e830cdf2673f7a334bf3166e7689d006c41c0490c170893b0afd88cc8329ecca436316351f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624869739, "uuid": "b3472a3b-dd30-41d6-8a52-885cf9e3139a", "value": "FD859BDB38255182C38BDEF09D6BB1D8922EF4E10CC455448812CBFA6C66AD7D70FD9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624869739, "uuid": "00b5d05a-42b6-4424-82ff-6c2820de11d0", "value": "1536:XsdRLURHtQQQQQQQQQ23QQuQZbJt9Xp9EiQZIgdRXqgZbJt9Xp9EiQQQ9QkQQQZN:XP3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624869739, "uuid": "1ded579a-4316-4af7-adf8-311ee002be69", "value": 1865662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624869739, "uuid": "4bf257df-c508-4e95-8575-1760b0fb7f3b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624869739, "uuid": "f6f26bf2-c071-4feb-9f29-2eda18792e82", "value": "SecuriteInfo.com.Exploit.Rtf.Obfuscated.16.18008.30596", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cceb3ff-d7fa-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1624875505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624875505, "uuid": "40446884-2043-4a3c-ab8f-080f0980e01e", "comment": "Malware payload (RemcosRAT)", "value": "ae30602300981c0dfe3dc1c0312b565f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624875505, "uuid": "277a9780-cefc-4453-9316-39290e6e8588", "comment": "Malware payload (RemcosRAT)", "value": "ebe0b8890392475537625aeefaec22b5f0115011e135117d7afd9325eb47fad8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624875505, "uuid": "7595f7ea-edfd-410e-bd6d-0965317d5336", "comment": "Malware payload (RemcosRAT)", "value": "f6d3580857825b3bd0f7155998647f4ba36fdd6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624875505, "uuid": "01b5143d-c4d3-4a01-9efd-807f5de46741", "comment": "Malware payload (RemcosRAT)", "value": "66634553a313a375845dea4a92aaea6cc7a2ec3aa2dc807ef0cb60507bb568e7161a307dd94410bf70240389b8e9ed68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624875505, "uuid": "84ef8a6f-cc4e-41c5-b269-6e001de92a7f", "value": "24F47D22B2E508B3C163697ADD5F92685C2BFF441E3828D36BE00D84DB69F913D251E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624875505, "uuid": "fa0fef30-1595-4244-9eca-6a4dc13c6f19", "value": "297e933499a18450c85ffd54c53cbda8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624875505, "uuid": "15fcb14a-38c3-4dc3-8d5a-f0fd88d4fe2b", "value": "12288:4m4Hco5sy2ziQSM9CUl4kR5UM+iQDMYAdQUivvvvvvvvvvvvvvvvvvvvvvvvvvvu:4jcPTS4CV6VQ/uQHvvvvvvvvvvvvvvvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624875505, "uuid": "93552c19-bccf-4542-8908-0550af57b1c2", "value": 756216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624875505, "uuid": "198e3372-eeae-426f-a0f6-7aa382abb829", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624875505, "uuid": "f9ee9d02-c585-417c-9433-154ea89c22fa", "value": "Dfdvfczl_Signed_.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f893a3ac-d81c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624890450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624890450, "uuid": "a8612426-efc7-4657-a85e-536b7e238aa3", "comment": "Malware payload", "value": "16420dfc1a2785b68d891752f80f009b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624890450, "uuid": "4ff1de7e-119c-4608-a50f-a1e1c756640f", "comment": "Malware payload", "value": "ec460117c220bf4797dfdbc1fd17ad61fe2dba7f315d91f065e4e9242bf50de1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624890450, "uuid": "bf48aa30-6812-4eff-8460-c7573357573a", "comment": "Malware payload", "value": "e95d657cb1e9da8ddc72d4dd0d249197d60e70d9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624890450, "uuid": "e0745e7b-a573-49a4-80c2-c1d333160b6e", "comment": "Malware payload", "value": "0eef539feef7735ada1f016a76834571c804f1fd3b873817155041fc170f77ba735e24df195d4b42218c63d26c6d83e4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624890450, "uuid": "5530b806-ca09-4870-b0f8-ee6f52a0d2a7", "value": "5AF423E34AA6138D022B31E3364BAAA106FD925F4D853EB7D71402DE85DD00F72EBB55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624890450, "uuid": "e48f5fa9-cb52-453a-ac90-d3a3892820c4", "value": "12288:T9izv01bXO7Qy3Ph2JgeuyQGWOTJUMEvE/B+dr6W6wol1OY09amRnmMSl+gJUESB:cw1U30JgeuyQjZMfBG973amRmzrqNG8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624890450, "uuid": "9f209c1b-cdcf-47b7-baba-83a54fe1f772", "value": 772423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624890450, "uuid": "3573c30d-77b0-49e7-a7e4-641c8dca775c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624890450, "uuid": "733b8270-67cf-4627-9e2d-0b37e32fad59", "value": "SCAN 972231_PL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec8b7a0-d83b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624903372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624903372, "uuid": "12a3d30b-a285-4b3b-b308-a9b756122f13", "comment": "Malware payload (Mirai)", "value": "2313e9b624b95d3d298417c2e1d2b8f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624903372, "uuid": "79b2de64-e24a-4cd0-a71b-2ec897029d5d", "comment": "Malware payload (Mirai)", "value": "ec8331f20058ccdd82c6f560278bbf6590ec5cc076d73d212b6b200977b56cb7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624903372, "uuid": "bc2a92c1-2023-4e33-8815-ca81ab8bc4dc", "comment": "Malware payload (Mirai)", "value": "04ca3cd7ea8e88ef8a9da7f0895912c5f7c65cfe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624903372, "uuid": "cbd48978-f55c-4c49-b413-c64c0d7a4bf0", "comment": "Malware payload (Mirai)", "value": "6ebf75133d68c6ae5c3670d8c54ba67b77a6c2ae21f797c9a56c6aca31956be41786b146c8ea8c099e816e8b975f1e8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624903372, "uuid": "ec3f5be8-1346-4d21-806f-44c19d9a43b9", "value": "AB338CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624903372, "uuid": "32e37db8-cd0c-4171-bf02-a90b75a191a7", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCv5:jaQFwtOGBvQXxfs3kgCJt/qMF/RCv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624903372, "uuid": "40a2fdc7-09a0-4a04-835f-ebabe6975c63", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624903372, "uuid": "694f328c-81e9-4e73-81c4-197d10d2ae83", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624903372, "uuid": "e28d3af6-abbf-461b-97a3-76ba6db71d0a", "value": "2313e9b624b95d3d298417c2e1d2b8f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7546ae26-d7d0-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624857588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857588, "uuid": "3ca28901-6c65-4601-9e0b-2b0d1ddcbcae", "comment": "Malware payload (AgentTesla)", "value": "8960203a1283a4b46d1c0b8573716fe3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857588, "uuid": "f23320e2-21e4-4b53-8ee5-ed1e096a59a6", "comment": "Malware payload (AgentTesla)", "value": "ecb3d2f8933eb1e048a42128cd5a6d0eb21745f55ff83c89c715be34db170e1c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857588, "uuid": "fd46728e-aa5d-4a23-ad52-4ac2f72c0210", "comment": "Malware payload (AgentTesla)", "value": "121fd09609e73731f5cd3bf2fd3ecb93cc483995", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857588, "uuid": "9995067e-1076-4b2e-be6a-6105159b07ea", "comment": "Malware payload (AgentTesla)", "value": "870e0c2ab209e19edc0bfe87e7f81baa9f12aff74317bfcbe4affb54317a5d66dc3f7d953428a51ea6eae8aeecdfa479", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857588, "uuid": "cf51c2fb-786f-44eb-a7d8-00012c4dbf79", "value": "A98423C420F46C8C9041F0CDB7795DBFC6B664758897A33A9274284E5A80066AADF7FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857588, "uuid": "847d4350-fd33-4525-a623-9492bf30c927", "value": "6144:/lAxgBi9auvDC01oZkug2GJ1joXmTSBXiMfiJiLIXtuDxS/gwyfyG7+il21:/UKiPvOYoZkTJ10XmTSQMq5XtExS/DQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624857588, "uuid": "a822f3e7-2e19-4a34-97cf-38ccdc23a2f1", "value": 385839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624857588, "uuid": "1b5ef55e-b5fa-41ba-92cd-aba3db53b2ed", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857588, "uuid": "d435300d-e9ae-4a33-8ba2-ac68c93933d8", "value": "Purchase Quotation.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa887d7d-d81a-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624889460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624889460, "uuid": "da55d846-0658-40e5-95bf-11b471e31a94", "comment": "Malware payload (Loki)", "value": "55ce2d3591e6cbec73f3812023d6c13a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624889460, "uuid": "a0d3d601-ab18-429e-9962-0fd72aa6091b", "comment": "Malware payload (Loki)", "value": "ecca3c26d7fead0982cf194f369a6eaf871c2a48c9d9b88f4b0c5d8aa2e279ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624889460, "uuid": "e1c5ed0e-831a-46fb-a42c-7d4fd5ae6506", "comment": "Malware payload (Loki)", "value": "a595804272de7ef48770c440d207f8d24e8c2fd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624889460, "uuid": "9a21a3c4-f08d-4119-b272-681e72de7dde", "comment": "Malware payload (Loki)", "value": "454228035effbce96bb8c2466d9b0f0ff37b9740d3ea21b16b6ca3b6bf773e6d461e8651e3e26d1f7a6a1ef7555d5123", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624889460, "uuid": "3e25b68f-37e1-4dcd-ad20-c035a23013a9", "value": "20053C9432E9C759EFF29F7AC4C1000495F4EC67E85AAA2565B673C722B7F800523B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624889460, "uuid": "82a68db3-ac62-4476-9fc1-6c359525d526", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624889460, "uuid": "ad5eba0b-3a32-4e83-9574-196e99f9a4cf", "value": "6144:e/nnnulgvsfQ7LUKAgDmLbyXAN7+VqmA5EHQbrH5MsWSq6tODZVJeWN74p:cuzf81AOm/ywNPmRYHhrbMSi4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624889460, "uuid": "74bdaab9-fbeb-4ced-b9d2-c737ae344c35", "value": 828416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624889460, "uuid": "35f9a4b2-3155-4cb8-a910-02f517996e73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624889460, "uuid": "14463367-8dfe-4030-b90f-9e51e7535018", "value": "Ij5nHFBTiajpgfL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c863b3d5-d800-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624878343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878343, "uuid": "ed7ea2e2-507c-4025-b1e9-e742ff5e7e7b", "comment": "Malware payload (SnakeKeylogger)", "value": "501660f2310efb40ca77a981044c61f5", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878343, "uuid": "0079c4f2-9e02-4372-82cb-3c588c8070f4", "comment": "Malware payload (SnakeKeylogger)", "value": "eec0c1a34f078642a001b1c3611159446d65586cc7f502780c005e4398c6298b", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878343, "uuid": "6eb91c88-788d-4a92-a77a-639751493f5c", "comment": "Malware payload (SnakeKeylogger)", "value": "10e401141ac5a99abcbbe9516764b20d3c97f31d", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878343, "uuid": "5c4b1fcf-f6eb-42b3-bfd1-1f2db8c3373a", "comment": "Malware payload (SnakeKeylogger)", "value": "070d6ab16ac14b9af0d1fadcdf2876fc7dd7edbb2e1135ab29b0ca24735920083f22b432327bb2ec573ae7c423bc2f04", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878343, "uuid": "1f0a934a-2cb3-4324-9794-69b5225fbc3e", "value": "A5E4231C89B5D9DFAEC2F13C40DCC2956023E1AD7B4AED62817AD91369AD61EDC0CC89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878343, "uuid": "991fa191-3110-473f-9fa5-709890aa7fe4", "value": "12288:3xfRE2akLR75t3lpEgAQ67NgC/hNovxc5h3fgQg8sOk4xUfn:3lRE2akT/N67/hCvx+PgysOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624878343, "uuid": "bccc1bd8-6a7b-45ff-ab88-3f3befc31c0b", "value": 692266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624878343, "uuid": "4d6df672-4364-4fe6-9e01-2cd75ad14aa0", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878343, "uuid": "2bc80c79-bd50-45b1-be30-e6fee39911e8", "value": "Purchase Order.LZH", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233e2e9a-d807-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624881073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881073, "uuid": "e80f87aa-224a-40db-a3ed-c5dc5ef363c2", "comment": "Malware payload (AgentTesla)", "value": "6613703584bbc067e7b834e4761703a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881073, "uuid": "1c265635-88ef-4469-a867-89d21e44b4f3", "comment": "Malware payload (AgentTesla)", "value": "f17a6575582d4c1a4fe6408486bcb9cb2fb80de24a35f0608ad995d4f206d843", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881073, "uuid": "fd4e405d-9c8d-46c7-b83c-7d15e69b1773", "comment": "Malware payload (AgentTesla)", "value": "4b9b224fc46e3e3db9b4d0ac1a18e9ce0ab6eb01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881073, "uuid": "9bdf1a49-bf6d-4bf9-ab39-3bc02db3eeca", "comment": "Malware payload (AgentTesla)", "value": "0649df7377ef057822703c54cf4eb07b37963503f8b475696bfbdb5a0a255d09cbffa8f409bae8171450b8187b59de46", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881073, "uuid": "84d2dc92-dd7b-4b48-84cb-2901d38adddb", "value": "49E4AE352EE94236F5BA9FBD95A4244157BDF2236F03C96D78B912C90323582C9F123B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881073, "uuid": "6029865a-e5f7-419e-a06a-a8a749236dcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881073, "uuid": "36faf79c-7a6e-42d4-a129-994ee242f711", "value": "12288:0/5qaEhBwuo3oQATJm31m6ixqv5aOOCVvi3hz/uqI2EOkGaW+MkIMwF9N:0/4jhIf3c64qv5aOOCB4hz/uqI2EO4Wb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624881073, "uuid": "51794334-0c6a-4cf5-9e64-fa94db8754e5", "value": 685056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624881073, "uuid": "a45247e7-ba9c-464a-b904-cf3a46adf0d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881073, "uuid": "4492e9b5-77f0-40d7-a425-db5f0e87ac95", "value": "6613703584bbc067e7b834e4761703a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff4e7025-d859-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624916661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624916661, "uuid": "9b36d958-bfc9-46f6-91d1-2c6ba6232621", "comment": "Malware payload", "value": "b4c6fe982399daa8dfc7bd5c90a3cd89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624916661, "uuid": "7aef8e14-2815-43d4-87e1-f5826052c1b1", "comment": "Malware payload", "value": "f1b8da7ab577c7650b2ad39d32298952bf6831374f553c18b7ebaad20392fb45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624916661, "uuid": "0f1808c0-dc33-4d2c-bf55-9630215217a7", "comment": "Malware payload", "value": "4925f9dd14776be1e8a5937d2de7a93d35cf6a8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624916661, "uuid": "0dfa7f82-13cd-4e5d-8ca6-145583485799", "comment": "Malware payload", "value": "b73bcd48bdb22d3b9deaa97144ce5b8642e44177fdaffc4675b11f7c60777a262c27f83558a46e8e0cd85132313b737e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624916661, "uuid": "0119db4f-4b07-4739-8624-894cffd6b082", "value": "1664F12C2EED116AF177AF319AF0395086BEB6122613E09D25D1138B1E17A40CDD2F3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624916661, "uuid": "7c93ce67-8695-44e2-834b-8e510fabf9d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624916661, "uuid": "7feb036f-3fc7-4383-b715-c6f8c1f86b0b", "value": "6144:tOzu2A8s4Fjb2Hz9g99NZyq1ylPCHAndwO5fvgBVrTuY+Q:gi2A8xb2uHNo/lPCHAn5fvgBVrTuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624916661, "uuid": "18d8ba82-910e-4747-9655-06c3596238fa", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624916661, "uuid": "e4e3dfbf-c571-4cbc-b668-e73e094af71b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624916661, "uuid": "025d9b35-b508-414f-b7ba-c4736e0b7393", "value": "i0GOFEs5MgSta4n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651e1e9f-d85c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624917690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624917690, "uuid": "a6984173-2ca5-4e43-85a0-7eeec397baf7", "comment": "Malware payload", "value": "0e80256d2f94813e12b595fc4df96dc7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624917690, "uuid": "0c771c83-c809-4755-ae01-61bf8f558ec7", "comment": "Malware payload", "value": "f2592295022dda9bd52d9379a7445e2052dd6da16e13791b069289a2eb0240e2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624917690, "uuid": "bc38f333-71cd-493c-9b51-75d28efeb6c2", "comment": "Malware payload", "value": "90253e757e3704e511635c5e9d410ddf3a0500f7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624917690, "uuid": "2fb1d49a-1356-41f5-a92a-feaaa6e95fd1", "comment": "Malware payload", "value": "35892112b2f5b2473317d07b4bc09f031ab32b456d1db18f42930df7729ff4bf700f3b6b6cfdfa97f42f350c3d15710f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624917690, "uuid": "e4c7e387-b84f-426c-8783-b1862dfa44a3", "value": "B3563317D6ECE18CF42F6174A8F22E76DB5E7CAEB25371C9A27E01118418CAFA133561", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624917690, "uuid": "9c982bca-b070-42ce-b2ef-a0b71dc8ad11", "value": "98304:EsBcQHvNZzQ4spzCOIr/wJagzKeWvJ1Z4bY000/grnofMF7HOfVgjSKgWXDRGaUw:EYHjzQz9Cdk8gzOxQornoUBqKgWQ196", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624917690, "uuid": "6173d351-20b1-41d0-b96c-18f90a2ebd55", "value": 6356612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624917690, "uuid": "5ae9cd25-804b-4122-a9bd-6845dc92f3c4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624917690, "uuid": "ab922e2f-b466-4284-8a2b-0a54fd62c17b", "value": "0e80256d2f94813e12b595fc4df96dc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "967c001e-d7c9-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624854637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624854637, "uuid": "62fa5399-60a1-47c7-8893-883eb7bf67aa", "comment": "Malware payload (RedLineStealer)", "value": "a463a5eddc0f2dd61809f863e071221b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624854637, "uuid": "dea9e8fb-8970-4c1a-9a75-55ebd8360ac8", "comment": "Malware payload (RedLineStealer)", "value": "f2ddff63a62a9cdf907533921e67c0221187c1f5b1740ae293b76095c721a6ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624854637, "uuid": "352f936b-ed63-467f-8998-87520ffa4e75", "comment": "Malware payload (RedLineStealer)", "value": "d7b126d84404305f3d62c2e936dd622495b4c29b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624854637, "uuid": "3ac824a4-5354-422c-ba80-9e8eeabef401", "comment": "Malware payload (RedLineStealer)", "value": "731c9b079fd64b4c3655a63cb5c2fa307f96c0208d84f0266358dae5aac57a1cc45b3a003166251adeee0b918fdd67af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624854637, "uuid": "b756cfe8-6b9d-41a1-9b97-c4eb0410aa2c", "value": "B8A33B16E3ACC656D7BD0935A5B0112547F1E2CBB042EBCB8EC068DF2E677C22A155F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624854637, "uuid": "89705945-ed7d-4d84-b1f6-161e0f8f7b85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624854637, "uuid": "11c7687a-171c-4a9c-8a46-c7c933aaa265", "value": "1536:hcdIy9hTJfvUneBM59wEtvRGb4pQ30HbPyFXdU08HKx/SEKG6aPU+RQ:hcWshVvGDfwhx0HTyRdLFY+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624854637, "uuid": "c6ca2d0d-bbc1-464c-b7e1-6d9d2bca22aa", "value": 105864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624854637, "uuid": "7c155692-aade-41f5-b851-b91dc7ed2b73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624854637, "uuid": "a477b03f-8c4d-4c2d-8340-0ca12b699c83", "value": "A463A5EDDC0F2DD61809F863E071221B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92e225f-d850-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624912785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624912785, "uuid": "5b9520e9-5dbc-40cb-8988-d8dd5bc85ff0", "comment": "Malware payload (RaccoonStealer)", "value": "3384706e2f8fb7877b86bf8b86c62f94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624912785, "uuid": "a9cef027-75b5-42cb-bcba-300e55360814", "comment": "Malware payload (RaccoonStealer)", "value": "f3fc2abd99598a304f3b1ba415493fa8cc6ad7057444a10e46ea5c72ea9571a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624912785, "uuid": "8b7b9ae9-8ed3-4592-9bb1-d0b0c2744a77", "comment": "Malware payload (RaccoonStealer)", "value": "6e81fac89a612bef8195471fc0085440556d3d57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624912785, "uuid": "fc4fee55-2a75-4d28-9d3f-f8758665011a", "comment": "Malware payload (RaccoonStealer)", "value": "b93f0752f7eb7be2e8accd8399517221ad05cf7a82c8ded8394c896c0e1d37a6debcf85d542ad66c6eb41233876a57ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624912785, "uuid": "a1454f93-c6fb-4918-ab57-0699167317f2", "value": "74D4CE00B690C039F9F311F599B99369A93EBEB16B1450CB63D96BEE47356E0AD30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624912785, "uuid": "62a64b89-c7d7-4372-8f6a-ff03e4d248d2", "value": "9cc652b98d99a86a80e16f2ea69ad54e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624912785, "uuid": "d19af3e3-5b5f-4d32-b155-1257321a6904", "value": "12288:TqlGXT8yEy96FPjJfDH2dQd8dflEn07ijlL8SocGRNiyiRomy8mg5JclLdLE:W49oPjZL2dQIuZGScrWk+wB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624912785, "uuid": "c08c3d95-b467-45ea-9736-e5316ab752bd", "value": 633344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624912785, "uuid": "ed1e9b81-0635-4620-a294-617cb1b9d047", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624912785, "uuid": "65781590-75e1-4a46-9cc8-7edbdd5f7404", "value": "SecuriteInfo.com.W32.AIDetect.malware1.653.1993", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51db3dfb-d850-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624912504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624912504, "uuid": "4cccf6ff-2d6f-444d-8641-5a3ffc2d83bf", "comment": "Malware payload", "value": "6904608bf1b22eb9aeca9d6bda4c99ad", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624912504, "uuid": "27646700-77d6-44d5-b818-bd576d344ac8", "comment": "Malware payload", "value": "f442ad7ecf750caad3de8f8109768782532bfcb7a09221a72a7afc6519f79cfc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624912504, "uuid": "c84c7c72-976c-4775-941a-40e32efb3fbd", "comment": "Malware payload", "value": "426cd5d1b966326ea1e894b3d935c74be13d822c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624912504, "uuid": "dee4a3a0-3bf5-4cd1-9b89-fb341c579749", "comment": "Malware payload", "value": "18200ffc466c59feb2b54227c05988f5056e0eeec075d844f68d7cd3f9c5e278ecfca3bd983401548c92217922b4327a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624912504, "uuid": "97a179b7-a7d7-4cb3-9dbd-f581e104d9fb", "value": "5856236362994109D0FDC93A8A337EE132F6072AC3836479BDED2AC630E59F4E513957", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624912504, "uuid": "03b613f3-3bf9-406f-815c-e3716914a5df", "value": "c0cc37fe3d7bd00205e28204da1ea30c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624912504, "uuid": "8c611c17-2bba-4e34-94a8-03872c88d21c", "value": "98304:ckkdyPhfS4IN9o108VyaYixBlGt5TkA+Y/EPRCfEJNTEZZGHec06usWLtX:ckpJa78u8VAirlircPRC8b6c0WEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624912504, "uuid": "a71e65c6-0fea-4055-809c-9c9b21932aed", "value": 6247424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624912504, "uuid": "51139292-111b-4e5c-8eed-89ffc93ea532", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624912504, "uuid": "ca430fe0-3577-4946-a98a-999965f2c36b", "value": "mPw295QW0uX0MCBxL71452ie", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6bd58d-d803-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624879313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879313, "uuid": "d8084e7d-8d5f-4346-94f9-210140e83336", "comment": "Malware payload", "value": "4b2ea32ec6a8a29a93e43f550d0f6df0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879313, "uuid": "96c981cd-9846-4feb-b72b-592552e4f08b", "comment": "Malware payload", "value": "f594bf8746027418a82a15be485bc26d59fa2777294f54777c86c295a3cef23a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879313, "uuid": "f814330c-b919-4b08-bbf2-ec67351434c5", "comment": "Malware payload", "value": "7347d97e4b364323529ea01709ec5ce7049e4d11", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879313, "uuid": "78ae90f2-a0fe-4f14-a0ed-82e21aa247c2", "comment": "Malware payload", "value": "5361afdd4381b262460a86fc7c07cccf4ad09098dd397d8cb94d7736035ecf0397973013a4c7654954a1bcf2e5e3cd5c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879313, "uuid": "b1c0e338-dd9d-4ad3-8eb0-7182d4b14f1b", "value": "3A910871876C09C6CC8B91F6E8957EAB22A7F52AD1CB0B40735EF9B10B3B310081AD02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879313, "uuid": "26ebefe2-1ec9-4c4e-bc03-d8bce11a089f", "value": "96:lvagauObrMZLQPAQmLYVv/Z2HYwtaX7k34N+jHJOI3FS:lvagauOXGLQII24wMo48bJOI1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624879313, "uuid": "e7eb6211-c5ff-44b6-bf9f-82f2420ca2cd", "value": 4586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624879313, "uuid": "06e16e47-ce83-4c88-800a-2fb3b28f82d9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879313, "uuid": "a5648066-93c5-47d0-97f2-6d26528d0083", "value": "Order Specification.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89353d7d-d7b9-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1624847743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624847743, "uuid": "1f29f966-e21f-4574-b8c3-b025479b5dff", "comment": "Malware payload (RaccoonStealer)", "value": "93963da2eb14233d540c7b21ccb91443", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624847743, "uuid": "901049cb-56e0-4e10-bbcd-018c9e7d33e5", "comment": "Malware payload (RaccoonStealer)", "value": "f7a0d1831875dbfa2b76e18103d93e5208df22ee6a490af7e5db0ddef945c2fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624847743, "uuid": "5e22c87e-89e7-4212-b4f2-54561b94b9be", "comment": "Malware payload (RaccoonStealer)", "value": "52e316804c6881a45770744dfbd1b163b038a541", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624847743, "uuid": "2f40fe11-4d39-4e2a-b933-a122586b81e0", "comment": "Malware payload (RaccoonStealer)", "value": "d6e4823c11a53eeb725a75e192110954c1975393e447ea59602fa7682743896c03cc93c2ddbf282ab0afa1a2e030d0eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624847743, "uuid": "5eb5ad88-f1db-4089-8420-e82087a29b7b", "value": "CED4D010E6A0C0F4F1B232BC897A9E79A5ED3DE0576450CF52C52AEA17B65F0AC31B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624847743, "uuid": "87f0fe42-98c2-477e-b69a-35eec3747ecd", "value": "58959b365b24aa3c98eb39fa519e2c9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624847743, "uuid": "7a1659e1-8780-4cbf-9e59-96b09477a8b4", "value": "12288:hWVkNtEd3w2exBHbRvRauBgRyzzAdApFa7zH3:hA0tQeDHbT9Rodgi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624847743, "uuid": "0438f7e7-2b34-48dc-b187-21f5479f2194", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624847743, "uuid": "7e193543-310f-4a55-9f17-e55800bab747", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624847743, "uuid": "850bbc72-56e1-4dd7-a792-e317636c22d8", "value": "93963DA2EB14233D540C7B21CCB91443.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8aa6b0c-d803-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624879659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879659, "uuid": "b6f65d71-0c67-4b1a-afbe-728fca2854b3", "comment": "Malware payload", "value": "a61e30ebb3018340010154846e5c09a1", "object_relation": "md5", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879659, "uuid": "e97212e2-beed-4e92-886b-4091ca4d7c48", "comment": "Malware payload", "value": "fafcce7e401f9a294b3dbbfffc5f59696dc8bdf876e388c40262f5900c654832", "object_relation": "sha256", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879659, "uuid": "fa925a4e-2274-432b-93d0-55060d41d952", "comment": "Malware payload", "value": "0677615baa959aec16c8e7c2768cdfbac3d4a14d", "object_relation": "sha1", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624879659, "uuid": "1f4be258-4ee1-435e-8451-36da99fbb936", "comment": "Malware payload", "value": "7599687f91bb51354d8881b4e9c5de2d04bfea632a21cfdaaa3109fd246c40ffdfe2eb66e701876fea0079ad329ddc0d", "object_relation": "sha3-384", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879659, "uuid": "0990bd78-bdd6-47cc-9db3-8898a173bc15", "value": "07C0124F8B5DC190920DE545739C6846644BC306219EFF0401B518DDB02947513A47C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879659, "uuid": "98a7f82d-eee4-45ab-9dfe-5e9c9575f70b", "value": "3:dZYSLVLxYJmKMLkXiECBKSNBNRcT2lkQLKIDLnNHKi9CAXGJfFpki9CAXmv:LYSLp+JmKMCiVBJN/ZLdDLnR9CAXGnpg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624879659, "uuid": "573c208b-a1ea-4989-af48-178d2f4b7986", "value": 178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624879659, "uuid": "0038a6f8-50e5-4d3e-ae85-e6f6171b883d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624879659, "uuid": "1b15cf33-8849-4137-8073-2710bbce8981", "value": "fafcce7e401f9a294b3dbbfffc5f59696dc8bdf876e388c40262f5900c654832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a80be1-d7b6-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624846527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846527, "uuid": "cd97adb2-a93c-482d-8e0b-c859f0c25ef4", "comment": "Malware payload (Mirai)", "value": "474ca725ab856b1d33b0e8863d0557e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846527, "uuid": "0e9c8af7-a0bc-4a6e-9092-b41c41461823", "comment": "Malware payload (Mirai)", "value": "fc15f0e87ca8bee79fb758f81736f66052a9a9508a93f1fb1aa17a1889af15ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846527, "uuid": "f5709ce4-b2d0-46d0-9585-3a84fcd1a8a0", "comment": "Malware payload (Mirai)", "value": "03b2abb71f11a583e15aa36ca405bce7918453f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624846527, "uuid": "586535d9-b274-40dc-bbcf-055164377b0c", "comment": "Malware payload (Mirai)", "value": "9ff2615db7e37e0966861cb57b1bc9d182efd23f39e11c75067ea8930b2d3cfa0e315703eec99a8ca7746031903fc8ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846527, "uuid": "3ea4b95f-4acc-4e41-98ac-428a46539abf", "value": "8E633B46EA87F9F0CD4506B8206BAF75C436A8333130DFEBEBD8B9179D56742605226C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846527, "uuid": "3056cac7-e8dc-4bf7-b9c3-9353ee71943b", "value": "1536:IeAolofbYYQsBehM1XcB3xESOUd3dg28SbmDeGr:IeyssLcBTFXbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624846527, "uuid": "ec20bf05-9d95-4ad7-8985-6552f12b5329", "value": 70232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624846527, "uuid": "6344f725-1417-4007-83b0-0ddd866b428e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624846527, "uuid": "d18afb59-cf02-40e8-8495-6ad811098d51", "value": "474ca725ab856b1d33b0e8863d0557e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24997c28-d809-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1624881934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881934, "uuid": "b61c7dae-50ea-43b8-9343-835a97242760", "comment": "Malware payload (AZORult)", "value": "de59d823aa280bea75dd6207c706453a", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881934, "uuid": "7d809cbc-8718-43b3-9bac-90dba2bf2be7", "comment": "Malware payload (AZORult)", "value": "fc924b8211821ca81f3848fda60e744e4dbf59c2fae116939b136cec3b3210f3", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881934, "uuid": "c6b16e1a-9e5f-4079-9045-6e26016b10f2", "comment": "Malware payload (AZORult)", "value": "859b2c61fe163c284d79e65101fb254a42c26567", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624881934, "uuid": "14348934-1798-4c9b-9e52-d0cb74545dc8", "comment": "Malware payload (AZORult)", "value": "9f77734b36d6de28b6e5cb706c944bf9f0f045fa6cbeb9967d575caaf175cec452ceef0cd0ac3962364baa7e5d3f2704", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881934, "uuid": "08056814-a045-4d3e-af45-331e46924f0d", "value": "7494EF099D247D70FD57B6FED0BAD5AC2B331B2412E0D2C818974FB22B32B85569EE41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881934, "uuid": "e3afe8b4-c279-4b8f-90fe-6b5caeb7ee54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881934, "uuid": "bbc0561a-af67-4731-8943-e7c9bafc227b", "value": "12288:VCKjxFWgQpkJ0xiTz7WT06KloQRIUZ5aNol:oJMz7oR9l6aN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624881934, "uuid": "ade4b5f7-985a-479f-bc82-0e0b3adfb52d", "value": 427520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624881934, "uuid": "bf2500a0-8275-4f7e-9f4d-9ab1e5733115", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624881934, "uuid": "b7f2957b-e329-49c9-a66e-218c754eb428", "value": "PROJECT OVERVIEW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa71d8e-d80c-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624883456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624883456, "uuid": "cc327a26-2258-4fbb-8da5-db2eee541927", "comment": "Malware payload (Formbook)", "value": "f94b7b97c25c3cba54e881caa18eaeb9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624883456, "uuid": "dcaf5aff-b036-4904-a9e3-ae4bd7d37ea3", "comment": "Malware payload (Formbook)", "value": "fdd0267b7a2fc993e613cd13de583f4c257467338134d5323ce49c0ad0f02fb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624883456, "uuid": "dffefdf3-3e8f-41db-8a8c-cfd41888bd64", "comment": "Malware payload (Formbook)", "value": "e501beb40456f7213f9bb2b6cecaefd7aaf7100d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624883456, "uuid": "7b9ff7c7-ac52-4bb5-a79b-54550f7d7cbe", "comment": "Malware payload (Formbook)", "value": "fd9f0e84cb21e8b05a823a408206cd8d8e6952754ee5b802548f508b9520448aefa15df720e654b0464ceaf2fa2cf2fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624883456, "uuid": "13ae8773-1f1c-4a87-b4c4-c9fac64845bc", "value": "C515BE207AE95126E5B65F7D49B0704156BDFE622F17C87D28B132C91733A82CAB133E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624883456, "uuid": "a7314303-0c3a-47b8-bba4-9f88b8975b22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624883456, "uuid": "b985d3f3-eda8-4aee-ac8c-047e096015f4", "value": "12288:oRpwuo3JbGgsD0C6jpHSgmZ9rUEok2+LA8lX2HkbMUTmVwQMhI2ZU:2gKGhZSlZWX2H9TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624883456, "uuid": "2e30ce67-d008-4db9-8e38-4903c25ffbea", "value": 956928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624883456, "uuid": "a847dc49-545e-4b2d-9bcc-c032dd92a1a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624883456, "uuid": "e5c9a3eb-c756-4b6d-a98f-afcfb6423f3b", "value": "f94b7b97c25c3cba54e881caa18eaeb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b538abbf-d800-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624878311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878311, "uuid": "9ff359f6-9454-40d6-b7d1-d36d86b3444a", "comment": "Malware payload", "value": "5c215494d938fbab70841de4a11e805e", "object_relation": "md5", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878311, "uuid": "7fccc1c2-8432-4e15-89a5-a5b1ebcdcdab", "comment": "Malware payload", "value": "fdd8c27495fbaa855603df4f774fe86bbc21743f59fd039f734feb07704805bd", "object_relation": "sha256", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878311, "uuid": "7b316fca-a821-4a1b-9163-2ca7d892d209", "comment": "Malware payload", "value": "45b57869e3857b50c1d794baba6ceca2641a7cfa", "object_relation": "sha1", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624878311, "uuid": "57db8b0c-7ae6-4308-b025-f33e0de67db5", "comment": "Malware payload", "value": "f26f103389c5ac824d4ed0ffb825580d55d0a8f51a1e07a7191f18230e8c70c99950da012825fc3767be117652f71ec4", "object_relation": "sha3-384", "Tag": [ { "name": "DarkRadiation", "colour": "#03A9DD", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878311, "uuid": "8a3f65cf-c252-49c7-a75f-3a5851b777f3", "value": "CED1B820EBD4943036024769EF9BAC90613D210B0A7CED6AFA9D61DD3F7051D12AB67C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878311, "uuid": "f4450098-97a0-4a35-bcfd-025dd98241b0", "value": "192:bKqB+hjzisuzL+sVI15gtSj2Qih1jcU1tulty:29visCL+sVIgG2QihFcU1clA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624878311, "uuid": "fc1f62fa-0d36-454e-8149-616e96ab31cd", "value": 6760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624878311, "uuid": "ac590622-e522-4054-9aa9-43b66c4c44d8", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624878311, "uuid": "ee7f539c-7bb8-41f0-ada7-5966c5d76f15", "value": "fdd8c27495fbaa855603df4f774fe86bbc21743f59fd039f734feb07704805bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f0e37d-d7e5-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1624866743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624866743, "uuid": "eeb6c9fa-03d2-413b-9605-9df463004c77", "comment": "Malware payload (Gafgyt)", "value": "8ff6d5e8c93de646c0cdccb627c8a36f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624866743, "uuid": "7989e056-6b37-4700-80e4-fd4713e77096", "comment": "Malware payload (Gafgyt)", "value": "fef509d53f8ad35413153f425ffb6ab6c7e05ee26b974e1ddfb3cfe2f4a49b92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624866743, "uuid": "6f90110d-4ae6-43cb-84b6-96936804143c", "comment": "Malware payload (Gafgyt)", "value": "9c948c8c384dd211821fec39daf6ed3894b1b640", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624866743, "uuid": "a53c0623-f15b-4679-8a62-c56a92c14101", "comment": "Malware payload (Gafgyt)", "value": "9abd10785ce98d35d22262b8b76e350a341f6a4a4303870e885df848a51f4f8f24591fdb7975196614ec9518c96f4309", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624866743, "uuid": "1090b93c-0343-4adc-93c8-a1e07efa34f8", "value": "2AC32A2B3B231E23C0C9547102E31331FAB9C75938B957E3E9D16DAC2F1AA943456BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624866743, "uuid": "d2aa199e-3b90-4461-804f-afaa93c0c835", "value": "3072:m0uGXYT9AnKnNPFjhWphakciJA6lb/+LFP/0nSQJ8R:SlCphakciJA6lb/+LFP/0nSQJ8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624866743, "uuid": "e07a6e18-bfd7-44a6-8623-ea2b0bfe3d51", "value": 127065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624866743, "uuid": "7f390054-3d97-456a-9216-2377503c1925", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624866743, "uuid": "fdde6b5e-d83f-4cbd-9f1d-aadc91ba1a51", "value": "8ff6d5e8c93de646c0cdccb627c8a36f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f643574-d858-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624916017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624916017, "uuid": "0076919c-45fe-4170-9328-d7c9b92ba773", "comment": "Malware payload (AgentTesla)", "value": "925aa9703d26e568e91dbba98d612bc2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624916017, "uuid": "1514412e-0746-467d-87b1-38614c5b0e5d", "comment": "Malware payload (AgentTesla)", "value": "ff077a5864b967557c33367dc1b8d3ef13bf4cd31889df00a9aba634f74254f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624916017, "uuid": "4493eee3-8241-4dce-b824-6b7ba1c1eb6d", "comment": "Malware payload (AgentTesla)", "value": "0fa64b1e364a930df5ce8548dc4e4b6f4453a476", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624916017, "uuid": "eb2168ec-d283-456c-aec8-b1cd0a4f5534", "comment": "Malware payload (AgentTesla)", "value": "112c659d0bb294f118d1fd64aa234d342bb535db33b6fdd184949385444262720abec03d2591f3041a4a301163418965", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624916017, "uuid": "88d24895-9de1-4d87-8178-2ca2a69f2b09", "value": "4EC4E040795C714AF13E2A3929852AA8177EBF12366E901D308D735F07335A7CA76A3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624916017, "uuid": "6ffc874b-80cb-49f5-b753-0b4fe11ca286", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624916017, "uuid": "b656c715-afec-4f5d-b47d-2984bc2d97b5", "value": "12288:kz2ci74olvefv7Twu+MMKVL2jF/cmzV4IUQ6Ni:O2P74olmnHz+M5VEFkmziIV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624916017, "uuid": "4ff3d4da-b822-4682-9511-a7bc89374f76", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624916017, "uuid": "95648df7-a645-4141-ba6e-b2d455741c8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624916017, "uuid": "18b4e8a7-fbed-448d-b51d-74c08fa9b2e6", "value": "BANK SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b1446d-d7d0-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624857634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857634, "uuid": "2b75c85a-e286-4916-886b-6cf085b5b360", "comment": "Malware payload (SnakeKeylogger)", "value": "a2ff46cae10e7a850e13768ae0af83e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857634, "uuid": "9efa59f2-a671-4d50-a890-888438958171", "comment": "Malware payload (SnakeKeylogger)", "value": "ff821b2e8dd742ac85834c33973d92fa8743b8116ac2672dfda63593a2f502c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857634, "uuid": "8ea9cf40-5d39-41a1-a775-137f0276f5c7", "comment": "Malware payload (SnakeKeylogger)", "value": "cb7df06a1ba2824ea61dc8251f66ee9c57035fd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624857634, "uuid": "2709883f-8c2c-4463-a381-fab5827bb874", "comment": "Malware payload (SnakeKeylogger)", "value": "57ad5855e5287a44e6b5a8a0c86969bc578f875ce4f1c03e32d4db778e4baa94ca9d0c7df6d4cf075bc64946e7dc1a0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857634, "uuid": "f2263b46-9cdc-47ad-a343-187a9dce248d", "value": "DC05AE242AE95126F5B61F7C89B0744156BEFE636F17C87D28B132C91733942CAB027E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857634, "uuid": "a0aa2cbd-ea01-41cb-a2c0-7497957c079f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857634, "uuid": "93a85f68-d34a-4319-9f3e-9a120c0777f9", "value": "12288:B9JdGwuo3/b/tbYflHwDBiXE8rdy3yqrNPHcd/d6mrWygn2L8vxzhOArBEMVcK0t:BzdX7wE8rd4JPHKAGL8vnO47cKwXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624857634, "uuid": "ba336500-1798-401a-abfd-66a237f9722c", "value": 870912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624857634, "uuid": "c9d3df75-5ee1-4062-968a-d9014bad067e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624857634, "uuid": "a836740e-02dd-458b-b7df-f8b1a33a194c", "value": "MIP17-MTA002 TBE Clarification Rev. A - EASTERN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }